Paloalto Networks PCCET Palo Alto Networks Certified Cybersecurity Entry-level Technician Exam Practice Test

Routing protocols are defined at the network layer (Layer 3) of the OSI model. The network layer is responsible for routing packets across different networks using logical addresses (IP addresses). Routing protocols are used to exchange routing information between routers and to determine the best path for data delivery. Some examples of routing protocols are BGP, OSPF, RIP, and EIGRP. Palo Alto Networks devices support advanced routing features using the Advanced Routing Engine1. References: Advanced Routing - Palo Alto Networks | TechDocs, What Is Layer 7? - Palo Alto Networks, How to Configure Routing Information Protocol (RIP)

A meddler-in-the-middle (MITM) attack is a type of Wi-Fi attack where the attacker intercepts and redirects the victim’s web traffic to serve content from a web server it controls. The attacker can use various techniques, such as ARP spoofing, DNS spoofing, or SSL stripping, to trick the victim into connecting to a rogue access point or a proxy server that acts as a middleman between the victim and the legitimate website. The attacker can then modify, inject, or drop the packets that are exchanged between the victim and the website, and perform malicious actions, such as stealing credentials, injecting malware, or displaying fake or misleading content. A MITM attack can compromise the confidentiality, integrity, and availability of the victim’s web traffic and expose them to various risks and threats. References:

• What is a man-in-the-middle attack?
• The 5 most dangerous Wi-Fi attacks, and how to fight them
• What Are Sniffing Attacks, and How Can You Protect Yourself?

Personally identifiable information (PII) is any data that can be used to identify someone. All information that directly or indirectly links to a person is considered PII1. Among PII, some pieces of information are more sensitive than others. Sensitive PII is sensitive information that directly identifies an individual and could cause significant harm if leaked or stolen2. Birthplace and name are examples of sensitive PII, as they can be used to distinguish or trace an individual’s identity, either alone or when combined with other information3. Login 10 and profession are not considered sensitive PII, as they are not unique to a person and do not reveal their identity. Login 10 is a non-sensitive PII that is easily accessible from public sources, while profession is not a PII at all, as it does not link to a specific individual4. References:

• 1: What is PII (personally identifiable information)? - Cloudflare
• 2: What is Personally Identifiable Information (PII)? | IBM
• 3: personally identifiable information - Glossary | CSRC
• 4: What Is Personally Identifiable Information (PII)? Types and Examples

Cortex XSOAR Threat Intelligence Management (TIM) is a platform that enables security teams to manage the lifecycle of threat intelligence, from aggregation to action. One of the key features of Cortex XSOAR TIM is that it automates the ingestion and aggregation of indicators from various sources, such as threat feeds, open-source intelligence, internal data, and third-party integrations 1. Indicators are pieces of information that can be used to identify malicious activity, such as IP addresses, domains, URLs, hashes, etc. By automating the ingestion and aggregation of indicators, Cortex XSOAR TIM reduces the manual effort and time required to collect, validate, and prioritize threat data. It also enables analysts to have a unified view of the global threat landscape and the impact of threats on their network 1. References: 1: Threat Intelligence Management - Palo Alto Networks 2

Prisma Access provides firewall as a service (FWaaS) that protects branch offices from threats while also providing the security services expected from a next-generation firewall. The full spectrum of FWaaS includes threat prevention, URL filtering, sandboxing, and more.

To deliver secure east-west flows and secure Kubernetes workloads in a public cloud environment, you have two deployment options available: VM-Series and CN-Series.

• VM-Series is a virtualized form factor of the Palo Alto Networks next-generation firewall that can be deployed in public cloud platforms such as AWS, Azure, Google Cloud, and Oracle Cloud. VM-Series provides comprehensive network security and threat prevention capabilities for protecting your cloud workloads and applications from cyberattacks. VM-Series can also integrate with native cloud services and third-party tools to enable automation, orchestration, and visibility across your cloud environment. VM-Series supports various deployment scenarios, such as securing internet-facing applications, protecting hybrid connectivity, segmenting internal networks, and enabling secure DevOps12.
• CN-Series is a containerized form factor of the Palo Alto Networks next-generation firewall that can be deployed in Kubernetes environments. CN-Series provides granular network security and threat prevention capabilities for protecting your Kubernetes pods and namespaces from cyberattacks. CN-Series can also integrate with Kubernetes network plugins and services to enable dynamic policy enforcement, service discovery, and visibility across your Kubernetes clusters. CN-Series supports various deployment scenarios, such as securing ingress and egress traffic, enforcing microsegmentation, and enabling secure DevSecOps34.

References:

• VM-Series in Public Cloud
• VM-Series Deployment Guide
• CN-Series in Kubernetes
• CN-Series Deployment Guide

● Benign: Safe and does not exhibit malicious behavior

● Grayware: No security risk but might display obtrusive behavior (for example, adware,

spyware, and browser helper objects)

● Malware: Malicious in nature and intent and can pose a security threat (for example,

viruses, worms, trojans, root kits, botnets, and remote-access toolkits)

● Phishing: Malicious attempt to trick the recipient into revealing sensitive data

2G/2.5G: 2G connectivity remains a prevalent and viable IoT connectivity option due

to the low cost of 2G modules, relatively long battery life, and large installed base of

2G sensors and M2M applications.

○ 3G: IoT devices with 3G modules use either Wideband Code Division Multiple Access

(W-CDMA) or Evolved High Speed Packet Access (HSPA+ and Advanced HSPA+) to

achieve data transfer rates of 384Kbps to 168Mbps.

○ 4G/Long-Term Evolution (LTE): 4G/LTE networks enable real-time IoT use cases, such

as autonomous vehicles, with 4G LTE Advanced Pro delivering speeds in excess of

3Gbps and less than 2 milliseconds of latency.

○ 5G: 5G cellular technology provides significant enhancements compared to 4G/LTE

networks and is backed by ultra-low latency, massive connectivity and scalability for

IoT devices, more efficient use of the licensed spectrum, and network slicing for

application traffic prioritization.

Multiple policies, no policy reconciliation tools: Sequential traffic analysis (stateful inspection, application control, intrusion prevention system (IPS), anti-malware, etc.) in traditional data center security solutions requires a corresponding security policy or profile, often using multiple management tools. The result is that your security policies become convoluted as you build and manage a firewall policy with source, destination, user, port, and action; an application control policy with similar rules; and any other threat prevention rules required. Multiple security policies that mix positive (firewall) and negative (application control, IPS, and anti-malware) control models can cause security holes by missing traffic and/or not identifying

Event Viewer is a native Windows application that can be used to inspect actions taken at a specific time. Event Viewer displays detailed information about significant events on your computer, such as application, security, system, and setup events. You can use Event Viewer to monitor and troubleshoot problems with your computer, such as hardware failures, software errors, security breaches, network issues, etc. Event Viewer allows you to filter, sort, and search events by various criteria, such as date and time, event level, event source, event ID, etc. You can also view the event properties, which provide more details about the event, such as the event description, user name, computer name, event data, etc. Event Viewer can help you identify the root cause of a problem, or provide evidence of a malicious activity, by inspecting the actions taken at a specific time on your computer. References:

• Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET) - Palo Alto Networks
• WinAppDriver and Desktop UI Test Automation - Microsoft Tech Community
• Palo Alto Networks PCCET Quiz 1 Topic 14 Questions 1-5 - Buddy4Exam
• Paloalto Networks Exam PCCET Questions and Answers - DumpsMate
• Event Viewer - Windows 10 - Microsoft Docs

SIEM stands for security information and event management. It is a technology that collects, analyzes, and reports on security-related data from various sources within an organization’s network. The purpose of SIEM is to provide real-time monitoring and analysis of security events, such as user logins, file access, and changes to critical system files. SIEM helps security teams to detect and respond to potential threats, as well as to meet compliance requirements and improve their cybersecurity posture. References: What Is Security Information and Event Management (SIEM)? - Palo Alto Networks, What is a SIEM Solution? - Palo Alto Networks, Integrate IoT Security with SIEM - Palo Alto Networks

According to the NIST definition, cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction1. One of the essential characteristics of cloud computing is on-demand self-service, which means that users can request and obtain computing resources as needed, without requiring human intervention from the service provider2. On-demand network services are an example of this characteristic, as they allow users to access network resources such as bandwidth, routing, firewall, or load balancing, on demand and in a scalable manner3. References:

• The NIST definition of cloud computing
• SP 800-145, The NIST Definition of Cloud Computing | CSRC
• On-Demand Network Services - Palo Alto Networks

● Reduce the attack surface: Best-of-breed technologies that are natively integrated provide a prevention architecture that inherently reduces the attack surface. This type of architecture allows organizations to exert positive control based on applications, users, and content, with support for open communication, orchestration, and visibility.

● Prevent all known threats, fast: A coordinated security platform accounts for the full scope of an attack across the various security controls that compose the security posture, thus enabling organizations to quickly identify and block known threats.

● Detect and prevent new, unknown threats with automation: Security that simply detects

threats and requires a manual response is too little, too late. Automated creation and

delivery of near-real-time protections against new threats to the various security solutions in the organization’s environments enable dynamic policy updates. These updates are

designed to allow enterprises to scale defenses with technology, rather than people.

Prisma SaaS connects directly to the applications themselves, therefore providing continuous silent monitoring of the risks within the sanctioned SaaS applications, with detailed visibility that is not possible with traditional security solutions.

Local systems can eliminate vulnerabilities by patching systems and software effectively and continuously. Patching is the process of applying updates or fixes to software or hardware components that have known vulnerabilities or bugs. Patching can prevent attackers from exploiting these vulnerabilities and compromising the security or functionality of the systems. Patching should be done regularly and promptly, as new vulnerabilities are constantly discovered and exploited by cybercriminals. Patching should also be done effectively, meaning that the patches are tested and verified before deployment, and that they do not introduce new vulnerabilities or issues. Patching should also be done continuously, meaning that the systems are monitored for new vulnerabilities and patches are applied as soon as they are available. Continuous patching can reduce the window of opportunity for attackers to exploit unpatched vulnerabilities and cause damage or data breaches. References:

•1: What is Patch Management? | Palo Alto Networks

•2: Patch Management Best Practices: How to Keep Your Systems Secure | Snyk

•3: Vulnerability Remediation Process - 4 Steps to Remediation | Snyk

Virtualization improves the availability of IT systems and resources by enabling features such as12:

• Resource optimization: Virtualization allows multiple virtual instances to share the same physical infrastructure, reducing hardware costs and increasing resource utilization.
• Scalability: Virtualization enables rapid provisioning and deprovisioning of virtual instances, allowing organizations to scale up or down their IT capacity according to demand.
• Disaster recovery: Virtualization facilitates backup and replication of virtual instances, allowing organizations to restore their IT systems and data in the event of a disaster or outage.
• Fault tolerance: Virtualization supports high availability and load balancing of virtual instances, ensuring that IT systems and services remain operational even if one or more virtual instances fail. References: Virtualization Benefits: How Virtualization Improves Efficiency and Security | VMware, Virtualization Security - A Complete Guide - CyberExperts.com

When you enable URL Filtering, all web traffic is compared against the URL Filtering database, PAN-DB, which contains millions of URLs that have been grouped into about 65 categories.

A layer 2 switch will break up collision domains but not broadcast domains. To break up broadcast domains you need a Layer 3 switch with vlan capabilities.

In addition to local analysis, Cortex XDR can send unknown files to WildFire for discovery and deeper analysis to rapidly detect.

A stateless firewall is a network firewall that primarily filters traffic based on source and destination IP address, as well as port numbers and protocols. A stateless firewall does not keep track of the state or context of network connections, and only inspects packet headers. A stateless firewall is faster and simpler than a stateful firewall, but it is less secure and flexible. A stateless firewall cannot block complex attacks or inspect packet contents for malicious payloads. References: What Is a Packet Filtering Firewall? - Palo Alto Networks, Common IP Filtering Techniques – APNIC, What is IP filtering? - Secure Network Traffic Management

A botnet is a network of computers or devices that are infected by malware and controlled by a malicious actor, known as the botmaster or bot-herder. The botmaster uses a command and control (C2) server or channel to send instructions to the bots and receive information from them. The C2 communication is essential for the botmaster to maintain control over the botnet and use it for various malicious purposes, such as launching distributed denial-of-service (DDoS) attacks, stealing data, sending spam, or mining cryptocurrency. Therefore, the key to “taking down” a botnet is to prevent the bots from communicating with the C2 server or channel. This can be done by disrupting, blocking, or hijacking the C2 communication, which can render the botnet ineffective, unstable, or inaccessible. For example, security researchers or law enforcement agencies can use techniques such as sinkholing, domain name system (DNS) poisoning, or domain seizure to redirect the bot traffic to a benign server or a dead end, cutting off the connection between the bots and the botmaster. Alternatively, they can use techniques such as reverse engineering, decryption, or impersonation to infiltrate the C2 server or channel and take over the botnet, either to disable it, monitor it, or use it for good purposes. References:

• What is a Botnet? - Palo Alto Networks
• Botnet Detection and Prevention Techniques | A Quick Guide - XenonStack
• Botnet Mitigation: How to Prevent Botnet Attacks in 2024 - DataDome
• What is a Botnet? Definition and Prevention | Varonis

Web 2.0 applications provide the type of service known as Software as a Service (SaaS). SaaS is a cloud computing model that allows users to access and use web-based applications over the internet, without having to install or maintain any software on their own devices. SaaS applications are hosted and managed by a third-party provider, who is responsible for the security, performance, availability, and updates of the software. SaaS applications are typically accessed through a web browser or a mobile app, and offer features such as user-generated content, social networking, collaboration, and interoperability. Examples of Web 2.0 SaaS applications include Facebook, X, Wikipedia, Gmail, and Salesforce. References:

• What Is Web 2.0? Definition, Impact, and Examples - Investopedia
• Web 2.0 - Wikipedia
• [What is SaaS? Software as a service (SaaS) definition - Salesforce.com]

 A rootkit is a type of malware that enables cyber criminals to gain access to and infiltrate data from machines without being detected. It covers software toolboxes designed to infect computers, give the attacker remote control, and remain hidden for a long period of time1 One of the most prominent characteristics of a rootkit is that it cannot be detected by antivirus because of its masking techniques. A rootkit may be able to subvert the software that is intended to find it, such as by hooking system calls, modifying kernel objects, or tampering with the registry2 Another prominent characteristic of a rootkit is that it takes control of the operating system. A rootkit may install itself in the kernel or the firmware of the device, giving it the highest level of privilege and access. A rootkit may also replace the bootloader or the BIOS of the machine, making it difficult to remove. A rootkit can use its control over the operating system to launch other malware, such as ransomware, bots, keyloggers, or trojans34 References:

• 1: What Is a Rootkit? How to Defend and Stop Them? | Fortinet
• 2: Rootkit - Wikipedia
• 3: What Is a Rootkit? – Microsoft 365
• 4: What is Rootkit? Attack Definition & Examples - CrowdStrike

Selective network security virtualization: Intra-host communications and live migrations are architected at this phase. All intra-host communication paths are strictly controlled to ensure that traffic between VMs at different trust levels is intermediated either by an on-box, virtual security appliance or by an off-box, physical security appliance.

North-South traffic refers to the data packets that move between the virtualized environment and the external network, such as the internet or a traditional data center. This traffic typically involves requests from clients to access applications or services hosted on virtual machines (VMs) or containers, or responses from those VMs or containers to the clients. North-South traffic can also include management or monitoring traffic from external devices to the virtualized environment. References: Fundamentals of Cloud Security, East-West and North-South Traffic Security, What is the meaning / origin of the terms north-south and east-west traffic?

 If an endpoint does not know how to reach its destination, it will send data to the specified default gateway. A default gateway is a device that routes traffic from a local network to other networks or the internet. The endpoint will use the default gateway’s IP address as the next hop for packets that are destined for unknown or remote networks. The default gateway will then forward the packets to the appropriate destination or another gateway, based on its routing table. References:

• Fundamentals of Network Security, Module 2: Networking Concepts, Lesson 2: IP Addressing and Routing1
• PCCET Study Guide, Section 2.2: Describe IP Addressing and Routing2

A Type 1 hypervisor, also known as a bare-metal hypervisor, is a software layer that runs directly on the hardware of a physical host computer, without requiring an underlying operating system. A Type 1 hypervisor can create and manage multiple isolated virtual machines (VMs), each with its own virtual (or guest) operating system and applications. A Type 1 hypervisor is hardened against cyber attacks, as it has a smaller attack surface and fewer vulnerabilities than a Type 2 hypervisor, which runs within an operating system. A Type 1 hypervisor also offers better performance, scalability, and resource utilization than a Type 2 hypervisor. References: 10 Palo Alto Networks PCCET Exam Practice Questions, Palo Alto Networks Certified Cybersecurity Entry-level Technician v1.0, FREE Cybersecurity Education Courses.

An encoded string is a common technique used by attackers to obfuscate their malicious code or data. By decoding the string, a security operations engineer can reveal the true nature and intent of the attacker, and potentially discover indicators of compromise (IOCs) such as IP addresses, domain names, file names, etc. Decoding the string can also help the engineer to determine the type and severity of the incident, and the appropriate response actions. Therefore, decoding the string and continuing the investigation is the best option among the given choices. Saving the string to a new file and running it in a sandbox may be risky, as it could execute the malicious code and cause further damage. Running the string against VirusTotal may not yield any useful results, as the string may not be recognized by any antivirus engines. Appending the string to the investigation notes but not altering it may not provide any additional insight into the incident, and may delay the response process. References:

• 1: SANS Digital Forensics and Incident Response Blog | Strings, Strings, Are Wonderful Things
• 2: 5 Minute Forensics: Decoding PowerShell Payloads - Tevora
• 3: Known plaintext analysis of encoded strings - SANS Institute
• 4: Palo Alto Networks Certified Cybersecurity Entry-level Technician - Palo Alto Networks
• 5: 10 Palo Alto Networks PCCET Exam Practice Questions - CBT Nuggets

Short-range wireless:

● Adaptive Network Technology+ (ANT+): ANT+ is a proprietary multicast wireless sensor

network technology primarily used in personal wearables, such as sports and fitness sensors.

● Bluetooth/Bluetooth Low-Energy (BLE): Bluetooth is a low-power, short-range

communications technology primarily designed for point-to-point communications between wireless devices in a hub-and-spoke topology. BLE (also known as Bluetooth Smart or Bluetooth 4.0+) devices consume significantly less power than Bluetooth devices and can access the internet directly through 6LoWPAN connectivity.

● Internet Protocol version 6 (IPv6) over Low-Power Wireless Personal Area Networks

(6LoWPAN): 6LoWPAN allows IPv6 traffic to be carried over low-power wireless mesh

networks. 6LoWPAN is designed for nodes and applications that require wireless internet

connectivity at relatively low data rates in small form factors, such as smart light bulbs

and smart meters.

● Wi-Fi/802.11: The Institute of Electrical and Electronics Engineers (IEEE) defines the 802

LAN protocol standards. 802.11 is the set of standards used for Wi-Fi networks typically

operating in the 2.4GHz and 5GHz frequency bands. The most common implementations

today include:

‒ 802.11n (labeled Wi-Fi 4 by the Wi-Fi Alliance), which operates on both 2.4GHz and 5GHz

bands at ranges from 54Mbps to 600Mbps

‒ 802.11ac (Wi-Fi 5), which operates on the 5GHz band at ranges from 433Mbps to 3.46

Gbps

‒ 802.11ax (Wi-Fi 6), which operates on the 2.4GHz and 5GHz bands (and all bands between 1 and 6GHz, when they become available for 802.11 use) at ranges up to 11Gbps

● Z-Wave: Z-Wave is a low-energy wireless mesh network protocol primarily used for home

automation applications such as smart appliances, lighting control, security systems,

smart thermostats, windows and locks, and garage doors.

● Zigbee/802.14: Zigbee is a low-cost, low-power wireless mesh network protocol based on the IEEE 802.15.4 standard. Zigbee is the dominant protocol in the low-power networking market, with a large installed base in industrial environments and smart home products.

Micro-segmentation is a VM-Series virtual firewall cloud deployment use case that reduces your environment’s attack surface. Micro-segmentation is the process of dividing a network into smaller segments, each with its own security policies and controls. This helps to isolate and protect workloads from lateral movement and unauthorized access, as well as to enforce granular trust zones and application dependencies. Micro-segmentation can be applied to virtualized data centers, private clouds, and public clouds, using software-defined solutions such as VMware NSX, Cisco ACI, and Azure Virtual WAN. References: Micro-Segmentation - Palo Alto Networks, VM-Series Deployment Guide - Palo Alto Networks, VM-Series on VMware NSX - Palo Alto Networks, VM-Series on Cisco ACI - Palo Alto Networks, VM-Series on Azure Virtual WAN - Palo Alto Networks

 A SIEM (Security Information and Event Management) is a system that collects, analyzes, and correlates security logs from multiple sources, such as endpoints, firewalls, servers, etc. A SIEM can provide a centralized and comprehensive view of the security posture of an organization, as well as detect and respond to threats. Configuring endpoints to forward logs to a SIEM is the recommended method for collecting security logs from multiple endpoints, as it reduces the network bandwidth and storage requirements, simplifies the log management process, and enables faster and more effective security analysis. Leveraging an EDR (Endpoint Detection and Response) solution to request the logs from endpoints is not recommended, as it may cause performance issues on the endpoints, increase the network traffic, and create a dependency on the EDR solution. Connecting to the endpoints remotely and downloading the logs is not recommended, as it is a manual and time-consuming process, prone to errors and inconsistencies, and may expose the endpoints to unauthorized access. Building a script that pulls down the logs from all endpoints is not recommended, as it requires technical skills and maintenance, may not be compatible with different endpoint platforms, and may introduce security risks if the script is compromised or misconfigured. References:

• Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET) - Palo Alto Networks
• Fundamentals of Security Operations Center (SOC)
• 10 Palo Alto Networks PCCET Exam Practice Questions - CBT Nuggets

Identity and access management (IAM) is a software service or framework that allows organizations to define user or group identities within software environments, then associate permissions with them. The identities and permissions are usually spelled out in a text file, which is referred to as an IAM policy.

Static routing is a form of routing that occurs when a router uses a manually-configured routing entry, rather than information from dynamic routing traffic 1. Static routing has some advantages, such as simplicity, low overhead, and full control, but it also has some disadvantages, such as:

•Manual reconfiguration: Static routes require manual effort to configure and maintain. This can be time-consuming and error-prone, especially in large networks with many routes. If there is a change in the network topology or a link failure, the static routes need to be updated manually by the network administrator 23.

•Single point of failure: Static routing is not fault tolerant. This means that if the path used by the static route stops working, the traffic will not be rerouted automatically. The network will be unreachable until the failure is repaired or the static route is changed manually. Dynamic routing, on the other hand, can adapt to network changes and find alternative paths 23.

References: 1: Static routing - Wikipedia 2: Explain the benefits and drawbacks of static routing - Cisco Community 3: Dynamic versus Static Routing (3.1.2) - Cisco Press

Routing Information Protocol (RIP) is an example of a distance-vector routing protocol that uses hop count as its routing metric. To prevent routing loops, in which packets effectively get stuck bouncing between various router nodes, RIP implements a hop limit of 15, which limits the size of networks that RIP can support. After a data packet crosses 15 router nodes (hops) between a source and a destination, the destination is considered unreachable.

According to the NIST definition of cloud computing1, there are three service models for cloud computing: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). In the SaaS model, the cloud provider delivers the software applications over the internet, and the users access them from various devices through a web browser or a program interface. The cloud provider manages the underlying infrastructure, including the servers, databases, and code of the applications. The users do not need to install, update, or maintain the software, and they only pay for the service they use. The scenario described in the question is an example of the SaaS model, as the user is provided access over the internet to an application running on a cloud infrastructure, and the vendor hosts and maintains the servers, databases, and code of that application. References:

• SP 800-145, The NIST Definition of Cloud Computing | CSRC
• Final Version of NIST Cloud Computing Definition Published
• NIST Cloud Computing Program - NCCP | NIST

SaaS - User responsible for only the data, vendor responsible for rest

page 211 "Consolidating servers within trust levels: Organizations often consolidate servers within the same trust level into a single virtual computing environment: ... ... ... This virtual systems capability enables a single physical device to be used to simultaneously meet the unique requirements of multiple VMs or groups of VMs. Control and protection of inter-host traffic with physical network security appliances that are properly positioned and configured is the primary security focus."

Cortex XSOAR enhances Security Operations Center (SOC) efficiency with the world’s most comprehensive operating platform for enterprise security. Cortex XSOAR unifies case management, automation, real-time collaboration, and native threat intel management in the industry’s first extended security orchestration, automation, and response (SOAR) offering.

OSPF is a link-state routing protocol that requires all routers in the same domain to maintain a map of the network. This map is called the link-state database (LSDB) and it contains information about the topology and the state of each link. Each router independently calculates the shortest path to every destination in the network using the Dijkstra algorithm. OSPF routers exchange routing information by flooding link-state advertisements (LSAs) to their neighbors. LSAs are acknowledged by the receivers to ensure reliable delivery12. References:

• What Is OSPF? Understanding Network Protocols By WireX Systems
• Routing Protocols Overview - Global Knowledge

IaaS (Infrastructure as a Service) is a cloud computing model that delivers on-demand infrastructure resources to organizations via the cloud, such as compute, storage, networking, and virtualization1. Customers do not have to manage, maintain, or update their own data center infrastructure, but are responsible for the operating system, middleware, virtual machines, and any apps or data1. Therefore, IaaS gives customers full control over the operating system(s) running on their cloud computing platform, as well as the flexibility to customize and configure their infrastructure according to their needs2. References: What are the different types of cloud computing? | Google Cloud, PaaS vs IaaS vs SaaS: What’s the difference? | Google Cloud

Tunneling is a method of transporting data across a network using protocols that are not supported by that network. Tunneling works by encapsulating packets: wrapping packets inside of other packets. Tunneling within commonly used services is a technique that uses file sharing or an instant messenger client such as Meebo running over HTTP to bypass firewalls or other network restrictions. The data packets are encapsulated within HTTP packets and sent as normal web traffic. This way, the data packets can reach their destination without being blocked or detected by the network. References: What is tunneling? | Tunneling in networking | Cloudflare, What Is Network Tunneling & How Is It Used? | Traefik Labs, networking - What is HTTP tunneling? - Stack Overflow

SaaS applications are cloud-based software that users can access from anywhere and any device. This poses a challenge for organizations to ensure that their employees are using the SaaS applications in a secure and compliant manner. Therefore, organizations need to establish and enforce acceptable use policies (AUPs) for SaaS applications that define the rules and guidelines for accessing and using the applications, such as who can use them, what data can be stored or shared, and what actions are prohibited12. AUPs help organizations to protect their data, prevent unauthorized access, and comply with local regulations and standards3. References: Using Software as a Service (SaaS) securely - NCSC, Minimum Security Standards for Software-as-a-Service (SaaS) and Platform-as-a-Service (PaaS) | University IT, How to Secure Your SaaS Applications - CyberArk

● Application (Layer 7 or L7): This layer identifies and establishes availability of communication partners, determines resource availability, and synchronizes communication.

● Presentation (Layer 6 or L6): This layer provides coding and conversion functions (such as data representation, character conversion, data compression, and data encryption) to ensure that data sent from the Application layer of one system is compatible with the Application layer of the receiving system.

● Session (Layer 5 or L5): This layer manages communication sessions (service requests and service responses) between networked systems, including connection establishment, data transfer, and connection release.

● Transport (Layer 4 or L4): This layer provides transparent, reliable data transport and

end-to-end transmission control.

● Type 1 (native or bare metal). Runs directly on the host computer’s hardware

● Type 2 (hosted). Runs within an operating system environment

Examples of serverless environments include Amazon Lambda and Azure Functions. Many PaaS offerings, such as Pivotal Cloud Foundry, also are effectively serverless even if they have not historically been marketed as such. Although serverless may appear to lack the container-specific, cloud native attribute, containers are extensively used in the underlying implementations, even if those implementations are not exposed to end users directly.

Simplicity: Because each device is centrally managed, with routing based on application policies, WAN managers can create and update security rules in real time as network requirements change. Also, when SD-WAN is combined with zero-touch provisioning, a feature that helps automate the deployment and configuration processes, organizations can further reduce the complexity, resources, and operating expenses required to spin up new sites. ● Improved performance: By allowing efficient access to cloud-based resources without the need to backhaul traffic to centralized locations, organizations can provide a better user experience.

SOAR stands for security orchestration, automation and response. It is a software solution that enables security teams to integrate and coordinate separate tools into streamlined threat response workflows. SOAR systems allow for accelerated incident response through the execution of standardized and automated playbooks that work upon inputs from security technology and other data flows. SOAR systems can also help ensure consistency, reduce human errors, and improve efficiency and scalability of security operations. References:

• Security Operations Infrastructure from Palo Alto Networks
• What is SOAR (security orchestration, automation and response)? from IBM
• Security Operations Fundamentals (SOF) Flashcards from Quizlet