Paloalto Networks Practitioner Based on Real Exam Environment

Attack communication traffic is usually hidden with various techniques and

tools, including:

● Encryption with SSL, SSH (Secure Shell), or some other custom or proprietary encryption

● Circumvention via proxies, remote access tools, or tunneling. In some instances, use of

cellular networks enables complete circumvention of the target network for attack C2 traffic.

● Port evasion using network anonymizers or port hopping to traverse over any available open

ports

● Fast Flux (or Dynamic DNS) to proxy through multiple infected endpoints or multiple,

ever-changing C2 servers to reroute traffic and make determination of the true destination

or attack source difficult

● DNS tunneling is used for C2 communications and data infiltration

SOAR stands for security orchestration, automation and response. It is a software solution that enables security teams to integrate and coordinate separate tools into streamlined threat response workflows. SOAR systems allow for accelerated incident response through the execution of standardized and automated playbooks that work upon inputs from security technology and other data flows. SOAR systems can also help ensure consistency, reduce human errors, and improve efficiency and scalability of security operations. References:

Security Operations Infrastructure from Palo Alto Networks

What is SOAR (security orchestration, automation and response)? from IBM

Security Operations Fundamentals (SOF) Flashcards from Quizlet

Originally designed as a tool to assist organizations with compliance and industry-specific regulations, security information and event management (SIEM) is a technology that has been around for almost two decades