PSE-STRATA practice question 1 of 25

Which two email links, contained in SMTP and POP3, can be submitted from WildFire analysis with a WildFire subscription? (Choose two.)

Full set: 139 questions
Answer options
A: FTP
B: HTTPS Correct answer
C: RTP
D: HTTP Correct answer
Correct Answer:
B. HTTPS; D. HTTP
Explanation

When a Palo Alto Networks firewall with an active WildFire subscription is configured for email link analysis, it can extract and forward specific types of links from SMTP and POP3 traffic. This feature is designed to combat web-based threats delivered via email, such as phishing and links to malware-hosting sites. The firewall specifically forwards links that use the HTTP and HTTPS protocols to the WildFire cloud for a verdict. WildFire then visits the link in a sandboxed environment to determine if the destination is malicious.

Why Incorrect

A. FTP: While the firewall can inspect files within FTP traffic, the specific feature for forwarding links from emails for analysis is targeted at web protocols.
C. RTP: The Real-time Transport Protocol is used for delivering streaming audio and video; it is not a protocol for hyperlinks that would be analyzed for malicious web content.

References

Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 10.2. "WildFire Analysis for Links in Email." This section explicitly states, "The firewall can be configured to forward HTTP and HTTPS links in email messages to the WildFire analysis cloud."

Palo Alto Networks. (2023). WildFire® Administrator’s Guide 10.2. "Configure WildFire Analysis." The guide details the setup for forwarding different sample types, including email links, specifying HTTP and HTTPS as the supported protocols for this feature.

Scroll to Top