Which two features are key in preventing unknown targeted attacks? (Choose two)

Preventing unknown targeted attacks requires a multi-faceted approach that goes beyond traditional signature-based methods. WildFire cloud threat analysis is specifically designed for this purpose; it executes unknown files and links in a secure sandbox to identify zero-day malware and exploits. Concurrently, implementing a Zero Trust model using App-ID is crucial. App-ID ensures only sanctioned applications are allowed, drastically reducing the attack surface. This principle of least privilege prevents unknown, malicious applications from communicating, thereby thwarting an attacker's ability to establish a foothold or exfiltrate data.

A. The botnet report identifies infections from known command-and-control servers based on regularly updated signatures, not unknown attacks.
D. Single-Pass Parallel Processing (SP3) is a hardware and software architecture that enables high-performance processing, not a threat prevention feature itself.

1. Palo Alto Networks, "WildFire Datasheet," Page 1, "Key Features." Describes how WildFire provides "advanced protection from unknown threats" by identifying "unknown malware, zero-day exploits, and advanced persistent threats (APTs)." (Doc: wildfire-datasheet.pdf)

2. Palo Alto Networks, "PAN-OS® Administrator’s Guide 10.2," App-ID Overview section. Explains that App-ID enables policies that "reduce the attack surface of the network" by blocking unwanted applications, which is a core tenet of Zero Trust for preventing both known and unknown threats.

3. Palo Alto Networks, "What is Zero Trust?," Web Page. "Zero Trust is a strategic approach to cybersecurity that secures an organization by eliminating implicit trust and continuously validating every stage of a digital interaction... Key principles include... least-privileged access." App-ID is the mechanism to enforce this for applications.