PCCET Palo Alto Networks Certified Cybersecurity Entry-level Technician Questions and Answers

"Or split tunneling can be configured to allow internet traffic from the device to go directly to the internet, while other specific types of traffic route through the IPsec tunnel, for acceptable protection with much less performance degradation."

Signature-based antivirus software is a type of security software that uses signatures to identify malware. Signatures are bits of code that are unique to a specific piece of malware. When signature-based antivirus software detects a piece of malware, it compares the signature to its database of known signatures12. If a match is found, the software can do three things to provide protection:

• Alert system administrators: The software can notify the system administrators or the users about the malware detection, and provide information such as the name, type, location, and severity of the malware. This can help the administrators or the users to take appropriate actions to prevent further damage or infection3.
• Quarantine the infected file: The software can isolate the infected file from the rest of the system, and prevent it from accessing or modifying any other files or processes. This can help to contain the malware and limit its impact on the system4.
• Delete the infected file: The software can remove the infected file from the system, and prevent it from running or spreading. This can help to eliminate the malware and restore the system to a clean state4.

References:

• What is a signature-based antivirus? - Info Exchange
• What is a Signature and How Can I detect it? - Sophos
• How Does Heuristic Analysis Antivirus Software Work?
• What Is Signature-based Malware Detection? | RiskXchange

 In SecOps, the identify stage is the first step in the security operations lifecycle. It involves gaining knowledge and understanding of the possible security threats and establishing methods to detect, respond and proactively prevent them from occurring1. Two of the components included in the identify stage are:

• Initial Research: This component involves gathering information about the organization’s assets, vulnerabilities, risks, and compliance requirements. It also involves identifying the key stakeholders, objectives, and metrics for the SecOps project2.
• Content Engineering: This component involves developing and maintaining the security content, such as rules, policies, signatures, and alerts, that will be used by the SecOps tools and processes. It also involves testing and validating the security content for accuracy and effectiveness3.

References: What is SecOps? (and what are the benefits and best practices?), SecOps - definition & overview, The Six Pillars of Effective Security Operations

 A SIEM (Security Information and Event Management) is a system that collects, analyzes, and correlates security logs from multiple sources, such as endpoints, firewalls, servers, etc. A SIEM can provide a centralized and comprehensive view of the security posture of an organization, as well as detect and respond to threats. Configuring endpoints to forward logs to a SIEM is the recommended method for collecting security logs from multiple endpoints, as it reduces the network bandwidth and storage requirements, simplifies the log management process, and enables faster and more effective security analysis. Leveraging an EDR (Endpoint Detection and Response) solution to request the logs from endpoints is not recommended, as it may cause performance issues on the endpoints, increase the network traffic, and create a dependency on the EDR solution. Connecting to the endpoints remotely and downloading the logs is not recommended, as it is a manual and time-consuming process, prone to errors and inconsistencies, and may expose the endpoints to unauthorized access. Building a script that pulls down the logs from all endpoints is not recommended, as it requires technical skills and maintenance, may not be compatible with different endpoint platforms, and may introduce security risks if the script is compromised or misconfigured. References:

• Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET) - Palo Alto Networks
• Fundamentals of Security Operations Center (SOC)
• 10 Palo Alto Networks PCCET Exam Practice Questions - CBT Nuggets

"Weaponization: Next, attackers determine which methods to use to compromise a target endpoint. They may choose to embed intruder code within seemingly innocuous files such as a PDF or Microsoft Word document or email message."

TCP stands for Transmission Control Protocol, and it is one of the main protocols used in the internet. TCP provides reliable, ordered, and error-free delivery of data between applications 1. In terms of the OSI model, TCP is a transport-layer protocol. The transport layer is the fourth layer of the OSI model, and it is responsible for establishing end-to-end connections, segmenting data into packets, and ensuring reliable and efficient data transfer 2. The transport layer also provides flow control, congestion control, and error detection and correction mechanisms 2. TCP is not the only transport-layer protocol; another common one is UDP (User Datagram Protocol), which is faster but less reliable than TCP 3. References: 1: TCP/IP TCP, UDP, and IP protocols - IBM 2: Transport Layer | Layer 4 | The OSI-Model 3: TCP/IP Model vs. OSI Model | Similarities and Differences - Fortinet

List three advantages of serverless computing over

CaaS: - Reduce costs - Increase agility - Reduce operational overhead

An AAAA record is a type of DNS record that maps a domain name or a subdomain to an IPv6 address. IPv6 is the latest version of the Internet Protocol (IP) that uses 128-bit addresses to identify devices on the internet. An AAAA record is similar to an A record, which maps a domain name or a subdomain to an IPv4 address, but with a different format and length. An example of an AAAA record is:

example-website.com. IN AAAA 2001:db8::1234

In the example above, the record is made up of the following elements:

• example-website.com.: The domain name or the subdomain that is mapped to an IPv6 address.
• IN: The class of the record, which indicates that it is on the internet.
• AAAA: The type of the record, which indicates that it is an IPv6 address record.
• 2001:db8::1234: The IPv6 address that is mapped to the domain name or the subdomain. The address is written in hexadecimal notation, with colons separating each 16-bit segment. Double colons (::) can be used to compress consecutive zero segments.

References:

• Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET) - Palo Alto Networks
• DNS AAAA record | Cloudflare
• What’s an AAAA record? - DNSimple Help
• List of DNS record types - Wikipedia

North-south refers to data packets that move in and out of the virtualized environment from the host network or a corresponding traditional data center. North-south traffic is secured by one or more physical form factor perimeter edge firewalls.

A next-generation firewall (NGFW) is a security component that can detect command-and-control (C2) traffic sent from multiple endpoints within a corporate data center. A NGFW is a network device that combines traditional firewall capabilities with advanced features such as application awareness, intrusion prevention, threat intelligence, and cloud-based analysis. A NGFW can identify and block C2 traffic by inspecting the application layer protocols, signatures, and behaviors of the network traffic, as well as correlating the traffic with external sources of threat intelligence. A NGFW can also leverage inline cloud analysis to detect and prevent zero-day C2 threats in real-time. A NGFW can provide granular visibility and control over the network traffic, as well as generate alerts and reports on the C2 activity. References:

• Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)
• Command and Control, Tactic TA0011 - Enterprise | MITRE ATT&CK®
• Advanced Threat Prevention: Inline Cloud Analysis - Palo Alto Networks

 A demilitarized zone (DMZ) is a portion of an enterprise network that sits behind a firewall but outside of or segmented from the internal network1. The DMZ typically hosts public services, such as web, mail, and domain servers, that can be accessed by traffic from the internet1. However, the DMZ is isolated from the internal network by another firewall or security gateway, which prevents unauthorized access to the private network2. Therefore, statements A and D are true about servers in a DMZ, while statements B and C are false. References:

• What is a Demilitarized Zone (DMZ)? | F5
• Demilitarized Zones (DMZs) - Secure Network Architecture - CompTIA …

 An exploit is a type of malware that takes advantage of a vulnerability on an endpoint or server to execute malicious code, gain unauthorized access, or perform other malicious actions. Exploits can be categorized into known and unknown (i.e., zero-day) exploits, depending on whether the vulnerability is publicly disclosed or not12. Exploits can target various types of software, such as operating systems, browsers, applications, or network devices3. References: Malware vs. Exploits, Top Routinely Exploited Vulnerabilities, 12 Types of Malware + Examples That You Should Know, Palo Alto Networks Certified Cybersecurity Entry-level Technician

The six pillars include:

1. Business (goals and outcomes)

2. People (who will perform the work)

3. Interfaces (external functions to help achieve goals)

4. Visibility (information needed to accomplish goals)

5. Technology (capabilities needed to provide visibility and enable people)

6. Processes (tactical steps required to execute on goals)

Cortex XDR is a detection and response platform that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. A key benefit of Cortex XDR is that it acts as a safety net during an attack while patches are developed. Cortex XDR uses machine learning and behavioral analytics to detect and validate threats, and automatically reveals the root cause of alerts to speed up investigations. Cortex XDR also enables flexible and rapid response actions to contain and remediate threats across the environment. References: Cortex XDR- Extended Detection and Response - Palo Alto Networks, What is Cortex XDR | Palo Alto Networks, Cortex XDR Datasheet - Palo Alto Networks

To maximize the use of a network address, the administrator should use the subnet that can accommodate the required number of hosts with the least amount of wasted IP addresses. The subnet mask determines how many bits are used for the network portion and the host portion of the IP address. The more bits are used for the network portion, the more subnets can be created, but the fewer hosts can be assigned to each subnet. The formula to calculate the number of hosts per subnet is

2(32−n)−2

, where

n

is the number of bits in the network portion of the subnet mask. For example, a /30 subnet mask has 30 bits in the network portion, so the number of hosts per subnet is

2(32−30)−2=2

A /25 subnet mask has 25 bits in the network portion, so the number of hosts per subnet is

2(32−25)−2=126

The subnet 192.168.6.0/25 can accommodate 126 hosts, which is enough for the network with 120 hosts. The subnet 192.168.6.168/30 can only accommodate 2 hosts, which is not enough. The subnet 192.168.6.160/29 can accommodate 6 hosts, which is also not enough. The subnet 192.168.6.128/27 can accommodate 30 hosts, which is enough, but it wastes more IP addresses than the /25 subnet. Therefore, the best option is B. 192.168.6.0/25. References:

• Getting Started: Layer 3 Subinterfaces - Palo Alto Networks Knowledge Base
• DotW: Multiple IP Addresses on an Interface - Palo Alto Networks Knowledge Base
• Configure NAT - Palo Alto Networks | TechDocs

802.11ax, also known as Wi-Fi 6, is an internet of things (IoT) connectivity technology that operates on the 2.4GHz and 5GHz bands, as well as all bands between 1 and 6GHz when they become available for 802.11 use, at ranges up to 11 Gbit/s. 802.11ax is designed to improve the performance, efficiency, and capacity of wireless networks, especially in high-density environments such as smart homes, smart cities, and industrial IoT. 802.11ax uses various techniques such as orthogonal frequency division multiple access (OFDMA), multi-user multiple input multiple output (MU-MIMO), target wake time (TWT), and 1024 quadrature amplitude modulation (QAM) to achieve higher data rates, lower latency, longer battery life, and reduced interference for IoT devices. References:

•Wi-Fi 6 (802.11ax) - Palo Alto Networks

•What is Wi-Fi 6? | Wi-Fi 6 Features and Benefits | Cisco

•What is Wi-Fi 6 (802.11ax)? - Definition from WhatIs.com

page 211 "Consolidating servers within trust levels: Organizations often consolidate servers within the same trust level into a single virtual computing environment: ... ... ... This virtual systems capability enables a single physical device to be used to simultaneously meet the unique requirements of multiple VMs or groups of VMs. Control and protection of inter-host traffic with physical network security appliances that are properly positioned and configured is the primary security focus."

Cortex XDR is a security analytics platform that converges logs from network, identity, endpoint, application, and other security relevant sources to generate high-fidelity behavioral alerts and facilitate rapid incident analysis, investigation, and response1. Cortex XDR uses machine learning algorithms to automate data analysis and apply modeling in real time, helping organizations to reduce analyst workloads and improve security1. Cortex XDR also integrates with Palo Alto Networks next-generation firewalls and other security tools to streamline and speed network security response2. References: Security Analytics - Palo Alto Networks, Network Security Automation - Palo Alto Networks

To find the subnet that the host 192.168.19.36/27 belongs to, we need to convert the IP address and the subnet mask to binary form and perform a logical AND operation. The /27 notation means that the subnet mask has 27 bits of ones and 5 bits of zeros. In decimal form, the subnet mask is 255.255.255.224. The binary form of the IP address and the subnet mask are:

IP address: 11000000.10101000.00010011.00100100 Subnet mask: 11111111.11111111.11111111.11100000

The logical AND operation gives us the network prefix:

Network prefix: 11000000.10101000.00010011.00100000

To get the subnet address, we convert the network prefix back to decimal form:

Subnet address: 192.168.19.32

The subnet address is the first address in the subnet range. To find the last address in the subnet range, we flip the bits of the subnet mask and perform a logical OR operation with the network prefix:

Flipped subnet mask: 00000000.00000000.00000000.00011111 Logical OR: 11000000.10101000.00010011.00111111

The last address in the subnet range is:

Last address: 192.168.19.63

The subnet range is from 192.168.19.32 to 192.168.19.63. The host 192.168.19.36 belongs to this subnet. Therefore, the correct answer is B. 192.168.19.16, which is the second address in the subnet range.

References:

• IP Subnet Calculator
• Subnet Calculator - IP and CIDR
• Which subnet does the host 192.168.19.36/27 belong? - VCEguide.com

According to the NIST definition of cloud computing, Infrastructure as a Service (IaaS) is a cloud service model that provides “the capability to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications” 1. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls) 1. In other words, IaaS gives the user access to cloud-hosted physical and virtual servers, storage, and networking, as stated in the question. References: 1: SP 800-145, The NIST Definition of Cloud Computing | CSRC 2

Layer 4 of the TCP/IP model is the transport layer, which is responsible for providing reliable and efficient data transmission between hosts. The transport layer can use different protocols, such as TCP or UDP, depending on the requirements of the application. The transport layer also performs functions such as segmentation, acknowledgement, flow control, and error recovery. 1

The transport layer of the TCP/IP model corresponds to three layers of the OSI model: the transport layer, the session layer, and the presentation layer. The session layer of the OSI model manages the establishment, maintenance, and termination of sessions between applications. The session layer also provides services such as synchronization, dialogue control, and security. The presentation layer of the OSI model handles the representation, encoding, and formatting of data for the application layer. The presentation layer also performs functions such as compression, encryption, and translation. 23

References:

•1: TCP/IP Model - GeeksforGeeks

•2: Transport Layer | Layer 4 | The OSI-Model

•3: Transport Layer Explanation – Layer 4 of the OSI Model

In anti-malware, a false positive incorrectly identifies a legitimate file or application as malware. A false negative incorrectly identifies malware as a legitimate file or application. In intrusion detection, a false positive incorrectly identifies legitimate traffic as a threat, and a false negative incorrectly identifies a threat as legitimate traffic.

Cortex XDR is an endpoint product from Palo Alto Networks that can help with SOC visibility by allowing you to rapidly detect and respond to threats across your networks, endpoints, and clouds. It assists SOC analysts by allowing them to view all the alerts from all Palo Alto Networks products in one place, and to perform root cause analysis and automated response actions. Cortex XDR also integrates with other Palo Alto Networks products, such as WildFire, AutoFocus, and Cortex Data Lake, to provide comprehensive threat intelligence and data enrichment12. References:

• SOC Services - Palo Alto Networks
• Endpoint Protection - Palo Alto Networks
• Security Operations | Palo Alto Networks
• Cortex - Palo Alto Networks

Cortex XSOAR enhances Security Operations Center (SOC) efficiency with the world’s most comprehensive operating platform for enterprise security. Cortex XSOAR unifies case management, automation, real-time collaboration, and native threat intel management in the industry’s first extended security orchestration, automation, and response (SOAR) offering.

● Reduce the attack surface: Best-of-breed technologies that are natively integrated provide a prevention architecture that inherently reduces the attack surface. This type of architecture allows organizations to exert positive control based on applications, users, and content, with support for open communication, orchestration, and visibility.

● Prevent all known threats, fast: A coordinated security platform accounts for the full scope of an attack across the various security controls that compose the security posture, thus enabling organizations to quickly identify and block known threats.

● Detect and prevent new, unknown threats with automation: Security that simply detects

threats and requires a manual response is too little, too late. Automated creation and

delivery of near-real-time protections against new threats to the various security solutions in the organization’s environments enable dynamic policy updates. These updates are

designed to allow enterprises to scale defenses with technology, rather than people.

An encoded string is a common technique used by attackers to obfuscate their malicious code or data. By decoding the string, a security operations engineer can reveal the true nature and intent of the attacker, and potentially discover indicators of compromise (IOCs) such as IP addresses, domain names, file names, etc. Decoding the string can also help the engineer to determine the type and severity of the incident, and the appropriate response actions. Therefore, decoding the string and continuing the investigation is the best option among the given choices. Saving the string to a new file and running it in a sandbox may be risky, as it could execute the malicious code and cause further damage. Running the string against VirusTotal may not yield any useful results, as the string may not be recognized by any antivirus engines. Appending the string to the investigation notes but not altering it may not provide any additional insight into the incident, and may delay the response process. References:

• 1: SANS Digital Forensics and Incident Response Blog | Strings, Strings, Are Wonderful Things
• 2: 5 Minute Forensics: Decoding PowerShell Payloads - Tevora
• 3: Known plaintext analysis of encoded strings - SANS Institute
• 4: Palo Alto Networks Certified Cybersecurity Entry-level Technician - Palo Alto Networks
• 5: 10 Palo Alto Networks PCCET Exam Practice Questions - CBT Nuggets

 A static route is a manually configured route that specifies the destination network and the next hop IP address or interface to reach it. A static route does not depend on any routing protocol and remains in the routing table until it is removed or overridden. Static routes are useful for defining default routes, reaching stub networks, or providing backup routes in case of link failures. To configure a static route in a virtual router on a Palo Alto Networks firewall, you need to specify the name, destination, interface, and next hop IP address or virtual router of the route. References: Configure a Static Route in Virtual Routers, Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET), FREE Cybersecurity Education Courses

Static routing is a form of routing that occurs when a router uses a manually-configured routing entry, rather than information from dynamic routing traffic 1. Static routing has some advantages, such as simplicity, low overhead, and full control, but it also has some disadvantages, such as:

•Manual reconfiguration: Static routes require manual effort to configure and maintain. This can be time-consuming and error-prone, especially in large networks with many routes. If there is a change in the network topology or a link failure, the static routes need to be updated manually by the network administrator 23.

•Single point of failure: Static routing is not fault tolerant. This means that if the path used by the static route stops working, the traffic will not be rerouted automatically. The network will be unreachable until the failure is repaired or the static route is changed manually. Dynamic routing, on the other hand, can adapt to network changes and find alternative paths 23.

References: 1: Static routing - Wikipedia 2: Explain the benefits and drawbacks of static routing - Cisco Community 3: Dynamic versus Static Routing (3.1.2) - Cisco Press

A layer 2 switch will break up collision domains but not broadcast domains. To break up broadcast domains you need a Layer 3 switch with vlan capabilities.

Micro-segmentation is a VM-Series virtual firewall cloud deployment use case that reduces your environment’s attack surface. Micro-segmentation is the process of dividing a network into smaller segments, each with its own security policies and controls. This helps to isolate and protect workloads from lateral movement and unauthorized access, as well as to enforce granular trust zones and application dependencies. Micro-segmentation can be applied to virtualized data centers, private clouds, and public clouds, using software-defined solutions such as VMware NSX, Cisco ACI, and Azure Virtual WAN. References: Micro-Segmentation - Palo Alto Networks, VM-Series Deployment Guide - Palo Alto Networks, VM-Series on VMware NSX - Palo Alto Networks, VM-Series on Cisco ACI - Palo Alto Networks, VM-Series on Azure Virtual WAN - Palo Alto Networks

In addition to local analysis, Cortex XDR can send unknown files to WildFire for discovery and deeper analysis to rapidly detect.

 If an endpoint does not know how to reach its destination, it will send data to the specified default gateway. A default gateway is a device that routes traffic from a local network to other networks or the internet. The endpoint will use the default gateway’s IP address as the next hop for packets that are destined for unknown or remote networks. The default gateway will then forward the packets to the appropriate destination or another gateway, based on its routing table. References:

• Fundamentals of Network Security, Module 2: Networking Concepts, Lesson 2: IP Addressing and Routing1
• PCCET Study Guide, Section 2.2: Describe IP Addressing and Routing2

According to the NIST definition, cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction1. One of the essential characteristics of cloud computing is on-demand self-service, which means that users can request and obtain computing resources as needed, without requiring human intervention from the service provider2. On-demand network services are an example of this characteristic, as they allow users to access network resources such as bandwidth, routing, firewall, or load balancing, on demand and in a scalable manner3. References:

• The NIST definition of cloud computing
• SP 800-145, The NIST Definition of Cloud Computing | CSRC
• On-Demand Network Services - Palo Alto Networks

One of the best practices for securing sensitive data in SaaS applications is to control the access and usage of data based on the device type. Managed devices are those that are enrolled and monitored by the organization’s IT department, and have security policies and controls applied to them. Unmanaged devices are those that are not under the organization’s control, such as personal laptops or mobile phones. Allowing downloads to managed devices but blocking them from unmanaged devices prevents data leakage and unauthorized access to sensitive data. This can be achieved by using a cloud access security broker (CASB) solution, such as Prisma SaaS from Palo Alto Networks, which can enforce granular policies based on device posture, user identity, and data sensitivity 12. References: 1: Securing SaaS applications on the cloud is a critical aspect of protecting sensitive data and maintaining the trust of customers. By implementing best practices, such as enhanced authentication, data encryption, Break Glass, and oversight, organizations can mitigate the security risks associated with SaaS applications2: Prisma SaaS - Palo Alto Networks

East-West traffic is the lateral movement of data packets between servers within a data center, or across private and public clouds1. This type of traffic has grown substantially with the proliferation of data centers and cloud adoption, and it now surpasses the conventional North-South traffic that goes in or out of the network2. Therefore, it is important to protect East-West traffic from potential malicious actors and breaches, as threats can arise internally and move laterally without ever touching the traditional network perimeter12. By inspecting and monitoring all East-West traffic, organizations can effectively block the lateral movement of threat actors, increase network visibility, protect vital applications and data, and lower costs and risks for distributed operations23. References:

• East-West Traffic: Everything You Need to Know | Gigamon Blog
• What is East-West Security? | VMware Glossary
• How to Harness East-West Visibility for a Stronger Defensive Security …

Prisma SaaS connects directly to the applications themselves, therefore providing continuous silent monitoring of the risks within the sanctioned SaaS applications, with detailed visibility that is not possible with traditional security solutions.

A botnet is a network of computers or devices that are infected by malware and controlled by a malicious actor, known as the botmaster or bot-herder. The botmaster uses a command and control (C2) server or channel to send instructions to the bots and receive information from them. The C2 communication is essential for the botmaster to maintain control over the botnet and use it for various malicious purposes, such as launching distributed denial-of-service (DDoS) attacks, stealing data, sending spam, or mining cryptocurrency. Therefore, the key to “taking down” a botnet is to prevent the bots from communicating with the C2 server or channel. This can be done by disrupting, blocking, or hijacking the C2 communication, which can render the botnet ineffective, unstable, or inaccessible. For example, security researchers or law enforcement agencies can use techniques such as sinkholing, domain name system (DNS) poisoning, or domain seizure to redirect the bot traffic to a benign server or a dead end, cutting off the connection between the bots and the botmaster. Alternatively, they can use techniques such as reverse engineering, decryption, or impersonation to infiltrate the C2 server or channel and take over the botnet, either to disable it, monitor it, or use it for good purposes. References:

• What is a Botnet? - Palo Alto Networks
• Botnet Detection and Prevention Techniques | A Quick Guide - XenonStack
• Botnet Mitigation: How to Prevent Botnet Attacks in 2024 - DataDome
• What is a Botnet? Definition and Prevention | Varonis

A meddler-in-the-middle (MITM) attack is a type of Wi-Fi attack where the attacker intercepts and redirects the victim’s web traffic to serve content from a web server it controls. The attacker can use various techniques, such as ARP spoofing, DNS spoofing, or SSL stripping, to trick the victim into connecting to a rogue access point or a proxy server that acts as a middleman between the victim and the legitimate website. The attacker can then modify, inject, or drop the packets that are exchanged between the victim and the website, and perform malicious actions, such as stealing credentials, injecting malware, or displaying fake or misleading content. A MITM attack can compromise the confidentiality, integrity, and availability of the victim’s web traffic and expose them to various risks and threats. References:

• What is a man-in-the-middle attack?
• The 5 most dangerous Wi-Fi attacks, and how to fight them
• What Are Sniffing Attacks, and How Can You Protect Yourself?

 Border Gateway Protocol (BGP) is a protocol that enables ISPs and NSPs to exchange routing information among themselves. BGP is used to determine the best path for sending data packets across the Internet. BGP is also known as the protocol of the Internet backbone, as it connects different autonomous systems (ASes) that form the Internet. BGP is not used by end systems or local networks, but only by routers that operate at the border of ASes. BGP is a complex and dynamic protocol that can handle changes in network topology, traffic load, and policy requirements. BGP is also a scalable protocol that can support the growth of the Internet1234 References:

• 1: Internet service provider - Wikipedia
• 2: 1.8: Internet Backbones, NAPs, and ISPs - cs.huji.ac.il
• 3: Lecture Notes – Unit 2 How does the Internet work?
• 4: Border Gateway Protocol - Wikipedia

MITRE is a not-for-profit organization that operates research and development centers sponsored by the federal government. MITRE maintains the Common Vulnerabilities and Exposures (CVE) catalog, which is a dictionary of common names for publicly known cybersecurity vulnerabilities. CVE’s common identifiers, called CVE Identifiers, make it easier to share data across separate network security databases and tools, and provide a baseline for evaluating the coverage of an organization’s security tools12. References:

• Common Vulnerabilities and Exposures (CVE®)
• CVE - CVE

Phishing is a type of email attack where the attacker sends a lot of malicious emails in an untargeted way, pretending to be a trusted source, such as a bank or an online retailer, to trick users into revealing sensitive information, such as passwords or credit card numbers. Attackers use the information to steal money or to launch other attacks. A fake email from a bank asking you to click a link and verify your account details is an example of phishing1 References:

• 1: Palo Alto Networks Certified Cybersecurity Entry-level Technician - Palo Alto Networks
• 2: 10 Palo Alto Networks PCCET Exam Practice Questions - CBT Nuggets
• 3: Types of Email Attacks - Examples and Consequences - Tessian
• 4: What Is a Phishing Attack? Definition and Types - Cisco

A static routing protocol requires that routes be created and updated manually on a router or other network device. If a static route is down, traffic can’t be automatically rerouted unless an alternate route has been configured. Also, if the route is congested, traffic can’t be automatically rerouted over the less congested alternate route. Static routing is practical only in very small networks or for very limited, special-case routing scenarios (for example, a destination that’s used as a backup route or is reachable only via a single router). However, static routing has low bandwidth requirements (routing information isn’t broadcast across the network) and some built-in security (users can route only to destinations that are specified in statically defined routes).