Exam NetSec-Analyst Topic 3 Question 1 Discussion

This is a challenging question that requires understanding the nuances of different custom object types and their logging implications, especially for DNS queries. Problem Analysis: Target: DNS queries. Pattern: Regex on the domain name (DNS query name). Condition: Originates from 'Guest_Network'. Action: Generate a custom log entry (alert), including matched domain and client 12 Constraint: Minimize performance impact. Evaluation of Options: A: Data Pattern/Data Filtering: Data Patterns are primarily designed for content inspection within application payloads (e.g., file transfers, web forms) and for Data Loss Prevention. While 'dns-query-name' can be a context for data patterns, using it for simple regex matching on DNS queries is generally less efficient and less idiomatic than a threat signature. It's more heavyweight. Also, Data Filtering logs are not the standard place for this type of anomaly. B: Custom Threat Signature/Vulnerability Protection Profile (Correct): 1. Custom Threat Signature: This is the most appropriate object for detecting anomalous patterns in network protocols like DNS. The 'dns-query-name' location is perfect for matching on the domain name in DNS queries. Setting the type to 'Spyware' or "Vulnerability' is suitable for threat-related anomalies. The regex is correctly defined. 2. Vulnerability Protection Profile: This profile is where you define the action for threat signatures. Setting it to 'alert' is exactly what's required. 3. Log Forwarding Profile: Threat logs contain detailed information, including the matched threat ID (your custom signature's ID), source IP, destination IP, and crucially, the matched pattern string (the domain name). This perfectly fulfills the logging requirement. 4. Security Rule Application: Applying the 'Vulnerability Protection Profile' to the specific security rule for "Guest_Network' traffic to 'dns' ensures that only relevant traffic is inspected. This approach is purpose-built for such threat detection. C: Custom Application: Custom Applications are for identifying applications based on their unique characteristics (ports, handshake, HTTP headers, URIS, etc.). While you could technically identify DNS traffic with a specific query name as a 'custom app', the primary purpose of App-ID is classification for policy enforcement, not fine-grained pattern detection alerts . The resulting logs would be 'Traffic Logs', which might not have the specific detail of the matched DNS query name readily available in a dedicated field for easy SIEM parsing, unlike Threat Logs. D: Custom URL Category/URL Filtering: URL Categories and URL Filtering Profiles are specifically designed for web (HTTP/HTTPS) traffic. They operate on URLs, not raw DNS queries. While DNS is involved in URL resolution, URL filtering happens after DNS resolution and is applied to HTTP/HTTPS sessions. This is completely inappropriate for direct DNS query inspection. E: Log Query/Email Alert: This option describes how to monitor for the logs after they've been generated. It does not describe how to configure the firewall to generate the initial log/alert based on the specific DNS query pattern. This is a post-detection analysis mechanism, not a detection mechanism.