Exam PCNSE topic 1 question 398 discussion

The answer is A because the question asking HOW an admin would accomplish a task "An administrator wants to prevent users from unintentionally accessing malicious domains where data can be exfiltrated through established connections to remote systems" The admin's goal is to stop known good users from getting to these malicious websites unknowingly C2 could be the answer if the question was worded differently but in this case the answer is A Set the malware category to block

Command-and-control (C2) URLs and domains used by malware or compromised systems to surreptitiously communicate with an attacker's remote server to receive malicious commands or exfiltrate data.

B is correct

C2 domains

A could be correct since CC is part of what the malware does. However, if there is a category for CC traffic then that is what I would go with.

Answer B: "command-and-control—Command-and-control URLs and domains used by malware and/or compromised systems to surreptitiously communicate with an attacker's remote server to receive malicious commands or exfiltrate data."

"established connections to remote system"->Command and Control The correct is B

Looks like A is also correct? malware—Sites known to host malware or used for command and control (C2) traffic. May also exhibit Exploit Kits. (From the same web link)

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/url-categories/url-category-best-practices