Exam PCNSE topic 1 question 405 discussion

Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama. https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs

The question states that there are no "Wildfire" logs in Panorama but they are on the firewalls. Both Panorama and firewalls have "WildFire Submissions" under Monitor->Logs. If the question were referring to 'wildfire-virus' subtype of Threat logs, I think it would have hinted at that. Also, by saying Wildfire logs are not showing up on the Panorama, it's assumed Threat logs are seen, so C does not fit. Furthermore, 'Wildfire' type logs are an option in the Log Forwarding profile, which the question specifically asks.

Question is about log snot beeing forwarded to Panorama. Object -> Log Forwarding -> Log Type -> Wildfire

wild fire logs are included in the threat logs forwarding

Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.

B. is the answer. Logs produced by Wildfire are seen under Wildfire logs. Logs produced by a Security Profile are seen under the threat log, even if a Wildfire signature matched the threat.

C. Like chrisy042

Wildfire logs profile should be attached to log forwarding profile under policies > security > actions > profile settings. Threat logs are associated with vulnerability profile.

I believe answer is B

On the 1/23/24 test

if we read the question carefully it is asking which log forwarding is causing this issue among the lists below as it is referenced from https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs the last one is missing so the answer is defiantly C. Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEVCA0 under log settings , there is an option Wildfire

Threat logs shows details about wildfire but since the WF logs are missing then need to send those answer is B

B is the correct.

I just test this sceniao with PN + NFGE with 10.1.x PN don't need WF subcription and get WF submissions log from managed device. The managed device just configured log forwarding profile with Wildfire log to forward to.

In the log forwarding Profile will be defined all Logs to be forwarded to panorama including WildFire. Selected Answer: B

C. see link from Chrisy042.