Threat Prevention and Troubleshooting
Threat Prevention and Troubleshooting
This domain tests Threat Prevention profiles, exceptions, and the tools used to diagnose gateways. The exam expects you to distinguish detect versus prevent, apply the right profile, and troubleshoot without disabling protections wholesale.
Core rules
- Threat Prevention is applied through profiles attached to rules or layers. A profile contains IPS, Anti-Bot, Anti-Virus, Threat Emulation, and Threat Extraction settings.
- IPS protections have severities and confidence; Prevent blocks, Detect logs only. Exceptions can be rule-based or protection-based and should be narrow.
- ThreatCloud provides reputation and indicators; it does not replace local policy.
- HTTPS inspection is required for many protections to see encrypted traffic; without it, the gateway sees only SNI and certificate metadata.
- Troubleshooting order: verify SIC and policy installation status, check logs in SmartView, confirm rule hit counts, then use fw monitor, zdebug, or cpview.
- Performance tools: SecureXL (fwaccel) and CoreXL (fw ctl multik) can explain why traffic is not inspected in the slow path.
Worked example
Users report a legitimate SaaS application is blocked after an IPS update. The log shows an IPS protection blocking the connection. The engineer should confirm the protection name and severity, check whether the rule uses a profile with that protection in Prevent mode, and create a narrow exception for the specific destination and protection rather than disabling the profile. Then install policy and verify the log shows the exception. The reasoning: exceptions preserve coverage for other traffic while removing the false positive.
Traps
- Setting the whole profile to Detect to solve one false positive.
- Forgetting that HTTPS inspection must be enabled for encrypted traffic.
- Looking only at SmartView logs and ignoring fw monitor when packets are accelerated.
- Assuming a policy install succeeded on all cluster members without checking each member.
- Confusing Threat Extraction, which sanitizes files, with Threat Emulation, which detonates files in a sandbox.