Free Palo Alto Networks Cybersecurity-Apprentice Actual Exam Questions - Question 8 Discussion

I get why B stands out—it’s definitely about real-time threat spotting. Another way to look at it: A is more about protecting data after detection, C is about setup and access control, and D is for after an incident. Detect’s main job is finding suspicious activity early, usually by monitoring things like network traffic, logs, and endpoints. So B fits best since it’s specifically focused on analyzing traffic to catch threats as they appear.

D imo, since designing disaster recovery is more about responding after an incident, not detecting it. The question is about the primary goal of Detect, which is real-time identification of threats. A and C are more about protection and access control, so they don’t fit here. B fits best because analyzing network traffic (and typically logs or endpoints too) helps spot attacks as they happen, which aligns with detection’s purpose.

B imo, since Detect is mainly about spotting threats as they happen, not encrypting data or planning recovery. Network traffic analysis fits well with that real-time detection focus.

Makes sense to go with B since Detect is about spotting issues quickly, and network traffic analysis is a big part of that. A and C seem more about prevention and planning rather than detection. D is clearly about what comes after a breach, so it’s out too. Plus, Detect usually involves all kinds of monitoring, not just network traffic but endpoints and logs as well, so B covers the core function best.

I get why B seems right, but what if Detect also includes things beyond just network traffic, like endpoint alerts? Does that mean A or C could partly fit since they relate to protecting data or assets?

Option B fits best because the Detect function is all about spotting threats as they happen, and analyzing network traffic for IoCs is exactly that. The other options focus on prevention, policy setting, or recovery, which come before or after detection. So B is the only one that directly deals with real-time detection.

B or is it more about quick alerts? this one feels kinda vague.