Palo Alto Networks Certified Network Security Analyst Free Sample Questions

The Antivirus profile handles blocking malicious files (malware). The Anti-Spyware profile is responsible for detecting and blocking command-and-control (C2) beacons. The URL Filtering profile controls access to web categories like gambling. Combining these creates the required protection stack.

The best practice is to handle exclusions via policy logic. By placing a 'No Decrypt' rule for sensitive categories higher in the policy list, the firewall processes these first and bypasses decryption. A subsequent rule then catches and decrypts remaining traffic. This is cleaner than managing profile-based exclusions for broad categories.

When an EDL is hosted on an HTTPS server, the firewall acts as a client. It must validate the server's certificate. If the server uses a private CA or a certificate not in the firewall's trusted root store, the connection will fail, preventing the list fetch.

Custom URL categories do not support 'exclude' logic directly within the object definition itself in a single line. The standard approach is to define the broad match (partner.example.com and *.partner.example.com) in the custom category. The exclusion is handled operationally by placing test.partner.example.com in a separate category (or relying on its default categorization) and ensuring the policy logic or category match preference handles it appropriately. However, strictly speaking about the object definition, you define what IS included. To 'exclude' effectively in policy, you often need a specific allow/block rule for the specific subdomain before the wildcard rule.

Log Forwarding Profiles allow granular filtering using the filter builder. By creating a match list specifically for the 'Threat' log type and applying a filter for specific severities, only those matching logs are sent to the configured forwarding destination (Syslog).

Path Quality Profiles use metrics like Latency, Jitter, and Packet Loss to determine if a path meets the SLA requirements for an application.

Jitter is a key metric in SD-WAN Path Quality profiles.