Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

If a security policy is blocking high-severity malware, which configurations must be checked to ensure effectiveness?

1. Antivirus profiles and logging settings

2. Security policies and global settings

3. Application signatures and URL filtering settings

4. All outgoing traffic restrictions

The correct answer is: Antivirus profiles and logging settings

To ensure that a security policy effectively blocks high-severity malware, it is essential to check the antivirus profiles and logging settings. Antivirus profiles specifically define how the firewall handles malware detection, including the actions taken when malware is identified, such as blocking, allowing, or alerting. These profiles configure the signature database used by the firewall to identify high-severity threats, ensuring the system is set to catch the latest advanced malware variants. Additionally, logging settings play a crucial role in monitoring and recording events when malware is detected. By reviewing logs, an administrator can verify which threats were blocked, assess the effectiveness of the antivirus configurations, and refine strategies as needed based on the alerts and reports generated. This combination of antivirus profiles and logging provides a comprehensive approach to maintaining a strong security posture against malware threats.