Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

What causes a company's firewall to not match a malware signature for an infection traffic recorded in the logs?

1. The update schedule is set to "download only"

2. Local logging is disabled on the firewall

3. The signature was not applied to the policy rules

4. This type of malware was not included in the threat database

The correct answer is: The update schedule is set to "download only"

The choice regarding the update schedule being set to "download only" is significant because firewalls rely on regularly updated threat intelligence databases to recognize and match various malware signatures. If the update schedule is configured to "download only," the firewall may not apply the updates that include the latest signatures into its active scanning processes. This means that even if the latest signatures are available for download, they will not be utilized by the firewall to inspect and analyze traffic effectively. Therefore, when an infection attempt occurs, the firewall may not detect the malware because it is running outdated definitions, hence failing to match the signature associated with the detected traffic. In essence, even if the firewall logs indicate that infection traffic was recorded, the absence of an updated signature applied actively on the firewall due to the limited update schedule can lead to situations where malware goes undetected, which aligns with the scenario presented in the question.