Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

What firewall setting could prevent traffic from being logged as malware despite a valid signature existing?

1. Signature matching being turned off

2. Update schedule set to download only

3. Traffic log enabled but threat logging disabled

4. Logging without threat prevention enabled

The correct answer is: Update schedule set to download only

The goal of the firewall is to prevent and log potential threats to maintain network security. In this scenario, the correct answer revolves around the update schedule being set to download only. When the update schedule is configured to simply download updates without applying them, it means that the firewall will receive signature updates but won't actively use those new signatures to scan and log threats. Therefore, even if a valid signature exists for particular malware, the firewall will not log traffic related to it as malware, because the actual threat prevention features are not engaged. This setting effectively means that while the system is aware of signatures for identified threats, it cannot take action on them until the updates are applied. Hence, traffic that matches a known malware signature will not be logged because the firewall isn't operationally employing those definitions at the time the logs are generated. This highlights the importance of not just having updated signatures but also ensuring that threat prevention features are actively applied to enforce security measures and log appropriately.