Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

Which component must be configured on the firewall to detect and prevent a newly discovered malware threat from spear phishing emails?

1. Antivirus Signatures applied to inbound Security policy rules

2. Antivirus Profiles applied to outbound Security policy rules

3. URL Filtering Profiles enabled on all interfaces

4. Threat Prevention Profiles applied to all Security policy rules

The correct answer is: Antivirus Profiles applied to outbound Security policy rules

The correct choice involves the implementation of Antivirus Profiles applied to outbound Security policy rules to effectively detect and prevent newly discovered malware threats from spear phishing emails. Spear phishing emails often contain malicious attachments or links that, when clicked, can deliver malware into the recipient's environment. By configuring Antivirus Profiles, the firewall is equipped to scan outbound traffic and monitor email attachments for known malware signatures. These profiles can actively analyze and block any identified threats before they reach the end-user. The proactive nature of antivirus scanning allows the firewall to respond to newly discovered malware based on regularly updated signatures, thereby enhancing the organization’s security posture against evolving threats originating from spear phishing attempts. In comparison, other choices may not provide the same level of security in this specific context. For instance, Antivirus Signatures applied to inbound Security policy rules focus on traffic coming into the network, which is relevant to stopping malware from entering but does not specifically target the outbound scenarios where threats may manifest due to user action. URL Filtering Profiles help in blocking access to malicious websites but do not handle malware inspection directly. Threat Prevention Profiles offer a broader security measure but may not specifically address the nuances of analyzing spear phishing through outbound communication. Thus, the correct approach hinges on the targeted application of Antivirus Profiles to comprehensively