Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

Which of the following actions does not occur when the Content-ID engine blocks a virus?

1. A threat log entry is generated

2. The client is redirected to a safe download site

3. The client receives a block page

4. The file download is terminated

The correct answer is: The client is redirected to a safe download site

When the Content-ID engine blocks a virus, certain actions are automatically triggered to ensure network security and maintain awareness of potential threats. Among these actions, generating a threat log entry provides visibility into the blocked malicious content, while the client receiving a block page communicates that the download has been halted due to a security threat. Additionally, the termination of the file download ensures that the harmful file is not allowed to enter the network. The action that does not occur in this scenario is redirecting the client to a safe download site. This functionality is typically associated with legitimate downloads where files are verified to be safe, not when a virus is blocked. In a case where the Content-ID engine detects a virus, the objective is to prevent the potentially harmful file from being downloaded entirely, rather than providing an alternative download option. Thus, option B accurately reflects an action that does not take place when a virus is blocked by the Content-ID engine.