Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

Which URL Filtering Security Profile action logs the URL Filtering category to the URL Filtering log?

1. Block

2. Alert

3. Allow

4. Monitor

The correct answer is: Alert

The action that logs the URL Filtering category to the URL Filtering log is the Alert action. When this action is configured within a URL Filtering Security Profile, it generates a log entry that captures relevant details about the request, including the category of the attempted URL. This logging provides valuable insight into user activity and helps in monitoring the types of content users are trying to access. For instance, using the Alert action can aid in reporting on potentially harmful or inappropriate web traffic without hindering user access—in scenarios where the intention is to investigate trends or behaviors rather than enforce strict blocking. This allows administrators to gain visibility into web usage patterns, which can be crucial for compliance and security posture assessments. In contrast, while the other actions (Block, Allow, and Monitor) have their specific functions, they do not focus on categorizing or logging as effectively as Alert does in this context. Block prevents access without logging the category detail in the same way, Allow permits access and generally does not create a log entry for the category, and Monitor tracks the URL activity but typically does not provide the categorical information in the URL Filtering log. Thus, Alert stands out as the action that effectively captures and logs URL categories directly to the filtering log.