Q: 9
A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS
Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be
included in the initial configuration of the Advanced DNS Security service?
Options
Discussion
C . Sinkholing malicious DNS queries is literally the first thing you set up for DNS Security profiles, so that's the step that gets the service working right away. If the question was about encrypted DNS specifically, maybe A, but not here.
C . Setting up sinkhole actions in the DNS Security policy is always highlighted as the first step in official guides because it actually enables threat prevention out of the box. Official docs and exam sample questions point to this directly.
Probably A. A lot of admins focus on decrypting DNS-over-TLS first to see threats, so C trips people up here.
C for sure. Sinkholing bad DNS queries is what makes the DNS Security service useful right away, since it blocks and logs threats just by updating the profile. Think it's standard best practice on initial config, but open if someone saw different.
Not B, C all the way.
Yeah, C is the direct move since you need to set up sinkhole actions in DNS Security so the NGFW can actually catch those malicious queries. Overrides (B) are good later for tuning, but Palo Alto always pushes configuring sinkholing up front. Pretty sure that's how they want it-correct me if I'm off.
Probably C, always hear sinkholing is the first thing Palo Alto wants you to set for DNS Security. Had similar questions in exam reports. Makes sense since you want to block threats right away.
Honestly I'm a bit unsure, but I'd probably say A. I figured decrypting DNS-over-TLS is needed so you can actually inspect the DNS traffic for threats. But not 100 percent if that's the very first step or if it comes later. Anyone else see it this way?
I don't think it's A. C is right since sinkholing malicious DNS queries is the main initial DNS Security config, while decryption (A) is more advanced and not always needed first.
C makes sense for initial config, since sinkholing in the DNS Security signature policy actually blocks and logs malicious lookups right away. Pretty sure A is more about expanding visibility, but that's usually done after getting the basics up. Anyone disagree?
Be respectful. No spam.
