Q: 9
A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS
Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be
included in the initial configuration of the Advanced DNS Security service?
Options
Discussion
C . Setting up sinkhole actions in the DNS Security policy is always highlighted as the first step in official guides because it actually enables threat prevention out of the box. Official docs and exam sample questions point to this directly.
Not B, C all the way.
Yeah, C is the direct move since you need to set up sinkhole actions in DNS Security so the NGFW can actually catch those malicious queries. Overrides (B) are good later for tuning, but Palo Alto always pushes configuring sinkholing up front. Pretty sure that's how they want it-correct me if I'm off.
Probably C, always hear sinkholing is the first thing Palo Alto wants you to set for DNS Security. Had similar questions in exam reports. Makes sense since you want to block threats right away.
Honestly I'm a bit unsure, but I'd probably say A. I figured decrypting DNS-over-TLS is needed so you can actually inspect the DNS traffic for threats. But not 100 percent if that's the very first step or if it comes later. Anyone else see it this way?
B tbh, I usually see companies set overrides for internal FQDNs right at the start to avoid business disruptions from false positives. Maybe it's a trap, but that's my understanding. Anyone disagree?
I don’t think it’s B. C is the real initial config they want since sinkholing stops bad domains right out of the gate. B is more for avoiding false positives but comes after. Pretty sure about this, unless someone’s seen otherwise.
Actually, C makes sense here since sinkholing malicious DNS queries is the recommended initial action for Palo Alto’s DNS Security. That’s how you actively start blocking threats from day one. Pretty sure that’s what the official guides push, but feel free to disagree.
B , since setting up overrides for company FQDNs seems like it would help avoid accidentally blocking internal stuff. Saw a similar question on a practice test. Not totally sure but feels logical here. Agree?
Be respectful. No spam.
