Q: 9

A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be included in the initial configuration of the Advanced DNS Security service?

Options

Discussion

Piya A. Oct 16, 2026 9:42 pm

C . Sinkholing malicious DNS queries is literally the first thing you set up for DNS Security profiles, so that's the step that gets the service working right away. If the question was about encrypted DNS specifically, maybe A, but not here.

Jack S. Oct 27, 2026 1:58 pm

C . Setting up sinkhole actions in the DNS Security policy is always highlighted as the first step in official guides because it actually enables threat prevention out of the box. Official docs and exam sample questions point to this directly.

Aaron P. Oct 18, 2026 3:20 am

Probably A. A lot of admins focus on decrypting DNS-over-TLS first to see threats, so C trips people up here.

Avery Oct 14, 2026 8:14 pm

C for sure. Sinkholing bad DNS queries is what makes the DNS Security service useful right away, since it blocks and logs threats just by updating the profile. Think it's standard best practice on initial config, but open if someone saw different.

MethodicalConsultant7023 Oct 29, 2026 12:54 am

Not B, C all the way.

PreciseLearner9211 Oct 16, 2026 2:22 pm

Yeah, C is the direct move since you need to set up sinkhole actions in DNS Security so the NGFW can actually catch those malicious queries. Overrides (B) are good later for tuning, but Palo Alto always pushes configuring sinkholing up front. Pretty sure that's how they want it-correct me if I'm off.

ChloeW Oct 14, 2026 8:03 pm

Probably C, always hear sinkholing is the first thing Palo Alto wants you to set for DNS Security. Had similar questions in exam reports. Makes sense since you want to block threats right away.

Mia T. Oct 24, 2026 7:45 pm

Honestly I'm a bit unsure, but I'd probably say A. I figured decrypting DNS-over-TLS is needed so you can actually inspect the DNS traffic for threats. But not 100 percent if that's the very first step or if it comes later. Anyone else see it this way?

Nathan C. Oct 27, 2026 1:57 pm

I don't think it's A. C is right since sinkholing malicious DNS queries is the main initial DNS Security config, while decryption (A) is more advanced and not always needed first.

Nora M. Oct 12, 2026 8:48 am

C makes sense for initial config, since sinkholing in the DNS Security signature policy actually blocks and logs malicious lookups right away. Pretty sure A is more about expanding visibility, but that's usually done after getting the basics up. Anyone disagree?

Be respectful. No spam.

Correct Answer:

Explanation

The primary function of the Advanced DNS Security service is to identify and mitigate threats by inspecting DNS queries. A fundamental initial configuration step is to define the action the firewall should take upon detecting a malicious DNS query. Configuring the DNS Security signature policy within an Anti-Spyware profile to "sinkhole" malicious queries is a core part of this setup. Sinkholing redirects the malicious request to a controlled server, which prevents the user from connecting to the malicious domain and helps administrators identify the compromised host that initiated the query. This is a direct and essential action to make the service effective from the start.

Why Incorrect

A: Decrypting DNS-over-TLS is a best practice for comprehensive visibility but not a mandatory initial step. The service can still inspect and block standard, unencrypted DNS traffic (UDP/53) without this rule. B: Creating overrides for company FQDNs is a tuning or customization step to prevent potential false positives. It is typically performed after the core protective policies are already in place and running. D: This option refers to configuring Advanced Threat Prevention (ATP), which is a separate service from Advanced DNS Security. The question specifically asks about the initial setup for the DNS Security service.

References

1. Palo Alto Networks - Configure DNS Security: "To use DNS Security

you must configure an Anti-Spyware profile to specify how the firewall handles DNS queries to malicious domains and apply the profile to a security policy rule... For DNS Signatures

select a single action... sinkhole: The firewall forges a response to a malicious DNS query to redirect the requesting client to a Palo Alto Networks sinkhole server..." This document establishes that configuring the action (like sinkhole) in the Anti-Spyware profile is the primary method to enable DNS Security.

Source: Palo Alto Networks TechDocs

"Configure DNS Security

" PAN-OS 10.2.

2. Palo Alto Networks - DNS Sinkhole: "DNS sinkholing is a mechanism that forges a response to a DNS query for a malicious domain and causes the victim to connect to a sinkhole IP address that you define." This reference defines the core action described in the correct answer.

Source: Palo Alto Networks TechDocs

"DNS Sinkhole

" PAN-OS 10.2.

3. Palo Alto Networks - DNS Security vs. Advanced DNS Security: "Advanced DNS Security... provides advanced protections

such as DNS-tunneling detection

and the use of machine learning to provide real-time identification and prevention of malicious domains." This highlights that DNS Security's core is preventing access to malicious domains

a function enabled by the policy action in option C.

Source: Palo Alto Networks TechDocs

"DNS Security

" PAN-OS 10.2.

4. Palo Alto Networks - Decryption Concepts: "To gain visibility into and control over SSL and SSH encrypted traffic

you can configure the Palo Alto Networks firewall to decrypt traffic..." This confirms that decryption is a separate

albeit related

configuration for handling encrypted traffic

not the primary setup for the DNS Security feature itself.

Source: Palo Alto Networks TechDocs

"Decryption Concepts

" PAN-OS 10.2.

Palo Alto Networks NetSec-Pro Real Exam Questions [October 2026 Update] Quiz

A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be included in the initial configuration of the Advanced DNS Security service?

Premium Access Includes