When configuring Advanced URL Filtering on a Palo Alto Networks firewall, the "Ransomware"

category should be explicitly blocked to protect customers from URLs associated with ransomware

activities. Ransomware URLs typically host malicious code or scripts designed to encrypt user data

and demand a ransom. By blocking the "Ransomware" category, systems engineers can proactively

prevent users from accessing such URLs.

Why "Ransomware" (Correct Answer A)?

The "Ransomware" category is specifically curated by Palo Alto Networks to include URLs known to

deliver ransomware or support ransomware operations. Blocking this category ensures that any URL

categorized as part of this list will be inaccessible to end-users, significantly reducing the risk of

ransomware attacks.

Why not "High Risk" (Option B)?

While the "High Risk" category includes potentially malicious sites, it is broader and less targeted. It

may not always block ransomware-specific URLs. "High Risk" includes a range of websites that are

flagged based on factors like bad reputation or hosting malicious content in general. It is less focused

than the "Ransomware" category.

Why not "Scanning Activity" (Option C)?

The "Scanning Activity" category focuses on URLs used in vulnerability scans, automated probing, or

reconnaissance by attackers. Although such activity could be a precursor to ransomware attacks, it

does not directly block ransomware URLs.

Why not "Command and Control" (Option D)?

The "Command and Control" category is designed to block URLs used by malware or compromised

systems to communicate with their operators. While some ransomware may utilize command-and-

control (C2) servers, blocking C2 URLs alone does not directly target ransomware URLs themselves.

By using the Advanced URL Filtering profile and blocking the "Ransomware" category, the firewall

applies targeted controls to mitigate ransomware-specific threats.

Reference: Palo Alto Networks documentation for Advanced URL Filtering confirms that blocking the

"Ransomware" category is a recommended best practice for preventing ransomware threats.