The appropriate CDSS subscription to inspect and mitigate suspicious DNS traffic is Advanced DNS

Security. Here’s why:

Advanced DNS Security protects against DNS-based threats, including domain generation algorithms

(DGA), DNS tunneling (often used for data exfiltration), and malicious domains used in attacks. It

leverages machine learning to detect and block DNS traffic associated with command-and-control

servers or other malicious activities. In this case, unusually high DNS traffic to an unfamiliar IP

address is likely indicative of a DNS-based attack or malware activity, making this the most suitable

service.

Option A: Advanced Threat Prevention (ATP) focuses on identifying and blocking sophisticated

threats in network traffic, such as exploits and evasive malware. While it complements DNS Security,

it does not specialize in analyzing DNS-specific traffic patterns.

Option B: Advanced WildFire focuses on detecting and preventing file-based threats, such as

malware delivered via email attachments or web downloads. It does not provide specific protection

for DNS-related anomalies.

Option C: Advanced URL Filtering is designed to prevent access to malicious or inappropriate

websites based on their URLs. While DNS may be indirectly involved in resolving malicious websites,

this service does not directly inspect DNS traffic patterns for threats.

Option D (Correct): Advanced DNS Security specifically addresses DNS-based threats. By enabling this

service, the customer can detect and block DNS queries to malicious domains and investigate

anomalous DNS behavior like the high traffic observed in this scenario.

How to Enable Advanced DNS Security:

Ensure the firewall has a valid Advanced DNS Security license.

Navigate to Objects > Security Profiles > Anti-Spyware.

Enable DNS Security under the "DNS Signatures" section.

Apply the Anti-Spyware profile to the relevant Security Policy to enforce DNS Security.

Reference:

Palo Alto Networks Advanced DNS Security Overview: https://www.paloaltonetworks.com/dnssecurity

Best Practices for DNS Security Configuration.