An administrator configured a Security policy rule with an Antivirus Security profile. The administrator did not change the action for the profile. If a virus gets detected, how will the firewall handle the traffic?

Question

Accepted Answer

D. It uses the default action assigned to the virus signature. In Palo Alto Networks Antivirus profiles, if an administrator does not explicitly override the action for a detected virus signature, the firewall will enforce the predefined default action associated with that specific signature (e.g., block, alert, reset connections).

Answer

A. It allows the traffic but generates an entry in the Threat logs. Allowing traffic but only logging it is a possible action, but not the default behavior if no action is specified; the default action depends on the specific signature.

Answer

B. It drops the traffic because the profile was not set to explicitly allow the traffic. Dropping traffic is a common action for viruses, but it's not universally applied by default if no explicit action is set; the specific signature's default action governs this.

Answer

C. It allows the traffic because the profile was not set the explicitly deny the traffic. Allowing traffic because no explicit deny was set is incorrect; the security profile's purpose is to enforce security, and a default action for detected threats will always apply.

An administrator configured a Security policy rule with an Antivirus Security profile. The administrator did not change the action for the profile. If a virus gets detected, how will the firewall…

Question

Options

How the community answered

Why each option

Topics

Community Discussion