What is the Anti-Spyware Security profile default action?

The correct answer is D. Reset-both. The default action in the predefined Palo Alto Networks Anti-Spyware Security profile for critical and high severity threat signatures is 'reset-both', which sends a TCP reset to both the client and the server to terminate the malicious session. Medium severity threats…

Submitted by femi9· Apr 18, 2026Securing Traffic

Question

Options

ASinkhole
BReset-client
CDrop
DReset-both

How the community answered

(63 responses)

A
2% (1)
C
3% (2)
D
95% (60)

Explanation

The default action in the predefined Palo Alto Networks Anti-Spyware Security profile for critical and high severity threat signatures is 'reset-both', which sends a TCP reset to both the client and the server to terminate the malicious session. Medium severity threats typically default to 'alert', while low and informational may be set to 'allow'. 'Reset-both' is the most decisive response to high-confidence spyware detections, terminating the connection from both ends. Sinkhole (A) is a DNS-specific action used with DNS Security, not the general Anti-Spyware default.

Topics

#Anti-Spyware#Security Profiles#Default Actions#Threat Prevention

Community Discussion

No community discussion yet for this question.

Full PCNSA Practice