Which two statements are true for the DNS Security service introduced in PAN-OS version 10.0? (Choose two.)

Question

Options

• AIt is automatically enabled and configured.
• BIt eliminates the need for dynamic DNS updates.
• CIt functions like PAN-DB and requires activation through the app portal.
• DIt removes the 100K limit for DNS entries for the downloaded DNS updates.

• A
  4% (1)
• B
  91% (21)
• C
  4% (1)

Explanation

DNS Security in PAN-OS 10.0 introduced a cloud-based DNS signature lookup mechanism. Statement B is true: because the firewall can query the cloud for real-time DNS threat intelligence, there is no longer a need to download and maintain dynamic DNS signature update packages locally. Statement D is true: the previous local DNS signature database had a 100,000-entry cap; the cloud-based DNS Security service removes this limitation, providing access to a vastly larger set of DNS threat indicators. Statement A is false-DNS Security requires explicit activation via a valid subscription and configuration. Statement C is incorrect because DNS Security is part of the Threat Prevention subscription and is accessed differently than PAN-DB (which is URL Filtering).

No community discussion yet for this question.