Which types of content can typically be submitted to Palo Alto Networks WildFire cloud service for analysis by a Strata NGFW or Prisma Access? (Select all that apply)

• A. Scripts (e.g., '.js', '.vbS, '.psl')
• B. Encrypted files (e.g., password-protected zips, encrypted documents)
• C. Document files (e.g., '.pdf, '.doc', '.xlS, '.ppt)
• D. Executable files (e.g., '.exe', '.dll')
• E. Archive files (e.g., 'zip', '.rar')

In addition to identifying device types and vulnerabilities, the Palo Alto Networks IoT Security subscription also performs behavioral analytics on IoT traffic. If the platform detects a 'High' severity behavioral anomaly from a device (e.g., unexpected communication with an external IP, unusual data transfer size), how is this intelligence typically integrated with the NGFW for policy enforcement or alerting?

• A. An alert is generated in the IoT Security dashboard, but no immediate action is taken on the NGFW.
• B. The IoT Security cloud service automatically changes the firewall's security policy to block the anomalous communication.
• C. The NGFW sends the full packet capture of the anomalous traffic to WildFire for detailed analysis.
• D. The anomalous device is automatically moved into a 'High-Risk IoT' dynamic device group, which can be used as a matching criterion in Security Policy rules with a 'deny' action.
• E. The anomaly triggers a 'Threat' log entry with a specific threat ID and severity on the NGFW/Panorama/CDL.

A network administrator managing a Prisma SD-WAN deployment needs to assess the historical performance and health of the WAN links at a specific branch office over the past week. They want to see metrics like latency, jitter, packet loss, and throughput for each ISP connection. Which section within the Prisma SD-WAN Cloud Management Console should they primarily use for this historical link performance analysis?

• A. Monitor (or Analytics) section with Network/Link Performance views
• B. Configuration Templates
• C. Security Policies
• D. Device Inventory
• E. Path Policies

Using the 'No Decrypt' action for specific traffic flows in Palo Alto Networks Strata NGFW or Prisma Access Decryption policy has significant implications for security visibility. When a session matches a 'No Decrypt' rule, which of the following security features or inspection capabilities are typically unavailable or severely limited for that specific encrypted session? (Select all that apply)

• A. App-ID identification of the application within the encrypted tunnel.
• B. Scanning the file content transferred within the session for malware using WildFire or Antivirus.
• C. Blocking sessions based on the source or destination IP address matching a high-risk external dynamic list (EDL).
• D. Applying Threat Prevention signatures (Vulnerability Protection, Antispyware) to detect exploits or command-and-control traffic hidden within the encrypted payload.
• E. Enforcing URL Filtering based on the full requested URL path, beyond just the hostname presented in the Server Name Indication (SNI) field.

A security analyst receives an alert indicating that a user attempted to access a website categorized as 'malware' by the Palo Alto Networks NGFW using the Advanced URL Filtering subscription. The analyst wants to understand how this categorization and blocking occurred and the additional protective measures provided by Advanced URL Filtering beyond standard URL filtering. Which of the following capabilities are relevant to Advanced URL Filtering's ability to identify and block such malicious websites? (Select all that apply)

• A. Blocking access to malicious domains or IPs associated with the URL, identified via correlation with other threat intelligence feeds (e.g., from WildFire or Threat prevention).
• B. Real-time analysis of unknown URLs using machine learning to identify malicious characteristics.
• C. Querying a large, dynamic cloud-based database of URLs and their categories.
• D. Inspecting the content of the webpage for embedded exploits using the URL Filtering profile.
• E. Using a local, static database of known malicious URLs on the firewall.