Security profiles are the specialised inspection engines inside a Palo Alto Networks firewall that scan traffic for specific types of threats before allowing it to reach your users. They matter for PCNSE because the exam tests your ability to choose, configure, and order the correct profile for each threat category, and real networks rely on these profiles to stop attacks that basic firewall rules cannot see.
Jump to a section
A simple way to picture Security Profiles and Threat Prevention
A bustling professional kitchen during Saturday dinner service. The head chef at the pass, expediting orders, the line cooks firing pans, the prep team chopping vegetables. Every ingredient that arrives at the kitchen door is like data entering a network. A crate of tomatoes comes in – that is the raw traffic. Before that tomato ever touches a cutting board, it passes through a series of checks. The sous-chef inspects it for bruises or rot, just like an antivirus profile scans files for known malware signatures. Then the vegetable station lead checks its variety against the menu – is it a Roma or a beefsteak? This matches an anti-spyware profile checking if the traffic matches known spyware behaviour patterns. Next, the head chef rules out any ingredient that could cause an allergic reaction in a VIP guest – this is like a vulnerability protection profile blocking exploits that target known software weaknesses. Finally, the expediter checks the delivery against the specific table orders – only certain ingredients go to certain dishes. This is precisely what a URL filtering profile does: it decides what web destinations are allowed based on policy. If any single check fails – a mouldy tomato, the wrong variety, a known food allergen, a delivery to the wrong station – that ingredient is sent back or thrown out. The dinner service flows smoothly because every ingredient is profiled before it ever becomes part of a dish. Your network traffic, similarly, is profiled by multiple security layers before it reaches your users.
The kitchen runs on trust but verification. The chefs do not assume an ingredient is safe because it arrived in the correct crate. They inspect it. Security profiles operate on the same principle: trust nothing, verify everything. Every file, every web request, every application connection is checked against a set of rules before it is allowed to pass. This prevents bad ingredients – malware, spyware, exploits, malicious websites – from corrupting the entire meal, just as security profiles prevent threats from infecting your network.
In the same way a restaurant has different stations – grill, sauté, pastry – each with a specific role, a Palo Alto Networks firewall uses different security profiles for different threat categories. Antivirus catches file-based malware. Anti-spyware catches beaconing and data-theft behaviour. Vulnerability protection catches exploit code. URL filtering controls which websites users can visit. Each profile is an expert at its own type of inspection, and they all work together under the head chef – the security policy rule – to decide whether to allow, block, or quarantine traffic.
Security profiles are sets of rules and signatures that a Palo Alto Networks firewall uses to inspect the content of network traffic, not just the source and destination of that traffic. A basic firewall can block traffic based on IP addresses or ports, but that is like checking the ID card of a visitor without looking inside their bag. Security profiles look inside the bag. They examine the actual data passing through the firewall – files, web requests, application commands – to find and stop malware, exploits, and unwanted content.
There are four main types of security profiles that the PCNSE exam focuses on: antivirus, anti-spyware, vulnerability protection, and URL filtering. Each one catches a different kind of threat. They are applied to security policy rules, which are the sets of conditions that tell the firewall what to do with certain kinds of traffic. When traffic matches a rule that has a security profile attached, the firewall applies that profile's inspection logic to the traffic.
Antivirus profiles scan files transferred over the network for known malware. The firewall uses a database of virus signatures – unique patterns of code that identify specific malware – to compare against each file. If a file matches a known signature, the antivirus profile can block it, alert on it, or clean it by removing the malicious part. Antivirus profiles protect against worms, viruses, trojans, and ransomware. They work on files during transfer, like a download or an email attachment.
Anti-spyware profiles detect and block spyware, which is software that secretly gathers information from a computer and sends it to an attacker. Spyware often communicates with a command-and-control (C2) server – a remote computer the attacker controls – to receive instructions or exfiltrate stolen data. Anti-spyware profiles look for this kind of communication, like beaconing (regular check-in traffic) or signatures of known spyware applications. They also block DNS queries that resolve known malicious domains.
Vulnerability protection profiles prevent attackers from exploiting weaknesses in legitimate software. A vulnerability is a flaw in a program that can be used to gain unauthorised access or cause damage. An exploit is a piece of code or a sequence of actions that takes advantage of a vulnerability. Vulnerability protection profiles inspect traffic for patterns that match known exploits. For example, they can block a specially crafted packet that tries to overflow a buffer in a web server, or a SQL injection attempt that tries to insert malicious database commands into a web form.
URL filtering profiles control which websites users can access based on the website's category. The firewall uses a cloud-based database that categorises millions of websites into categories like Social Networking, Gambling, Malware, or Adult. A URL filtering profile can block entire categories, allow them, alert on them, or allow them but warn the user. It can also override the category for specific websites, like blocking Facebook but allowing a corporate LinkedIn page. URL filtering profiles protect against legal liability (by blocking adult content), productivity loss (social media during work hours), and malware (known malicious sites).
Each security profile has multiple actions that can be set for different threat severities. Severity levels range from informational (low risk) to critical (immediate threat). For a signature that matches a critical severity threat, you might set the action to block. For informational severity, you might set it to alert only. Profiles also have exception lists where you can allow specific files, applications, or URLs that would otherwise be blocked. This is important for legitimate software that might be flagged incorrectly – a false positive.
All four profile types are configured in the firewall's management interface under the Objects tab, then Profiles. You create each profile with a name and define its rules. Then you attach the profile to a security policy rule. If you want HTTP traffic from the Sales department to be scanned for viruses, you create a security rule that matches traffic from the Sales zone, to the internet zone, using the HTTP application, and you attach your antivirus profile to that rule. The firewall then inspects every HTTP file transfer from Sales against that profile.
Security profiles can also be combined. A single security rule can have an antivirus profile, an anti-spyware profile, a vulnerability protection profile, and a URL filtering profile all applied at the same time. The firewall runs all the inspections together. This layered approach means that if one profile misses a threat, another profile might catch it. For example, a file might slip past antivirus because it uses an unknown signature, but if it tries to phone home to a known C2 server, the anti-spyware profile blocks it.
The PCNSE exam expects you to know the exact default actions for each profile type, which traffic types each profile inspects, and how to troubleshoot when a profile is not blocking as expected. You must also understand the difference between a blocking action and an alert action, and when to use the Drop vs. Block setting for different threat types. The exam will present you with a scenario – a company with a specific security requirement – and ask you to configure the correct combination of profiles on the correct rule.
Identify the Threat Type
Determine what kind of threat you are trying to prevent. File-borne malware (virus, ransomware) needs an antivirus profile. Spyware communication (beaconing to C2) needs an anti-spyware profile. Exploit code targeting a known vulnerability needs a vulnerability protection profile. Unwanted web categories (adult, gambling) need a URL filtering profile. This step ensures you select the correct profile type for the task.
Create or Edit the Security Profile
Navigate to Objects > Profiles in the firewall management interface and select the profile type you need (Antivirus, Anti-Spyware, Vulnerability Protection, or URL Filtering). Give the profile a descriptive name, like 'Block-Critical-Malware'. In the profile settings, you can adjust the actions for each severity level. For example, set the antivirus actions for Critical and High threats to 'block', and keep Medium and Low as 'alert'. This customisation lets you avoid blocking low-risk traffic while stopping real threats.
Configure Exceptions for False Positives
Before applying the profile broadly, check if any legitimate applications or websites will trigger the profile. In the profile's 'Exception' tab, add the specific file hash, application, or URL that must bypass the profile. For example, if a proprietary internal tool is detected as spyware because it phones home to update its licence, add its communication to the exception list. This step prevents breaking business-critical applications while still enforcing security.
Attach the Profile to a Security Policy Rule
Go to Policies > Security and locate the rule that matches the traffic you want to inspect. Typically this is a rule that allows traffic from the trust zone (internal network) to the untrust zone (internet). In the rule's 'Profile Setting' section, select the profile you created. You can attach multiple profiles to the same rule. This step binds the inspection to the specific traffic flow.
Test and Monitor the Profile
After applying the profile, generate traffic that matches the rule and verify the logs. Go to Monitor > Logs > Threat to see if the profile triggered correctly. Use a test file from the EICAR test site to confirm antivirus blocking. For anti-spyware, use a known C2 simulator. For URL filtering, try to access a site in the blocked category. If the profile does not block as expected, check that the profile is correctly attached to the rule, that the rule is enabled, and that the profile's action is set to 'block' and not 'alert'. This step validates your configuration before it goes live.
A mid-sized e-commerce company called ShopQuick runs its entire business online. The IT team of three people manages 200 employee computers and a handful of internal servers that host the product database and the customer-facing website. They use a Palo Alto Networks firewall at the internet perimeter. The network security engineer (that is the person who manages the firewall) recently noticed strange traffic patterns – some employee computers were sending small packets of data to an unfamiliar server in Eastern Europe every 30 seconds. This is classic spyware behaviour that the anti-spyware profile should catch.
Here is exactly what the engineer does, step by step:
First, she logs into the Palo Alto firewall management interface and navigates to Objects > Profiles > Anti-Spyware. She checks the existing anti-spyware profile applied to the outbound Internet rule. She finds that the profile has the action for the 'spyware' severity level set to 'alert' only, not 'block'. This means the firewall saw the suspicious traffic, logged it, but let it pass. That explains why the traffic is still happening. She changes the action for severity levels Critical, High, and Medium to 'block'.
She then reviews the logs. Under Monitor > Logs > Threat, she filters for the anti-spyware signature that triggered. The log shows the infected employee's internal IP address, the external C2 server IP, and the signature 'Win32/Spyware.Agent'. The engineer uses this information to isolate the infected computer from the network by disconnecting its Ethernet port in the switch management software. She then runs a full antivirus scan on that computer using the company's endpoint protection software.
Next, she creates a custom antivirus profile to specifically block any file transfer with the 'Win32/Spyware' signature in the future. Even though the signature is in the default database, she adds it to a custom profile with a 'reset-both' action, which terminates the connection both ways, so the client cannot send data and the server cannot respond.
She also checks the vulnerability protection profile to see if it caught any exploit attempts leading up to the infection. Vulnerability protection logs often show an earlier event where a server vulnerability was probed. The engineer updates the vulnerability protection profile to block any signature related to 'EternalBlue' – a known vulnerability in Windows file sharing that this spyware might have used to spread.
Finally, she tests the setup by having a colleague intentionally try to download a benign test file from a known malware testing site (like EICAR). The antivirus profile should block it. If it does not, she checks that the profile is correctly applied to the security rule that matches HTTP traffic. She also runs a simulated spyware connection using a tool that phones home to a known C2 simulator. The anti-spyware profile should block it. These tests confirm the configuration works.
Outside of incident response, the engineer regularly reviews security profile logs – at least once a week. She looks for signatures that are triggering frequently, which might indicate a widespread issue, and for new categories of threats that the default profiles might not cover. She updates the threat prevention profiles daily. The firewall automatically downloads latest signatures from Palo Alto Networks, but she manually reviews the release notes to see if any new critical signatures were added that affect her environment.
When the company rolls out a new internal web application for customers to track orders, the engineer creates a custom URL filtering profile that allows the order-tracking subdomain but blocks all other categories on the domain except 'Business and Industry'. She also creates an exception for the order-tracking URL to bypass the 'Newly Registered Domain' category block, which might otherwise block the domain if it is too new. This ensures customers can access the service while employees remain protected from malicious websites.
The engineer also documents every change she makes to security profiles. She writes the profile name, the date, the reason for the change, and the expected impact. When the external auditor reviews their security posture, this documentation proves that ShopQuick has a systematic approach to threat prevention and that profiles are configured correctly for their risk level.
The PCNSE exam treats security profiles and threat prevention as one of the most heavily tested objectives. You can expect multiple-choice questions, drag-and-drop ordering tasks, and scenario-based questions that require you to choose the correct profile type for a given threat. Here is exactly what the exam tests:
The default actions for each profile type. For example, the default antivirus action is 'alert' for most signatures. The exam will present a scenario where traffic is not blocked, and you must know that you need to change the 'action' from 'alert' to 'block'. They love testing the difference between 'drop' and 'reset' actions: drop silently discards the packet, while reset sends a TCP reset packet to terminate the connection.
The traffic direction each profile inspects. Antivirus inspects traffic in both directions but is most effective on inbound files. URL filtering inspects only outbound traffic. Vulnerability protection inspects both directions. Anti-spyware focuses on outbound traffic to C2 servers. The exam will give a scenario like 'an employee downloads a file from an external website' and ask which profile(s) inspect that traffic.
The concept of 'exception lists' within profiles. The exam tests your ability to add a specific file hash or URL to an exception list to allow legitimate traffic that the profile would otherwise block. They often combine this with a scenario about a false positive.
The order of operations for profile inspection. The exam expects you to know that the firewall inspects traffic against profiles in the following order: URL filtering (categories applied first), then vulnerability protection (exploit detection), then antivirus (file scanning), then anti-spyware (C2 detection). This matters because a URL filtering block prevents further inspection – the firewall does not waste time scanning a blocked request.
How profiles interact with security policy rules. A profile must be applied to a security rule that matches the traffic. The exam will give a scenario where traffic passes through but is not being inspected. The correct answer is often that the security rule does not have the correct profile attached, or the profile is applied to the wrong zone direction.
Common traps the exam sets:
Trap: 'Which profile blocks ransomware?' Answer: All three (antivirus, anti-spyware, vulnerability protection) can block different aspects of a ransomware attack. The exam expects you to recognise that ransomware is not a single profile category.
Trap: 'URL filtering uses a local database.' Answer: URL filtering uses a cloud-based database, with a local cache. The cloud database is authoritative.
Trap: 'Setting a profile action to alert will log the threat but allow the traffic.' Correct. Many beginners think alert also blocks – it does not.
Trap: 'The default antivirus profile blocks all malware.' False. Default is alert-only for many signatures. You must change to block.
Key definitions to memorise:
Signature: A unique pattern of code that identifies a specific threat.
Severity: The risk level of a threat (critical, high, medium, low, informational).
Action: What the firewall does when a signature matches (alert, allow, block, drop, reset-both, reset-client, reset-server).
Zone: A logical grouping of interfaces (trust, untrust, dmz). Profiles are applied to security rules that specify source and destination zones.
False positive: Legitimate traffic incorrectly flagged as malicious. Exception lists fix false positives.
C2 (Command and Control): The server attackers use to communicate with infected devices.
Memorise this: The four profile types are Antivirus (files), Anti-Spyware (beaconing/C2), Vulnerability Protection (exploits), URL Filtering (web categories). The exam will test your ability to map a threat description to the correct profile.
Also memorise the URL filtering categories that are commonly blocked in corporate environments: Malware, Phishing, Adult, Illegal, Drugs, Gambling, Social Networking (optional), and Streaming Media (bandwidth control). The exam may ask which categories are blocked by default in a profile – the answer is often none, because you must configure the block list manually.
Security profiles inspect the content of traffic, not just the header, and there are four main types: antivirus, anti-spyware, vulnerability protection, and URL filtering.
Profiles have default actions set to 'alert' for many signatures – you must manually change them to 'block' to stop threats.
URL filtering uses a cloud-based category database, not local inspection of page content, to determine which websites to allow or block.
Antivirus profiles cannot scan encrypted HTTPS traffic unless SSL decryption is configured separately on the firewall.
Vulnerability protection profiles inspect traffic in both directions – inbound and outbound – not just from the internet.
The 'drop' action silently discards a packet, saving firewall resources, while 'block' sends a TCP reset to terminate the connection.
You can attach multiple security profiles to a single security rule, and they are applied in the order of URL filtering, vulnerability protection, antivirus, then anti-spyware.
Exception lists within profiles allow you to whitelist specific files, applications, or URLs that would otherwise be blocked due to a false positive.
These come up on the exam all the time. Here's how to tell them apart.
Antivirus Profile
Scans files transferred over the network for known malware signatures
Usually inspects inbound traffic (downloads, email attachments)
Default action for critical threats is alert, not block
Can clean infected files by removing the malicious code
Anti-Spyware Profile
Detects spyware communication behaviour such as beaconing to C2 servers
Primarily inspects outbound traffic (data exfiltration attempts)
Default action for high-severity threats is alert
Cannot clean files; it blocks the network connection instead
Block Action
Sends a TCP reset packet to both the client and the server
Actively terminates the connection so the client knows it was stopped
Uses slightly more firewall resources due to generating reset packets
Drop Action
Silently discards the packet without any response
No feedback to the client – the connection simply times out
Uses fewer resources, preferred for high-volume attacks
URL Filtering Profile
Controls access to websites based on URL categories
Inspects the domain name and URL, not the file content
Can block HTTPS sites without SSL decryption using SNI
Antivirus Profile
Scans file content for malware signatures
Cannot inspect encrypted traffic without SSL decryption enabled
Inspects file payload whether the download comes from HTTP, FTP, or email
Vulnerability Protection Profile
Detects exploit code targeting known software vulnerabilities
Inspects packet payloads for patterns like buffer overflows or SQL injection
Works on both inbound and outbound traffic
Antivirus Profile
Detects known malware signatures in files
Only works when a file is being transferred (not on individual packets)
Primarily used on inbound traffic from untrusted sources
Mistake
Once I enable a security profile, it automatically blocks all threats of that type.
Correct
Profiles have default actions set to 'alert' for many signatures, meaning they log the threat but allow the traffic through. You must manually change the action to 'block' for the threat to actually be stopped.
Beginners assume that because a profile exists, it is active and blocking. In reality, profiles are shipped with conservative defaults to avoid breaking legitimate traffic, so the engineer must decide what to block.
Mistake
URL filtering checks the content of the webpage itself.
Correct
URL filtering checks the URL and domain against a cloud-based category database. It does not inspect the actual HTML content of the page. A page can change its content after the category was assigned, but URL filtering still uses the original category.
The term 'URL filtering' sounds like it inspects the page content, analogous to content filtering. But it actually works on metadata – the URL – not the page content. This confusion leads many to believe it can block specific text on a page.
Mistake
Antivirus profiles scan all traffic, including encrypted HTTPS traffic.
Correct
By default, antivirus profiles do not scan encrypted HTTPS traffic unless SSL decryption is configured separately. The firewall cannot see inside an encrypted tunnel without a decryption policy that re-encrypts the session.
Users expect 'antivirus' to work everywhere, but encryption blocks visibility. Without SSL decryption, the antivirus profile only scans unencrypted traffic. This is a common exam trap.
Mistake
Vulnerability protection profiles are only needed on inbound traffic from the internet.
Correct
Vulnerability protection profiles inspect traffic in both directions. Internal users can also launch exploits against internal servers, or a compromised internal device can attack other internal devices. Profiles should be applied to rules for both inbound and outbound traffic.
People associate 'vulnerability' with external attackers, but internal network traffic also carries exploits. This blind spot causes misconfigured profiles that only protect the network perimeter.
Mistake
The 'block' action and the 'drop' action do the same thing.
Correct
Block sends a TCP reset packet to both the client and server, actively terminating the connection. Drop silently discards the packet without sending any response, which consumes fewer resources but may cause the client to retry indefinitely.
Both actions prevent the traffic from passing, so beginners think they are identical. The exam tests the subtle resource and behaviour differences, especially for high-volume attacks where drop is preferred.
Mistake
You can only apply one security profile type per security rule.
Correct
A single security rule can have multiple profiles attached – antivirus, anti-spyware, vulnerability protection, and URL filtering all applied at the same time. The firewall runs all inspections in a defined order.
New users see each profile type as a separate configuration object and assume they must choose one. In practice, you layer them for defence in depth, and the exam tests this by asking which profiles apply in a given scenario.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A security policy rule decides which traffic is allowed or denied based on source, destination, application, and user. A security profile is a set of inspection rules applied to traffic that is allowed by a security rule. The profile scans the content inside the allowed traffic for threats.
No – security profiles only inspect traffic that is allowed by a security policy rule. If a rule denies traffic, the firewall blocks it before any profile inspection happens. Apply profiles only to rules that have an 'Allow' action.
Yes – URL filtering works on the domain name in the HTTPS certificate (the SNI field) and the IP address, so it can block HTTPS websites without decrypting the traffic. The firewall does not need to see inside the encrypted data to know which domain the user is visiting.
Find the file in the threat logs, note its hash value or signature ID, then add that hash or signature to the exceptions list within the specific profile. The profile will then allow that file while still scanning all other files. Do not disable the entire profile.
Not necessarily – you can reuse the same profile name across multiple security rules that apply to different zones. However, if you want different inspection settings for different zones (for example, stricter rules for internet-bound traffic than for internal traffic), you create separate profiles.
The profile automatically downloads new threat signatures from Palo Alto Networks, and the actions you set for each severity level apply to the new signatures. So if you set 'critical severity = block', any new critical signature downloaded today will be blocked without you having to edit the profile manually.
You've finished Security Profiles and Threat Prevention. Continue through the PCNSE study guide to build a complete picture of the exam.
Done with this chapter?