PCNSA App-ID and Content-ID Practice Question
A security administrator needs to ensure that files downloaded by users are scanned for malware. The administrator has already configured a File Blocking profile to block malicious files. Which additional Palo Alto Networks security profile must be applied to the Security policy rule to inspect the file contents for known threats?
⚠ Common exam trap
Watch out — candidates often confuse File Blocking with Antivirus, thinking that a File Blocking profile alone can detect malware, when it only blocks based on file type and direction, not content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Antivirus
To inspect file contents for malware, the Antivirus security profile must be applied to the Security policy rule. The Antivirus profile scans files and data streams for viruses, spyware, and other malicious code. While File Blocking profiles can block files by type, they do not analyze content. Anti-Spyware, Vulnerability Protection, and URL Filtering serve different purposes and do not perform file content scanning for known threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
URL Filtering
Why it's wrong here
URL Filtering profiles control access to websites based on URL categories. They can block access to malicious or phishing sites, but they do not scan the content of files for malware. URL Filtering is used for web access control, not for file content inspection. Therefore, it does not meet the requirement of scanning downloaded files for known threats.
- ✓
Antivirus
Why this is correct
The Antivirus security profile is responsible for scanning files and data streams for viruses, spyware, and other malware. It uses signatures and heuristics to detect and block malicious content. Applying an Antivirus profile to the Security policy rule ensures that files are inspected and threats are stopped. The File Blocking profile only blocks files based on file type, not content, so the Antivirus profile is needed for malware detection.
- ✗
Vulnerability Protection
Why it's wrong here
Vulnerability Protection profiles detect and block exploits that target software vulnerabilities, such as buffer overflows or code execution attempts. They inspect network traffic for exploit patterns but do not scan file contents for viruses or malware. They are complementary to Antivirus but do not fulfill the requirement of scanning downloaded files for known threats.
- ✗
Anti-Spyware
Why it's wrong here
Anti-Spyware profiles detect and block spyware phone-home activity and command-and-control traffic, but they do not scan files for malware. They focus on network behavior and DNS queries. While important for comprehensive security, they do not perform file content inspection. The question specifically asks for scanning file contents for known threats, which is the function of the Antivirus profile.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSA question from scratch — 385 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.