ntion system (IPS) event where the threat was identified and the session was terminated, preventing the attack from reaching the target.","domainId":"731710af-fac7-475e-af04-870ab8bb407c","difficulty":"hard","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"\n threat\n intrusion\n critical\n drop\n 192.168.10.5\n 10.10.10.1\n ssl\n 40000\n","options":[{"id":"8702a8b9-1d94-4a3d-93bc-91ecbf777fc0","label":null,"text":"A file transfer was blocked.","isCorrect":false},{"id":"84893153-1382-4376-9cf3-2cf7b795d421","label":null,"text":"An intrusion was detected and allowed.","isCorrect":false},{"id":"a50bbd1f-e40d-46a4-b588-49fcd481fb40","label":null,"text":"A URL filtering event occurred.","isCorrect":false},{"id":"0532e2e5-d00b-4083-83b7-addcfe9932a4","label":null,"text":"An intrusion was detected and dropped.","isCorrect":true}],"domainName":"Device Management and Services","domainSlug":"device-mgmt-services"},{"id":"14f224d3-a3b6-4b71-830d-49a68b677672","slug":"which-two-actions-should-be-taken-to-protect-against-dns-tun-0j6hg","questionText":"Which TWO actions should be taken to protect against DNS tunneling? (Choose two.)","explanation":"DNS Security (DNSsec) on Palo Alto Networks firewalls can inspect and block DNS tunneling by identifying anomalous DNS queries and responses, such as those with unusually long domain names or high query rates. This feature uses threat intelligence and machine learning to detect tunneling attempts without relying solely on static domain block lists.","domainId":"4e664c06-6d29-4a42-b849-97aa37f892cf","difficulty":"hard","questionType":"multi_select","pbqConfig":null,"exhibitText":null,"options":[{"id":"e383f67f-dae5-4325-af3a-c487d693169e","label":null,"text":"Enable DNS Security on the outbound DNS traffic.","isCorrect":true},{"id":"7e5f3616-a4c9-4f62-a123-e259b32597c8","label":null,"text":"Configure DNS policies to block requests to unknown domains.","isCorrect":true},{"id":"a1eaa90e-6343-4c18-a49b-d55698f69fbc","label":null,"text":"Allow all TCP traffic on port 53.","isCorrect":false},{"id":"6153a4b5-c560-4f7e-8e87-2d8a51993c2d","label":null,"text":"Enable logging on all DNS traffic for analysis.","isCorrect":false},{"id":"3565b85b-a4c7-4218-80df-41add64aee41","label":null,"text":"Block all UDP traffic on port 53.","isCorrect":false}],"domainName":"Securing Traffic","domainSlug":"pcnsa-securing-traffic"},{"id":"852fb261-98e8-4acb-844e-c0af1b82efc1","slug":"which-content-id-feature-can-be-used-to-prevent-data-loss-by-si15p","questionText":"Which Content-ID feature can be used to prevent data loss by blocking specific patterns in traffic?","explanation":"Data Filtering is the correct answer because it is the Content-ID feature specifically designed to inspect application-layer traffic for predefined patterns, such as credit card numbers, social security numbers, or custom regex patterns, and block or alert on matches to prevent data loss. Unlike URL Filtering or File Blocking, Data Filtering operates on the content within allowed traffic, making it the direct tool for data loss prevention (DLP) based on pattern matching.","domainId":"d06c64b6-4b10-4bcf-b9ca-4cc938ec011c","difficulty":"easy","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"9ac526ba-49d3-4bde-aa36-a76dc76bdc19","label":null,"text":"URL Filtering","isCorrect":false},{"id":"7ac2c8cc-802c-432d-989f-c4a290f9c6af","label":null,"text":"File Blocking","isCorrect":false},{"id":"46ee510e-c6db-453f-b0d9-1d031558b72c","label":null,"text":"Data Filtering","isCorrect":true},{"id":"2b947590-5798-4f63-b29b-45f84623e145","label":null,"text":"WildFire","isCorrect":false}],"domainName":"App-ID and Content-ID","domainSlug":"app-id-content-id"},{"id":"f0a6604a-8797-4fcb-93c0-033bff213f36","slug":"refer-to-the-exhibit-a-user-at-10-1-1-50-is-unable-to-conne-j2wm5","questionText":"Refer to the exhibit. A user at 10.1.1.50 is unable to connect to 192.168.1