A security analyst notices that the Threat Prevention subscription on a firewall is expired, but the firewall still receives updates. Why might this happen?
Trap 1: The firewall is using a grace period provided by the license server.
Grace periods generally apply to license activation, not indefinite update receipt.
Trap 2: The subscription is tied to the Panorama management server, not the…
Subscriptions are tied to the specific serial number of the firewall device.
Trap 3: The update server is misconfigured to allow free updates.
The update server validates the serial number status against Palo Alto entitlement databases.
- A
The firewall still has the previous signature database stored locally.
Local databases remain active until overwritten by a new update, which requires a valid subscription.
- B
The firewall is using a grace period provided by the license server.
Why wrong: Grace periods generally apply to license activation, not indefinite update receipt.
- C
The subscription is tied to the Panorama management server, not the firewall.
Why wrong: Subscriptions are tied to the specific serial number of the firewall device.
- D
The update server is misconfigured to allow free updates.
Why wrong: The update server validates the serial number status against Palo Alto entitlement databases.