Palo Alto Networks NetSec-Pro Exam - Topic 2 Question 7 Discussion

Actual exam question for Palo Alto Networks's NetSec-Pro exam

Question #: 7
Topic #: 2

A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be included in the initial configuration of the Advanced DNS Security service?

ACreate a decryption policy rule to decrypt DNS-over-TLS / port 853 traffic.

BCreate overrides for all company owned FQDNs.

CConfigure DNS Security signature policy settings to sinkhole malicious DNS queries.

DEnable Advanced Threat Prevention with default settings and only focus on high-risk traffic.

Show Suggested Answer

Suggested Answer: C

Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving.

''The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains.''

(Source: Configure DNS Security)

Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing compromise.

by Casey at Jul 03, 2025, 04:26 PM

Limited Time Offer

25%

Off

Get Premium NetSec-Pro Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosina

2 months ago

I think enabling Advanced Threat Prevention first makes more sense.

upvoted 0 times

...

Nidia

2 months ago

Creating overrides for FQDNs is also important, though.

upvoted 0 times

...

Cory

3 months ago

I agree, option C is the way to go!

upvoted 0 times

...

Holley

3 months ago

Wait, are we really sure about that? Seems too straightforward.

upvoted 0 times

...

Rueben

3 months ago

You definitely need to configure DNS Security signature policy settings.

upvoted 0 times

...

Rory

3 months ago

I recall that decrypting DNS-over-TLS traffic is important, but I’m not confident if that’s the very first thing we should do.

upvoted 0 times

...

Ettie

4 months ago

I practiced a similar question, and I feel like enabling Advanced Threat Prevention with default settings might not be the best initial step. We should be more proactive.

upvoted 0 times

...

Paola

4 months ago

I'm not entirely sure, but I remember something about needing to create overrides for FQDNs. Is that really necessary right away?

upvoted 0 times

...

Samuel

4 months ago

I think the first step should be to configure the DNS Security signature policy settings. That seems crucial for blocking malicious queries.

upvoted 0 times

...

Alyce

4 months ago

I'm a little confused by this one. The question is specifically about the initial configuration of the Advanced DNS Security service, but some of the options seem to be more about the broader security setup, like the decryption policy and enabling Advanced Threat Prevention. I'm not sure if those would be the right first steps. I think I'll need to review the Palo Alto documentation more carefully to make sure I understand the proper sequence of steps for setting up the Advanced DNS Security service.

upvoted 0 times

...

Peggie

4 months ago

Okay, let's see here. The question is asking about the initial configuration of the Advanced DNS Security service, so I think the answer is probably either B or C. Creating overrides for company-owned FQDNs or configuring the DNS Security signature policy settings both seem like logical first steps to me. I'll need to double-check the details, but I'm feeling pretty confident about those two options.

upvoted 0 times

...

Terry

5 months ago

Hmm, I'm a bit unsure about this one. The question is specifically asking about the initial configuration, so I'm not sure if creating a decryption policy or enabling Advanced Threat Prevention would be the right first step. I'm leaning towards either option B or C, but I'll need to think it through a bit more.

upvoted 0 times

...

Colette

5 months ago

This one seems pretty straightforward. I think the key is to focus on the initial configuration of the Advanced DNS Security service, so I'd go with option C - configuring the DNS Security signature policy settings to sinkhole malicious DNS queries.

upvoted 0 times

...