When a Palo Alto Networks NGFW detects a file containing known malware based on its Antivirus signature database, where is this event primarily logged?

• A. File Blocking logs
• B. Antivirus logs
• C. Threat logs
• D. System logs
• E. Traffic logs

A security analyst receives an alert indicating that a user attempted to access a website categorized as 'malware' by the Palo Alto Networks NGFW using the Advanced URL Filtering subscription. The analyst wants to understand how this categorization and blocking occurred and the additional protective measures provided by Advanced URL Filtering beyond standard URL filtering. Which of the following capabilities are relevant to Advanced URL Filtering's ability to identify and block such malicious websites? (Select all that apply)

• A. Inspecting the content of the webpage for embedded exploits using the URL Filtering profile.
• B. Using a local, static database of known malicious URLs on the firewall.
• C. Querying a large, dynamic cloud-based database of URLs and their categories.
• D. Real-time analysis of unknown URLs using machine learning to identify malicious characteristics.
• E. Blocking access to malicious domains or IPs associated with the URL, identified via correlation with other threat intelligence feeds (e.g., from WildFire or Threat prevention).

A critical data center perimeter is secured by a pair of Palo Alto Networks PA-5220 firewalls configured in an Active/Passive High Availability (HA) setup. In this configuration, which key state information is actively synchronized between the primary (Active) and secondary (Passive) firewalls to ensure minimal disruption to established connections upon a failover event?

• A. User-ID mappings (IP to username) learned from various sources.
• B. Routing table entries and neighbor discovery (ARP table).
• C. Master key for decrypting sensitive configuration data.
• D. NAT translation table entries for currently active NAT sessions.
• E. Session state table, including application identification status and security profile enforcement points.

An organization is concerned about zero-day malware spreading via executable files, PDFs, and office documents downloaded from the internet or transferred internally. They are using a Palo Alto Networks Strata NGFW with an Advanced WildFire subscription. What is the primary mechanism by which WildFire provides protection against these unknown threats?

• A. Blocking file types based on policy configured in the File Blocking profile.
• B. Scanning the file content for sensitive data patterns configured in the Data Filtering profile.
• C. Executing the file in a cloud-based virtualized sandbox environment to observe its behavior and determine if it is malicious.
• D. Comparing the file's hash against a local database of known malicious file hashes.
• E. Performing static analysis of the file's code for malicious patterns without executing it.