Index › Threat & Content Services
Revision Guide · Certified Next-Generation Firewall (NGFW) Engineer

Threat & Content Services

← Back to full guide index

~4 min read
Prerequisites: Encrypted Traffic — most of these services need decryption enabled to see HTTPS-borne threats.

Threat Prevention & Advanced Threat Prevention 14

Subscription

Learning objectives

  • Explain what each Threat Prevention component (antivirus, anti-spyware, vulnerability protection) actually inspects for
  • Describe how vulnerability signature severity maps to a profile's default action
  • Identify what Advanced Threat Prevention adds beyond signature-based Threat Prevention

The IPS/IDS layer of the NGFW: antivirus, anti-spyware/command-and-control detection, and vulnerability protection, layered with an optional cloud-based deep-learning engine for evasive threats.

Why

App-ID tells you what an application is; Threat Prevention tells you whether the traffic inside it is malicious — exploits, malware, or a compromised host phoning home.

How

Threat Prevention combines antivirus, anti-spyware (C2 detection), vulnerability protection (IPS), built-in external dynamic lists of known-bad hosts, and DNS-query analysis to flag infected hosts. Advanced Threat Prevention adds an inline, cloud-based detection engine using deep-learning models trained on Palo Alto's threat intelligence, specifically to catch evasive and unknown command-and-control traffic that signature matching alone would miss. Each vulnerability/ spyware signature carries a severity (critical/high/medium/low/informational), and the security profile's default rule maps each severity to a default action (alert, allow, reset, block, drop) — admins can override per-severity or per-signature actions in a custom profile rather than accepting the vendor default.
Layered Threat Prevention services catching malicious traffic before clean traffic exits.
Layered Threat Prevention services catching malicious traffic before clean traffic exits.

Pros

  • Inline prevention, not just after-the-fact detection/alerting
  • Advanced tier catches zero-day/evasive C2 that static signatures miss
  • Built-in EDLs give instant coverage against known-malicious infrastructure

Cons

  • Requires decryption to be effective against HTTPS-borne threats
  • Subscription cost, and Advanced Threat Prevention is a separate, higher tier
  • Inline cloud lookups add a (small) latency dependency on cloud availability

Exam trap

The default action for a given severity is not "block" for every profile — the predefined strict and default profiles differ in their per-severity actions, and a custom profile inherits none of that until you set it explicitly. Don't assume "enabled" means "blocking."
Self-check
A critical vulnerability signature fires but the session is only logged, not blocked. What's the most likely cause?
A: The active vulnerability protection profile's default (or per-severity) action for that severity is set to "alert," not "block" or "reset" — the profile controls the action per severity, and firing a signature doesn't automatically mean the traffic is dropped.
Why does Advanced Threat Prevention specifically help against C2 traffic that Threat Prevention's built-in EDLs already miss?
A: EDLs only block known-bad infrastructure; the Advanced tier's cloud-based deep-learning engine analyzes traffic patterns in real time to catch new/evasive C2 that hasn't been catalogued into a list yet.

Source: pan-os/11-1/pan-os-admin/subscriptions

WildFire & Advanced WildFire 15

Basic tier included with Threat PreventionSubscription for full features

Learning objectives

  • Explain why behavioral sandboxing catches malware that signature-based AV misses
  • Describe the WildFire verdict lifecycle from unknown file to global signature
  • Identify what Advanced WildFire's Intelligent Run-time Memory Analysis specifically targets

Palo Alto's cloud-based malware sandbox. Unknown files are detonated in a virtual environment to observe real behavior, rather than relying only on static signatures.

Why

Signature-based AV can't catch malware nobody has seen before. Sandboxing observes what a file actually does, closing the gap for novel and targeted threats.

How

Unknown files crossing the firewall are forwarded to the WildFire cloud (or an on-prem WF-500 appliance), detonated in multiple OS/application environments, and analyzed via static + dynamic analysis. A subscription unlocks faster signature turnaround, more file types (APK, PDF, Office, Java), and API-based uploads. Advanced WildFire adds Intelligent Run-time Memory Analysis — a cloud engine that inspects in-memory behavior to catch highly evasive malware that detects and hides from sandboxing.
WildFire sandbox analysis, verdict branching, and global signature distribution.
WildFire sandbox analysis, verdict branching, and global signature distribution.

Pros

  • Behavioral detonation catches genuinely new malware, not just known signatures
  • Verdicts propagate globally — one customer's detonation protects the whole community quickly
  • Advanced tier's memory analysis targets sandbox-evasive malware specifically

Cons

  • Cloud detonation isn't instant — first-seen files may pass before a verdict returns (mitigated by "hold mode," at a latency cost)
  • Requires decryption + forwarding config to see files inside HTTPS/other encrypted channels
  • Full feature set (advanced file types, on-prem appliance, API) needs the paid subscription

Exam trap

"Hold mode" (block until verdict) is not the default forwarding behavior — by default, first-seen files are allowed to pass while WildFire analyzes them in the background, and only a later verdict updates future sessions. Don't assume unknown files are blocked pending analysis unless hold mode is explicitly configured.
Self-check
A brand-new piece of ransomware slips through on its first appearance in your environment, even though WildFire is licensed and forwarding is configured correctly. Why?
A: Cloud detonation isn't instant — without hold mode, the first-seen file is allowed through while WildFire analyzes it, so a truly novel sample can complete delivery before a malicious verdict returns.
Standard WildFire keeps flagging a sandbox-aware sample as benign. Which tier/feature is designed to catch exactly this?
A: Advanced WildFire's Intelligent Run-time Memory Analysis — it inspects in-memory behavior specifically to catch malware that detects and evades traditional sandbox detonation.

Source: pan-os/11-1/pan-os-admin/subscriptions; pan-os_11-0_pan-os-new-features_wildfire-features

URL Filtering & Advanced URL Filtering 16

Subscription (PAN-DB)

Learning objectives

  • Explain how PAN-DB category lookups work and how local caching affects them
  • Describe the URL category override/appeal workflow when a site is misclassified
  • Identify what Advanced URL Filtering's inline ML adds beyond category-based control

Controls not just whether users can reach a site, but how they interact with it — category-based access control plus real-time ML inspection of web content and credential submissions. PAN-DB is Palo Alto's own cloud-hosted URL categorization database: the firewall keeps a local cache of recently-seen URLs and queries the cloud in real time for anything not cached, then caches that verdict locally to keep steady-state lookups fast.

Why

The web is the biggest delivery channel for phishing and drive-by malware; static category databases alone lag behind newly-registered malicious domains and single-use phishing pages.

How

A URL Filtering security profile enforces action per PAN-DB URL category, detects corporate credential submissions and restricts which categories can receive them (anti-phishing), and can log HTTP headers or block relaxed SafeSearch settings. Advanced URL Filtering layers a cloud-based ML web-security engine that inspects pages in real time — reducing reliance on the crawled/categorized database alone — to catch file-less, freshly-created phishing and exploit pages. When a site is misclassified, admins (or end users, if enabled) can submit a category-change request to Palo Alto for review, or simply override the category locally via a custom URL category while the appeal is pending.
URL filtering combines PAN-DB category lookup with inline machine-learning inspection.
URL filtering combines PAN-DB category lookup with inline machine-learning inspection.

Pros

  • Credential-phishing prevention is enforced at the category level, not just block/allow
  • ML inline inspection catches brand-new malicious pages a crawled database hasn't seen yet
  • Custom URL categories and External Dynamic Lists give fine-grained overrides

Cons

  • URL Filtering is no longer sold standalone — full functionality requires Advanced URL Filtering
  • Category misclassification happens and requires an appeal/override workflow
  • Effectiveness against HTTPS sites again depends on decryption being enabled

Exam trap

A URL Filtering security profile only takes effect once it's attached to a Security Policy rule — creating the profile alone enforces nothing. This mirrors a common mistake with other content-inspection profiles (antivirus, vulnerability protection): the object must be referenced by a rule to apply.
Self-check
A user submits credentials to a phishing page that PAN-DB hasn't categorized yet as malicious. Which feature is designed to catch this specifically?
A: Advanced URL Filtering's inline ML web-security engine — it inspects the page's content and behavior in real time rather than relying only on the crawled/categorized PAN-DB database, so it can flag freshly-created phishing pages PAN-DB hasn't seen yet.
You configure a URL Filtering profile blocking the "malware" and "phishing" categories, but users can still reach a known phishing site. What should you check first?
A: Whether the profile is actually attached to the Security Policy rule matching that traffic — an unattached profile enforces nothing.

Source: ngfw/help/11-1/objects/objects-security-profiles-url-filtering; pan-os/11-1/pan-os-admin/subscriptions

DNS Security & Advanced DNS Security 17

Requires Threat Prevention license

Learning objectives

  • Explain how DNS sinkholing redirects malicious lookups and why that reveals infected hosts
  • Describe how the DNS Security cloud service builds its threat verdicts from passive DNS data
  • Identify what Advanced DNS Security adds beyond sinkholing known-bad domains

Extends DNS sinkholing with a cloud service that generates DNS-threat signatures using predictive analytics/ML, and (Advanced tier) inspects DNS responses in real time to catch domain hijacking.

Why

Malware overwhelmingly uses DNS for C2 and exfiltration (fast-flux, DGA domains) — DNS is a high-leverage choke point most attacks must pass through, even encrypted ones.

How

The firewall queries the DNS Security cloud service for threat-intel-backed verdicts on domains and sinkholes malicious lookups. Advanced DNS Security adds cloud-based domain-detection engines that inspect changes to DNS responses in real time, catching hijacked or misconfigured domains as they happen rather than relying only on pre-built blocklists. Sinkholing works by returning a firewall-controlled IP instead of the real malicious answer, so an infected host's next connection attempt to that sinkhole IP shows up in traffic logs — instantly identifying which internal host queried the bad domain, even before Threat Prevention would otherwise have flagged its C2 traffic. The cloud service builds its verdicts by continuously analyzing passive DNS telemetry (query patterns, domain age, algorithmically-generated name structure) across Palo Alto's global customer base.
DNS Security uses threat intelligence to resolve benign domains and sinkhole malicious ones.
DNS Security uses threat intelligence to resolve benign domains and sinkhole malicious ones.

Pros

  • DNS is a small, high-value inspection point — cheap to enforce, hard for malware to avoid entirely
  • Sinkholing quickly reveals which internal hosts are already infected
  • Advanced tier's real-time response inspection catches hijacking, not just known-bad domains

Cons

  • Gated behind an existing Threat Prevention license — not standalone
  • DNS-over-HTTPS/TLS from endpoints can bypass firewall-level DNS visibility unless separately controlled

Exam trap

Sinkholing only works for DNS the firewall can actually see — if endpoints are configured (or malware forces them) to use DNS-over-HTTPS/TLS straight to an external resolver, firewall-level DNS Security is bypassed entirely unless that encrypted DNS traffic is itself blocked or decrypted.
Self-check
A host repeatedly queries a domain that DNS Security sinkholes. How does this help an analyst identify the infection without waiting on other logs?
A: Sinkholing returns a firewall-controlled IP instead of the real malicious answer, so the host's subsequent connection attempt to that sinkhole IP appears directly in traffic logs — immediately identifying the infected internal host.
Why can't you enable DNS Security on its own without any other subscription?
A: DNS Security is gated behind an existing Threat Prevention license — it's an add-on to Threat Prevention, not a standalone subscription.

Source: pan-os/11-1/pan-os-admin/subscriptions

Module Quiz

1. A Vulnerability Protection profile is attached to a Security policy rule, and traffic matches signature severity "critical" for an exploit attempt. What ultimately determines whether that session is reset, blocked, or merely logged?

Each vulnerability and spyware signature carries a severity, and the security profile maps each severity level to a default action (allow, alert, reset, block, or drop) — the App-ID and zone play no role in that decision.

2. A SOC lead reports that standard Threat Prevention keeps missing command-and-control traffic that changes its beacon pattern to evade signature matching. Which subscription upgrade specifically addresses this gap?

Advanced Threat Prevention's differentiator is the inline cloud deep-learning engine built specifically to catch evasive, signature-resistant C2 that static signatures alone would miss.

3. A previously unseen executable crosses the firewall with WildFire licensed but WildFire hold mode not enabled. What happens to the file on this first encounter?

Without hold mode enabled, an unknown file is allowed through while WildFire analyzes it asynchronously — the tradeoff for not adding latency to every never-before-seen file. Hold mode is the setting that changes this behavior.

4. A sample repeatedly behaves benignly under standard sandbox detonation, yet endpoint telemetry shows it is actively malicious in production. Which Advanced WildFire capability is designed to catch exactly this class of sample?

Intelligent Run-time Memory Analysis inspects in-memory behavior specifically to catch sandbox-aware malware that detects detonation and deliberately behaves differently to evade standard analysis.

5. A user browses to a site that has never been categorized by this firewall before and is not present in the local URL cache. What happens next under PAN-DB?

PAN-DB combines a local cache with real-time cloud lookups for URLs not already cached, storing the result locally afterward so subsequent requests resolve instantly.

6. A newly registered phishing domain that mimics a corporate login page goes live and is reached by a user within hours of registration, before any crawler has categorized it. Which subscription is most likely to still catch it?

Advanced URL Filtering's inline ML engine evaluates page content and behavior in real time, so it can flag brand-new phishing pages a crawled database like base PAN-DB has not yet seen.

7. An administrator configures a URL Filtering profile to block the "malware" and "phishing" categories, but testing shows a known-malicious matching site still loads without being blocked. What should the administrator check first?

Like other content-inspection profiles, a URL Filtering profile enforces nothing on its own — it only takes effect once referenced by the Security policy rule that matches the traffic in question.

8. An engineer enables DNS sinkholing in the Anti-Spyware profile to help locate internally infected hosts. Which two statements accurately describe how this actually helps identify the infected endpoint? (Choose two.)

Sinkholing substitutes a firewall-controlled IP for malicious DNS lookups; the infected host's follow-up connection attempt to that sinkhole IP is what surfaces it in the logs. It does not itself isolate the host or force re-authentication.

9. Standard DNS Security already blocks resolution to known-malicious domains via cloud-delivered signatures. What does Advanced DNS Security add on top of that?

Advanced DNS Security's differentiator is real-time response inspection to catch domain hijacking and misconfiguration as it happens, rather than relying solely on pre-built signature/blocklist coverage.

10. During licensing review, an administrator finds DNS Security cannot be purchased or activated on its own. What explains this?

DNS Security is licensed as an add-on requiring an active Threat Prevention subscription as its base — it is never sold or activated standalone.

11. A customer has fully licensed Threat Prevention, WildFire, and URL Filtering, yet still reports missed detections on HTTPS-borne threats. What is the most common root cause across all three services in this scenario?

All three content-inspection services depend on visibility into the actual payload, which HTTPS encryption hides from the firewall unless SSL/TLS decryption is active for that traffic.
← Firewall Fundamentals & AdminAI-Powered Security →