Palo Alto Networks Certified Network Security Administrator (PCNSA)Security Policy ConfigurationHard
A security administrator is implementing a new policy to prevent the exfiltration of sensitive company documents. The policy requires that all PDF and Microsoft Office documents containing specific keywords (e.g., 'CONFIDENTIAL', 'INTERNAL ONLY') should be blocked from being uploaded to external cloud storage services. Which combination of security profiles is BEST suited to enforce this policy?
- AAnti-Spyware and Vulnerability Protection
- BFile Blocking and Antivirus
- CFile Blocking and Data Filtering
- DData Filtering and URL Filtering
Show answer & explanationAnswer & explanation
Correct answer: C. File Blocking and Data Filtering
To block specific file types (PDF, Office documents) and inspect their content for keywords ('CONFIDENTIAL', 'INTERNAL ONLY'), a combination of File Blocking and Data Filtering profiles is required. File Blocking handles the file type restriction, while Data Filtering inspects the content for sensitive patterns or keywords.
Why the other options are wrong
- A. Anti-Spyware and Vulnerability Protection are for detecting spyware/C2 and exploits, respectively, not for preventing sensitive data exfiltration based on file type and content keywords.
- B. Antivirus protects against malware, but doesn't inspect for sensitive keywords or block specific file types based on content.
- D. URL Filtering controls access to website categories, but doesn't inspect file content for keywords. Data Filtering is correct for content inspection.
File Blocking & Data Filtering
File Blocking controls the transfer of specific file types, while Data Filtering inspects file content for sensitive information based on patterns or keywords.
- File Blocking: Enforces policy on file types (e.g., .pdf, .docx).
- Data Filtering: Enforces policy based on content patterns or keywords within files.
- Both are part of Content-ID.
- Often used together for comprehensive data loss prevention (DLP).
Memory trick: DLP is like a postal inspector: it checks the 'package type' (File Blocking) and then scans the 'contents' for secret messages (Data Filtering).