A branch office is configured with a Prisma SD-WAN ION device and has two internet links: a primary broadband connection and a secondary LTE link. The organization prioritizes VoIP traffic for business continuity and needs to ensure it uses the best available path based on real-time quality metrics, falling over to the LTE link if the broadband link deteriorates. Which type of Prisma SD-WAN policy is primarily used to define this behavior for VoIP traffic?

• A. Qos Policy
• B. NAT Policy
• C. Path Policy
• D. Application Override Policy
• E. Security Policy

In a Palo Alto Networks Strata NGFW or Prisma Access environment, traffic is processed through either the 'slow path' or the 'fast path'. Which of the following conditions or processing stages most accurately describes an action or requirement that forces the initial packet of a new session into the slow path?

• A. The packet is being forwarded based on an existing hardware-accelerated session lookup.
• B. The packet is the first packet of a flow and requires App-ID identification and security policy lookup to build a session.
• C. The packet is dropped due to a security policy deny rule after inspection.
• D. The packet requires basic routing lookups and interface forwarding.
• E. The packet is part of an established TCP session that has already been identified and allowed.

When configuring a DNS Security Profile on a Palo Alto Networks NGFW or Prisma Access, which actions are typically available to define the firewall's response when a DNS query matches a malicious category provided by the Advanced DNS Security cloud service?

• A. Sinkhole (respond with a fake IP address to redirect traffic to a controlled host)
• B. Allow (permit the query/response without any action)
• C. Redirect to Captive Portal (force user authentication)
• D. Block (prevent the DNS query from reaching the server)
• E. Alert (log the event without blocking)

A security team is investigating an alert from their Palo Alto Networks NGFW indicating a critical severity vulnerability exploit attempt against an internal server. The alert references a specific CVE ID and signature name. Which of the following capabilities or integrations, provided or enhanced by the Advanced Threat Prevention CDSS, contribute to the firewall's ability to detect and prevent such zero-day or rapidly evolving exploit attempts? (Select all that apply)

• A. Identifying malicious domains or IPs associated with the exploit source via dynamic threat intelligence feeds integrated into the Threat Prevention profile.
• B. Blocking the exploit attempt based solely on matching the application's default port and protocol in the security policy.
• C. Rapid and automated delivery of new exploit signatures from the cloud service in response to emerging threats.
• D. Analysis of traffic flows for behavioral anomalies and exploit-like patterns that don't match known signatures.
• E. Leveraging machine learning models in the cloud to identify new or mutated exploit techniques.