What is an important consideration when defining custom data patterns for data loss prevention (DLP) on Palo Alto Networks platforms?

• A. They should be as broad as possible to cover all potential data types.
• B. They should be specific and tested to minimize false positives and false negatives.
• C. They do not require regular updates once deployed.
• D. They are less effective than predefined patterns and should be avoided.

Two unique IP addresses are flooding a company website with SYN flood packets and causing slow performance. What is the most efficient method using DoS Protection profiles to mitigate this attack and minimize disruption to legitimate traffic?

• A. Apply a classified DoS Protection profile to limit the number of SYN packets from the identified IP addresses Set the action to Random Early Drop.
• B. Apply a classified DoS Protection profile to limit the number of SYN packets from the identified IP addresses. Set the action to SYN Cookies.
• C. Apply an aggregate DoS Protection profile to limit the number of SYN packets from the identified IP addresses. Set the action to SYN Cookies.
• D. Apply an aggregate DoS Protection profile to limit the number of SYN packets from the identified IP addresses. Set the action to Random Early Drop.

A network security analyst must validate and improve the alerting inside Strata Cloud Manager (SCM) for NGFWs. The defaults for alerts, logs, etc., have not been modified.
Which two changes will lead to reduced alerts and incidents as well as enable emails for alert triggers relevant to the company's needs? (Choose two.)

• A. Set the "Forecast and Anomaly Incidents & Alerts" to a higher level to force larger variation from baseline before an alert is triggered.
• B. Create notification rules with notification type "email" focused on the categories and domains of issues the company faces to highlight the relevant needs.
• C. Create notification rules with notification type "email" focused on critical severity issues the company faces to create a reduction in alerts.
• D. Set the "Forecast and Anomaly Incidents & Alerts" to a lower level to force larger variation from baseline before an alert is triggered.

A firewall administrator is creating an application override rule to bypass Layer 7 inspection for a pre-defined application. What is the expected behavior for Content-ID checks for this application?

• A. WildFire will only use inline-ML checks instead of sending items to WildFire Cloud.
• B. No additional security checks will occur due to there being only Layer 4 handling.
• C. DNS Security will have degraded performance for advanced features.
• D. Threat inspection will occur if the pre-defined application supports threat inspection.