URL Filtering and Application Control Flashcards

What is the function of a URL Filtering profile in Palo Alto Networks?

Answer: To control user access to websites based on URL categories

A URL Filtering profile allows administrators to allow, block, alert, or override access to websites based on PAN-DB URL categories.

Which database does Palo Alto Networks use to classify URLs into categories for URL Filtering?

Answer: PAN-DB

PAN-DB is Palo Alto Networks' proprietary URL categorization database, which classifies billions of URLs into categories that can be used in URL Filtering profiles.

What does the 'continue' action do in a URL Filtering profile?

Answer: Displays a warning page requiring the user to click through before accessing the site

The 'continue' action presents the user with a warning page acknowledging the site category, requiring a manual click-through to proceed, while logging the access.

Which URL category should be blocked in most enterprise environments to prevent malware distribution?

Answer: Malware

The 'Malware' URL category includes sites known to distribute malicious software and should be blocked in all enterprise URL Filtering profiles.

What is the 'override' action in URL Filtering used for?

Answer: To allow authorized users to access blocked sites after entering a password

The 'override' action allows specific users to enter an administrator-configured password to temporarily bypass a URL block for a particular site or category.

In Palo Alto Networks, which component must be enabled for URL Filtering to inspect HTTPS websites?

Answer: SSL/TLS Decryption

SSL/TLS Decryption must be configured to allow the firewall to inspect the URLs within encrypted HTTPS sessions, as without decryption only the SNI hostname is visible.