The CFO found a malware infected USB drive in the parking lot, which when inserted infected their corporate laptop the malware contacted a known…

The Anti-Spyware profile is specifically designed to detect and block malicious traffic from spyware, which includes command-and-control (C2) communications. The DNS Sinkhole feature, configured within the Anti-Spyware profile, intercepts DNS queries for known malicious domains (such as C2 servers). It then forges a reply, redirecting the infected client to a non-routable or internal IP address (the "sinkhole"). This action prevents the malware from establishing a connection with its C2 server, thereby blocking data exfiltration and allowing administrators to identify the compromised host.

A. Create a Data Filtering Profile and enable its DNS sinkhole feature.

Data Filtering profiles prevent exfiltration of specific data patterns (e.g., credit card numbers) and do not have a DNS sinkhole feature.

B. Create an Antivirus Profile and enable its DNS sinkhole feature.

Antivirus profiles block malware in file transfers. This profile does not contain the DNS sinkhole feature; that function resides within the Anti-Spyware profile.

D. Create a URL Filtering Profile and block the DNS sinkhole URL category.

URL Filtering blocks access to web pages by category. There is no "DNS sinkhole" URL category, and this profile is not the primary mechanism for C2 prevention via DNS interception.

---

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2 (2022).

Section: Anti-Spyware Profiles.

Content: "Anti-Spyware profiles block spyware on compromised hosts from trying to contact external command-and-control (C2) servers... You can also enable DNS Sinkholing to help you identify infected hosts on your network using DNS traffic." This directly links the Anti-Spyware profile and its DNS Sinkhole feature to the prevention of C2 communications.

2. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2 (2022).

Section: Configure DNS Sinkholing.

Content: "To enable DNS sinkholing

you must configure it in an Anti-Spyware profile and then apply that profile to a security policy rule that allows DNS traffic." This confirms that DNS Sinkhole is a feature configured exclusively within the Anti-Spyware profile.

3. Palo Alto Networks

"Palo Alto Networks Certified Network Security Analyst (PCNSA) Study Guide" (2021).

Section: Module 4: Securing Traffic with Security Profiles.

Content: The guide explains that the Anti-Spyware profile is used to identify and block C2 traffic. It details that DNS Sinkhole is an action within this profile used to identify infected clients by redirecting their malicious DNS queries. It explicitly differentiates this from Antivirus (for file-based threats) and Data Filtering (for data patterns).