A network administrator obtains Palo Alto Networks Advanced Threat Prevention and Advanced DNS Security subscriptions for edge NGFWs and is setting up security profiles. Which step should be included in the initial configuration of the Advanced DNS Security service?

The initial configuration of Advanced DNS Security involves creating or modifying an Anti-Spyware profile. Within this profile, under the DNS Signatures tab, an administrator must define the action to be taken for various malicious domain categories. The recommended best practice is to set the action to "sinkhole" for malicious categories. This action redirects DNS queries for known malicious domains to an internal sinkhole IP address, which prevents clients from connecting to the malicious site and helps identify compromised hosts on the network. This is a fundamental step to make the service operational and effective.

A. Decrypting DNS-over-TLS is necessary for visibility into encrypted DNS traffic but is configured in a Decryption policy, not as the primary step in setting up the DNS Security service's core actions.
B. Creating overrides for company-owned FQDNs is a policy tuning or customization step to prevent false positives, not a required part of the initial service configuration.
D. Advanced Threat Prevention is a separate subscription and security service, configured in different profiles (e.g., Vulnerability Protection). The question specifically asks about Advanced DNS Security.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "Configure DNS Security" section.

Reference: In the chapter on DNS Security, the guide outlines the configuration steps. Step 2 is "Create an Anti-Spyware profile for DNS Security." Within this step, the guide states: "For each Palo Alto Networks Content-defined signature, select an Action... For the best protection, it is recommended that you set the action to sinkhole for all malicious categories..." This confirms that configuring the sinkhole action is a primary initial step.

2. Palo Alto Networks, "DNS Security" Datasheet.

Reference: The datasheet describes the core functionality: "When a user or device attempts to access a malicious domain, DNS Security can automatically block access or redirect the user to a custom sinkhole page." This highlights sinkholing as a central feature that must be configured.

3. Palo Alto Networks TechDocs, "DNS Sinkhole" article.

Reference: The article explains, "To use the DNS sinkhole action, you must configure it in an Anti-Spyware profile and then attach the profile to a security policy rule." This directly links the sinkhole configuration to the initial setup within the Anti-Spyware profile, which is the mechanism for enabling DNS Security policies.