Which step is necessary to ensure an organization is using the inline cloud analysis features in its Advanced Threat Prevention subscription?

Advanced Threat Prevention (ATP) is an enhancement to the existing anti-spyware engine and is configured within an Anti-Spyware Security Profile. To utilize its features, an administrator must create or update an Anti-Spyware profile and explicitly enable the inline analysis capabilities. This includes both local deep learning models (local inline analysis) and real-time cloud analysis (cloud inline analysis). This configuration step is necessary to activate the engine to inspect traffic for zero-day command-and-control (C2) and other evasive threats, which is the primary function of the inline cloud analysis feature.

A: ATP functionality is built upon the anti-spyware engine; disabling anti-spyware would prevent ATP from working entirely. B: While SSL decryption is essential for inspecting encrypted traffic, it is a prerequisite for visibility, not the direct configuration step that enables the ATP feature itself. D: ATP is configured within the Anti-Spyware profile, not a separate "Advanced Threat Prevention profile." Default settings may not enable the specific inline analysis features.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0 (Nova). "Configure Advanced Threat Prevention". This section states: "Advanced Threat Prevention is configured in an Anti-Spyware profile. You can create a new profile or edit an existing one to enable Advanced Threat Prevention." It details the steps to enable "Cloud Inline Analysis" and "Local Inline Analysis".

2. Palo Alto Networks. (2023). Advanced Threat Prevention Datasheet. This document describes the service's core components: "Industry-first inline deep learning for real-time prevention of unknown C2" and "Real-time cloud-backed C2 detection," confirming these are the features enabled within the security profile.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0 (Nova). "Anti-Spyware Profile". The documentation for this object shows the specific user interface options, including checkboxes for "Enable cloud inline analysis" and "Enable local inline analysis," which must be activated to use the feature.