Which step is necessary to ensure an organization is using the inline cloud analysis features in its Advanced Threat Prevention subscription?

To activate the Advanced Threat Prevention (ATP) subscription's features, an administrator must configure them within an Anti-Spyware Security Profile. This involves creating a new profile or modifying an existing one to enable the advanced analysis capabilities. ATP combines on-box deep learning with inline cloud analysis to detect and block unknown command-and-control (C2) and other evasive threats in real time. This configuration step is the direct action required to enable the service on the firewall, which is then applied to relevant Security policy rules.

A: Disabling the anti-spyware profile is incorrect. Advanced Threat Prevention is an enhancement to, not a replacement for, the existing anti-spyware capabilities.

B: While SSL decryption is essential for ATP to inspect encrypted traffic and be fully effective, it is a prerequisite, not the direct configuration step to enable the ATP feature itself.

D: Advanced Threat Prevention is not a standalone profile type. Its settings are configured within the Anti-Spyware profile, making the premise of this option incorrect.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0 (Nova). "Configure Advanced Threat Prevention".

Section: Get Started with Advanced Threat Prevention

Content: The guide explicitly states

"After you have a valid license

you can begin configuring and enforcing Advanced Threat Prevention by creating an Anti-Spyware profile... This enables you to apply Advanced Threat Prevention to traffic that matches any Security policy rule that includes the profile." This directly supports that configuration occurs within the Anti-Spyware profile.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0 (Nova). "Advanced Threat Prevention".

Section: Advanced Threat Prevention Overview

Content: The documentation describes ATP's mechanism: "Advanced Threat Prevention uses a cloud-based and on-box

inline deep learning detection engine to identify and prevent malicious C2 traffic from leaving the network." This confirms that the feature set includes both local (on-box) models and cloud analysis

aligning with the substance of option C.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0 (Nova). "Prerequisites for Advanced Threat Prevention".

Section: Prerequisites for Advanced Threat Prevention

Content: This section lists requirements

including

"For Advanced Threat Prevention to be effective

you must enable decryption on the firewall." This clearly defines SSL decryption as a prerequisite for effectiveness

differentiating it from the primary configuration step of enabling the feature in a profile.