Explanation/Reference:
B: Most malware sneaks onto the network in legitimate applications or services. Therefore, to safely enable applications you must scan all traffic allowed into the network for threats. To do this, attach security profiles to all Security policy rules that allow traffic so that you can detect threats-both known and unknown-in your network traffic.
D: Log forwarding profiles allow you to forward traffic and threat logs to Panorama or an external system. A log forwarding profile can be added to a security zone to forward zone protection logs or to a security policy to forward logs for traffic that matches that policy.
Incorrect Answers:
A: Rules are not use to identify unclassified traffic.
Note: Besides checking for a specific application, you can also check for any unknown applications in the list of top applications. These are applications that did not match a defined App-ID signature and display as unknown-udp and unknown-tcp. To delve into these unknown applications, click on the name to drill down to the details for the unclassified traffic.
C: Rule 2 and Rule 3 apply to all any address in Trust-L3, and are not restricted to any specific ports.
References:
https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/create-best-practice-security- profiles
https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/log-forwarding- profiles.html