A company wants to ensure that all internal users are prevented from uploading sensitive documents...

Comprehensive and Detailed 150 to 250 words of Explanation From Palo Alto Networks Network Security Analyst Knowledge:

While a File Blocking Profile (Option A) can block files based on their type (e.g., preventing any .docx upload), it does not look at the information within the file. The Data Filtering Profile is the tool designed for Data Loss Prevention (DLP).

An analyst uses Data Filtering to scan file uploads and downloads for specific sensitive patterns, such as credit card numbers, Social Security numbers, or custom regex patterns (like internal project IDs). By attaching this profile to a security rule that allows access to the cloud storage application, the firewall can permit the use of the app while specifically blocking any session that contains unauthorized data. This provides a granular layer of security that protects intellectual property and ensures regulatory compliance without completely disabling the business applications users need to perform their jobs.