A prospective customer is concerned about stopping data exfiltration, data infiltration, and command-and-control (C2) activities...

DNS Security (Answer C):

DNS Securityis the appropriate subscription for addressingthreats over port 53.

DNS tunneling is a common method used fordata exfiltration, infiltration, and C2 activities, as it allows malicious traffic to be hidden within legitimate DNS queries.

The DNS Security service appliesmachine learning modelsto analyze DNS queries in real-time, block malicious domains, and prevent tunneling activities.

It integrates seamlessly with the NGFW, ensuring advanced protection against DNS-based threats without requiring additional infrastructure.

Why Not Threat Prevention (Answer A):

Threat Prevention is critical for blocking malware, exploits, and vulnerabilities, but it does not specifically addressDNS-based tunnelingor C2 activities over port 53.

Why Not App-ID and Data Loss Prevention (Answer B):

While App-ID can identify applications, and Data Loss Prevention (DLP) helps prevent sensitive data leakage, neither focuses on blockingDNS tunnelingor malicious activity over port 53.

Why Not Advanced Threat Prevention and Advanced URL Filtering (Answer D):

Advanced Threat Prevention and URL Filtering are excellent for broader web and network threats, but DNS tunneling specifically requires theDNS Security subscription, which specializes in DNS-layer threats.

References from Palo Alto Networks Documentation:

DNS Security Subscription Overview