If the EDL is consistently empty, it implies the firewall is fetching something but isn't finding valid entries. Option B (Correct): Palo Alto Networks firewalls are strict about EDL file formatting. Each entry must be on a new line. If entries are concatenated or the file is not served as plain text, the firewall will likely parse it as empty or invalid. This is a common pitfall when scripting EDL generation. Option A would result in a 'connection refused' or 'file not found' error, not an empty list. Option C is irrelevant; the script runs on the web server, not the firewall. Option D would mean the EDL never updates at all, not that it's empty after updates. Option E would cause intermittent failures, not consistently empty lists.

This is a very specific scenario targeting HTTP/2 vulnerabilities. Standard HTTP/I .1 rate limiting (A, B, C partially) might not be enough because HTTP/2 multiplexing means many logical streams (requests) can occur over a single TCP connection, potentially bypassing 'Per-session' limits. HTTP/2 also has vulnerabilities like 'HPACK Bomb' (excessive header size/count) and slow stream processing. Option E directly addresses these: 1. Target rules for load balancer IPs: Ensures protection is focused. 2. HTTP Flood protection: General HTTP volume. 3. HTTP Header Length and HTTP Header Count: These are CRITICAL for detecting HTTP/2-specific attacks like 'HPACK Bomb' which exploit header compression to consume resources with small packet sizes. This is an advanced feature not present in basic HTTP flood protection. 4. Client Read Timeout: Essential for slow HTTP/2 stream attacks. 5. Action: Protect: Provides a controlled response (e.g., reset stream) rather than outright blocking, minimizing impact on legitimate connections. Option C is close but misses the specific HTTP/2 header-based protections which are vital. Option A incorrectly suggests Syn-Cookie for HTTP and is too simplistic. Option B is too generic. Option D is less granular and reactive. Option E provides the most comprehensive and targeted defense for HTTP/2 DoS.

This scenario requires a rapid, comprehensive incident response. Command Center is paramount for real-time visibility into 'Threat Activity' and 'Network Activity' to quickly identify ongoing propagation, including applications and users. Its dynamic filtering capabilities are essential for pinpointing affected entities. For rapid blocking of indicators of compromise (IPs, URLs), EDLs or custom Anti-Spyware profiles are highly effective. Finally, creating Security Policy rules to quarantine or block traffic to/from infected hosts is the direct action needed to contain the lateral movement. Activity Insights is more for trend analysis, and Policy Optimizer is for policy refinement, not immediate incident response to a zero-day.

Option B best captures the complex conditional preference and failover logic. Two SLA Profiles: By defining and we can enforce different quality criteria for different groups of links. Path Groups: Grouping MPLS and 4G into a 'primary' path group evaluated against ensures they are considered first based on the general requirement. Secondary Path Group for Satellite: Placing Satellite in a 'secondary' path group, evaluated against its own, specific (which relaxes latency but tightens packet loss), allows the system to consider Satellite exceptionally when it meets the stringent packet loss condition, even if it wouldn't be chosen by the primary SLA's latency criteria. Fail Action: The 'Fail Action' of 'Drop' ensures data integrity by preventing MQTT traffic from using any link that doesn't meet any of the specified quality requirements. This hierarchical approach using path groups and distinct SLAs is a powerful feature for granular control over application performance.

The order of security policy rules is critical. First, traffic to known malicious sites should be explicitly denied before any decryption attempts, to prevent potential compromises. Second, specific traffic requiring decryption (cloud storage for DLP) should be handled. Finally, a general rule applies the default decryption policy to all other traffic. Option A correctly sequences these requirements: Block malicious first, then decrypt specific applications, then decrypt general traffic. Using 'application-default' is appropriate for most scenarios as it identifies the actual application.