The difference between deny and drop is that deny will make a router (or other device) send an ICMP type 3 (destination unreachable) message response back, where drop will not notify the sending party that the device has be denied and just silently drop the traffic.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/configure-an-authentication-profile-and-sequence

Antivirus: Includes new and updated antivirus signatures, including WildFire signatures and automatically generated command-and-control (C2) signatures. WildFire signatures detect malware seen first by firewalls from around the world. You must have a Threat Prevention subscription to get these updates.
New antivirus signatures are published daily.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/threat-prevention/best-practices-for-content-and-threat-content-updates/best-practices-mission- critical.html

Using IP address is layer 3. Mac address is layer 2.