In the WildFire best practices linked below, the first step is to "... make sure that you have an active Threat Prevention subscription. Together, WildFire and Threat Prevention enable comprehensive threat detection and prevention."
https://docs.paloaltonetworks.com/wildfire/10-2/wildfire-admin/wildfire-deployment-best- practices/wildfire-best-practices

Migrate from port-based to application-based Security policy rules before you create and deploy Decryption policy rules.
https://docs.paloaltonetworks.com/best-practices/10-2/decryption-best-practices/decryption-best- practices/plan-ssl-decryption-best-practice-deployment

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/network/network- network-profiles/network-network-profiles-monitor.html

Denying traffic will discard the packet. Packets can also be discarded due to malformed or incorrect frames, datagrams or packets.
C and D are irrelevant as packets would never be discarded if allowed and ECMP simply allows the use of multiple routes or paths to a destination.
Read up on "Packer Flow Sequence", it details where exactly it will discard packets (layer 2, layer
3 and on)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0