A company requires that all file transfers only over HTTP (tcp/80 and tcp/8080) to SaaS...

Comprehensive and Detailed 150 to 250 words of Explanation From Palo Alto Networks Network Security Analyst Knowledge:

To address data exfiltration specifically for SaaS and file-sharing platforms over non-encrypted channels, a Network Security Analyst must combine the power of App-ID with Data Filtering Profiles. The requirement specifies that inspection must occur over specific ports (tcp/80 and tcp/8080) and target SaaS storage.

Option D is the most accurate because it utilizes an Application Filter. Application filters are dynamic objects that automatically include applications sharing specific characteristics—in this case, the "file-sharing" subcategory which encompasses SaaS storage providers. By setting the Service to a custom service object containing ports tcp/80 and tcp/8080, the analyst ensures the rule only triggers on the unencrypted traffic specified in the requirement.

The Data Filtering Profile is the specific security profile designed to detect patterns (like credit card numbers, Social Security numbers, or custom regex) within file transfers to prevent exfiltration. While Option C mentions data filtering and the correct ports, it lacks the application specificity (SaaS storage) required. Option A is too broad as it only targets "web-browsing," which may not capture specific file-sharing App-IDs. By using an application filter, the analyst ensures that as new SaaS storage applications emerge, they are automatically added to the inspection policy, maintaining a robust security posture against data leakage.