WildFire logs showing a "malicious" verdict with an "allow" action indicate that the initial traffic wasn’t blocked in real-time, likely because the Antivirus profile isn’t configured to act immediately on WildFire verdicts. By default, WildFire submits files for analysis, and signatures may take up to 24 hours to propagate globally unless real-time blocking is enabled. Configuring the Antivirus security profile (Option B) to "block" on malicious WildFire verdicts ensures that threats are blocked within minutes once the verdict is returned (typically 5-15 minutes), leveraging WildFire’s real-time signature updates.

Option A (WildFire analysis profile) defines what files are sent to WildFire but doesn’t control blocking actions. Option C (File Blocking profile) manages file type blocking, not threat verdicts. Option D (file size limits) affects submission eligibility, not blocking behavior. The Antivirus profile is the key to real-time WildFire enforcement, as per Palo Alto Networks documentation.