ZIA Malware Protection is an inline security control that blocks malicious files or objects detected through signatures, reputation, and threat-intelligence checks. The policy action must stop the malicious transfer rather than simply route, isolate, or change TLS behavior. Option C (Block) is correct because Block is the malware policy action that prevents the identified malicious content from reaching the user.

Why the other options are incorrect:

A. Isolate: Isolate sends a browser session to a remote isolation environment. Malware Policy enforcement is simpler: detected malware should be blocked.

B. Bypass: Bypass skips an inspection or control path. A malware policy is meant to stop known malicious content, not exempt it from enforcement.

D. Do Not Decrypt: SSL/TLS bypass tells the proxy to pass encrypted traffic without decrypting it for content inspection.