It only detects it while the traffic content in transit on the FW is being inspected. In addition, you can enable the DNS Sinkholing action in Anti-Spyware profiles to enable the firewall to forge a response to a DNS query for a known malicious domain, causing the malicious domain name to resolve to an IP address that you define. This feature helps to identify infected hosts on the protected network using DNS traffic. Infected hosts can then be easily identified in the traffic and threat logs because any host that attempts to connect to the sinkhole IP address is most likely infected with malware. Anti-Spyware and Vulnerability Protection profiles are configured similarly.

Yeah its a poorly worded question cause Palo Alto describes their security profiles as "Security Profile Features". Like stated here. "Additionally, Palo Alto Networks also comes with security profile features, such as antivirus, anti-spyware, VPN, URL Filtering and WildFire features, that are useful in averting both known and unknown threats.”