Basic Concept: Split DNS lets GlobalProtect resolve selected domains through VPN DNS while leaving other names to local DNS. This improves performance without breaking internal name resolution.
Why A is Correct: The policy selectively resolves listed corporate domains through the tunnel and leaves all other lookups local.
Why B is Wrong: It blocks access to all domains that are not explicitly listed in the split tunnel configuration. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why C is Wrong: It forces all applications to use the corporate DNS servers, regardless of the split tunnel settings for IP traffic. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: It creates a DNS proxy on the client endpoint that forwards all queries to the firewall for inspection. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

By default, the Autonomous Digital Experience Manager (ADEM) traffic is configured to use the management interface in a Palo Alto Networks firewall. The management interface is typically used for management-related traffic, such as monitoring and logging, and it is configured to handle ADEM-related traffic for the optimal performance of digital experience monitoring features. This default configuration helps ensure that ADEM traffic does not interfere with regular traffic that may traverse other interfaces, such as traffic from security zones or IPSec tunnels. 

Basic Concept: SD-WAN path quality profiles measure latency, jitter, and packet loss. Panorama REST API endpoints support programmatic profile creation for managed deployments.
Why C is Correct: The SDWanPathQualityProfiles REST object on Panorama is the correct API target for creating path quality profiles centrally.
Why A is Wrong: XML API command with an xpath of config/devices/entry/vsys/entry/path-quality-profiles on Panorama is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
Why B is Wrong: XML API command with an xpath of sdwan/path-quality-profiles on a managed firewall is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
Why D is Wrong: POST request to the pathMonitoringProfiles object endpoint via the REST API on a managed firewall is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Basic Concept: Zone type is the PAN-OS category that matches interface mode. Valid selectable zone types include Layer 2 and Layer 3, among others.
Why A and B are Correct: Layer 3 and Layer 2 are valid zone types; Management and DMZ are not PAN-OS zone types, although DMZ is often used as a zone name.
Why C is Wrong: Management is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why D is Wrong: DMZ is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

In the Palo Alto Networks architecture, establishing a site-to-site VPN requires a clear understanding of how the Security Policy engine interacts with different traffic flows. According to technical documentation (Step 7 of the IPSec configuration guide), there are two distinct categories of traffic to consider: the Control Plane (negotiation) and the Data Plane (transit). First, the IKE negotiation (UDP 500/4500) and IPSec/ESP packets are directed at the firewall’s own external interface. Because the peer gateway is usually reachable through the same zone as that interface (e.g., 'Untrust'), the traffic is processed as intrazone. By default, PAN-OS includes an intrazone-default security policy set to 'Allow'. Consequently, the tunnel can technically establish without an explicit rule, provided no manual 'Deny All' rule precedes it. This confirms that negotiation is allowed by default via the intrazone policy. Second, regarding the data traffic entering or exiting the tunnel interface, the firewall applies standard zone-based inspection. While the firewall is stateful and policies are unidirectional, the documentation specifies that creating separate rules for each direction (one for inbound and one for outbound) is optional. An administrator can choose to create two granular rules for tighter control or combine both directions into a single rule by adding both the internal and tunnel zones to the source and destination fields. This flexibility allows for a more streamlined rule base while still meeting security requirements.

Basic Concept: Before logical routers can be configured, PAN-OS must be switched from the legacy virtual router model to the Advanced Routing Engine through the firewall's general routing setting.
Why D is Correct: The General setting is correct because enabling advanced routing is the prerequisite that exposes logical router configuration; it is not activated by a license, plugin, or content package.
Why A is Wrong: Advanced Routing Engine is not enabled by adding a license alone. Licensing may affect platform features, but logical routers require the routing engine setting.
Why B is Wrong: Plugins extend integrations such as SD-WAN, but they do not enable the base Advanced Routing Engine.

Why C is Wrong: Content updates deliver application, threat, and signature data. They do not activate logical router support.

Basic Concept: A tunnel interface IP address enables Layer 3 functions that require the firewall to source or receive traffic over the tunnel itself.
Why A and C are Correct: Tunnel monitoring and dynamic routing require an IP address on the tunnel interface; encryption and NAT traversal do not depend on that address.
Why B is Wrong: Firewall performing NAT traversal. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: Firewall encrypting and decrypting packet payloads. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Basic Concept: Authentication Portal creates User-ID mappings from a direct user authentication event on the firewall, making it more explicit than mappings inferred from server logs.
Why D is Correct: Authentication Portal is correct because the firewall itself validates the user and records the source IP mapping.
Why A is Wrong: X-Forwarded-For (XFF) headers is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why B is Wrong: Server monitoring is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why C is Wrong: Global Protect is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.