An organization is migrating its data center to Amazon Web Services (AWS) and needs to deploy VM-Series firewalls to inspect all ingress and egress traffic. The solution must provide both resilience across multiple Availability Zones and the ability to scale horizontally.
Which combination of AWS services and Palo Alto Networks components is required for this use case?

• A. Single VM-Series firewall with an Elastic IP address that can be re-associated upon failure
• B. Amazon EC2 Auto Scaling group with VM-Series firewalls and an Amazon Gateway Load Balancer
• C. PAN-OS active/active high availability (HA) pair with an AWS Transit Gateway
• D. AWS Lambda function that monitors the firewall's health and re-routes traffic using the AWS API

A large enterprise wants to implement certificate-based authentication for both users and devices, using an on- premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency.
Which approach best addresses these requirements while maintaining consistent policy enforcement?

• A. Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CTurn off certificate revocation checks for lower overhead, rely on IP- based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices.
• B. Distribute the root and intermediate CA certificates via Panorama as shared objects to ensure all firewalls have a consistent trust chain. Configure OCSP responder profiles on each firewall to offload revocation checks to an internal OCSP server while keeping CRL checks as a fallback. Maintain separate certificate profiles for user and device authentication and use an automated enrollment method
  - such as Group Policy or SCEP - to deploy certificates to endpoints.
• C. Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency.
• D. Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall's local certificate store for authentication.

An engineer is configuring a GlobalProtect portal and wants to enable split tunneling. The requirement is to route DNS queries for "https://www.google.com/search?q=corp.internal.com" to the DNS servers assigned by the VPN, while allowing all other DNS queries to be resolved by the client's locally configured DNS.
What is the effect of configuring this split DNS policy?

• A. It provides selective DNS resolution, with specified domains resolved through the tunnel, optimizing performance for other lookups.
• B. It forces all applications to use the corporate DNS servers, regardless of the split tunnel settings for IP traffic.
• C. It creates a DNS proxy on the client endpoint that forwards all queries to the firewall for inspection.
• D. It blocks access to all domains that are not explicitly listed in the split tunnel configuration.

An organization is migrating its GlobalProtect user authentication from an existing LDAP directory to a new Kerberos server. To ensure a smooth transition, the network security team needs to allow users from both directories to authenticate for a period of 90 days. The firewall should first attempt authentication against the new Kerberos server and then fall back to the legacy LDAP server if the initial attempt fails.
Which two configurations are required to implement this authentication fallback strategy? (Choose two.)

• A. Configure a new RADIUS proxy on the firewall to handle authentication requests for both Kerberos and LDAP.
• B. Configure an authentication sequence that lists the Kerberos authentication profile first, followed by the LDAP authentication profile.
• C. Implement a User-ID Group Mapping policy to link users between the LDAP and Kerberos directories.
• D. Configure a new authentication profile that references the Kerberos server profile.

An organization uses Cloud Identity Engine (CIE) to gather user information from its on-premises Active Directory (AD) for employees and a separate Azure AD for external partners. Due to compliance regulations, the firewalls protecting the internal network must not have any identity information about external partners.
Conversely, firewalls in the partner-facing DMZ should only be aware of partner identities.
Which CIE feature is designed to solve this data partitioning requirement?

• A. Panorama templates, which can be used to push different User-ID agent configurations to each firewall group
• B. Directory sync filtering, which is used at the source to prevent specific OUs from being imported into CIE
• C. Segments, which can be configured to create distinct, filter-based views of users and groups that are then redistributed only to the appropriate firewalls
• D. Multiple tenants, where a separate CIE tenant is required for each user directory to maintain isolation