When deploying a pair of Palo Alto Networks firewalls in an active/active high availability (HA) cluster what is the dedicated role of the HA3 link?

• A. Management plane synchronization for configurations and policies
• B. Packet forwarding for session setup and asymmetric traffic
• C. Data plane synchronization for session tables and forwarding tables
• D. Control plane synchronization for heartbeats and state information

To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers.
Resources exist on AWS and Azure:
The AWS deployment is architected with AWS Transit Gateway, to which all resources connect The Azure deployment is architected with each application independently routing traffic The engineer deploying Cloud NGFW in these two cloud environments must account for the following:
Minimize changes to the two cloud environments
Scale to the demands of the applications while using the least amount of compute resources Allow the company to unify the Security policies across all protected areas Which two implementations will meet these requirements? (Choose two.)

• A. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules.
• B. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.
• C. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama.
• D. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.

Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

• A. Configure the subordinate CA to issue certificates with indefinite validity periods.
• B. Disable all existing SSL decryption rules until the new certificate is fully propagated.
• C. Set the subordinate CA certificate as the default routing certificate for all network traffic.
• D. Import the new subordinate CA certificate into the trust stores of all client devices.

For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

• A. Tunnel monitoring
• B. Use of peer IP
• C. Use of dynamic routing protocols
• D. Redistribution of User-ID

When considering the various methods for User-ID to learn user-to-IP address mappings, which source is considered the most accurate due to the mapping being explicitly created through an authentication event directly with the firewall?

• A. X-Forwarded-For (XFF) headers
• B. GlobalProtect
• C. Authentication Portal
• D. Server monitoring