When configuring a Remote Network in Prisma Access for a branch office, you must specify the local branch subnets that will be sent through the IPSec tunnel to Prisma Access. Why is it important to accurately define these branch-local subnets in the Remote Network configuration?

• A. It is used by App-ID to identify applications originating from that branch.
• B. It dictates which security profiles (Threat Prevention, URL Filtering) are applied to traffic originating from that branch.
• C. It allows Prisma Access to correctly route traffic from other Prisma Access locations (Mobile Users, other Remote Networks) to the defined branch subnets via the established tunnel.
• D. It determines which public IP address range Prisma Access will use to Source NAT outbound internet traffic from the branch.
• E. It enables Decryption policy for all encrypted traffic originating from those subnets.

A company uses GlobalProtect on a self-managed PA-Series firewall to provide remote access. They have internal network segments defined by VLANs (e.g., Production Servers VLAN 10, Development Servers VLAN 20, User VLAN 30). Users connecting via GlobalProtect are assigned IP addresses from a dedicated VPN pool (e.g., 172.16.1.0/24). The security policy needs to restrict remote users' access to specific applications on specific server VLANs based on their user group and device compliance. How are Security Zones used to implement this segmentation and access control for remote user traffic interacting with internal resources? (Select all that apply)

• A. Define a dedicated Security Zone for the GlobalProtect VPN user pool (e.g., 'VPN-Zone').
• B. Create Security Policy rules with the Source Zone as 'VPN-Zone' and Destination Zone(s) as the respective internal server zones ('Prod-Zone', 'Dev-Zone').
• C. Ensure the GlobalProtect tunnel interface or subinterface that receives user traffic is assigned to the 'VPN-Zone'.
• D. Traffic between remote users (within the VPN IP pool) is implicitly allowed by the intra-zone-default rule because they are in the same 'VPN-Zone'.
• E. Define distinct Security Zones for each internal VLAN (e.g., 'Prod-Zone', 'Dev-Zone').

A network administrator is monitoring the performance and security status of a Prisma SD-WAN deployment managing multiple branch office ION devices. They need a centralized location to view real-time and historical logs for traffic flow, security threats, and application performance across all sites. Where is the primary location within the Palo Alto Networks ecosystem where these logs from Prisma SD-WAN ION devices are collected and made available for analysis?

• A. The local Syslog server deployed at each branch office.
• B. Each individual ION device's local web interface or CLI.
• C. A dedicated, on-premises Panorama appliance acting as a log collector.
• D. The Palo Alto Networks Customer Support Portal.
• E. The Prisma SD-WAN Cloud Management Console, which accesses data stored in Cortex Data Lake.

A company is implementing SSL Forward Proxy decryption for outbound internet traffic using a Palo Alto Networks NGFW. After deploying the firewall's Forward Trust Certificate to employee laptops via GPO, users accessing some internal applications and certain external banking websites report certificate errors or connection failures. Which of the following are potential reasons for these issues and how certificates play a role? (Select all that apply)

• A. The internal applications use client-side certificates for authentication, which is disrupted by the firewall's MITM decryption process.
• B. The firewall is configured to use the Forward Untrust Certificate for these sites, causing browsers to explicitly warn users.
• C. The banking websites use certificate pinning, causing the client browser to reject the certificate re-signed by the firewall's Forward Trust CA.
• D. The firewall's Decryption policy rule for these sites is set to 'No Decrypt', causing connection failures.
• E. The Forward Trust Certificate was not successfully installed or trusted in the certificate store of the user's device or specific application.