Select Two (Multi-Select) Questions

Device certificates and CA certificates used for secure communication between Panorama and managed firewalls.

Backing up certificates ensures that trust relationships with managed firewalls are maintained after restoration.

Panorama state-based configuration backups (.tgz export files containing device configs and templates).

Configuration backups contain the complete hierarchical object, device group, and template configuration.

State and auth-keys associated with managed firewalls and log collectors.

Auth-keys and registration states are essential for re-establishing management communication without re-registering every firewall.

Confirm that Panorama has successfully pushed the updated Dynamic Address Group policy configuration to the managed firewalls.

If the security rule referencing the DAG hasn't been committed and pushed to the firewall, traffic matching will not occur.

Check that the target firewall is successfully receiving User-ID updates and communicating with Panorama/User-ID agents.

Firewalls must receive the tag-to-IP mapping updates to evaluate traffic against the DAG.

Verify that the tag name used in the User-ID API registration exactly matches the tag specified in the Dynamic Address Group object configuration.

Tag names are case-sensitive and must match identically between the registration call and the DAG definition.

Incorporate robust error handling, token caching, and exponential backoff retry mechanisms in automation scripts to manage API rate limits.

Handling rate limits and caching authentication tokens ensures scripts remain stable and resilient.

Leverage External Dynamic Lists (EDLs) for high-frequency indicator updates instead of programmatically modifying security policy rules via API calls.

Using EDLs avoids commit storms and rate limits by having firewalls poll an external list rather than updating rules directly via API.

Implement asynchronous API task handling and status polling for long-running operations such as large report generation or bulk software pushes.

Asynchronous job queues prevent API timeouts during heavy processing tasks.

Configuring Log Collector Groups to allow log redundancy and failover handling across multiple collector nodes.

Collector Groups provide high availability by enabling log forwarding failover to member collectors if a primary node goes offline.

Ensuring that the network bandwidth between firewalls and Log Collectors exceeds the peak log generation rate.

Sufficient WAN/LAN bandwidth prevents log queue overflows and packet drops during high-traffic security events.

Transport protocol (UDP, TCP, or SSL) and port number.

Syslog server profiles require specifying whether communication uses UDP, TCP, or SSL and the corresponding destination port.

Facility level (e.g., LOG_USER, LOG_LOCAL0 through LOG_LOCAL7).

The syslog facility defines the log category classification used by the receiving SIEM.

Design a clean, shallow hierarchical Device Group and Template structure to minimize commit evaluation complexity.

Avoiding overly deep nested hierarchies reduces configuration evaluation overhead during commits.

Deploy Dedicated Log Collectors to offload log processing and storage from the Panorama management appliances.

Offloading logs to Dedicated Log Collectors preserves Panorama CPU and memory for policy management and configuration pushes.

Implement Panorama High Availability (HA) to provide automatic failover of the management plane.

Panorama HA ensures continuous administrative availability if the primary management node fails.

Retrieving active session table information from firewalls using operational command API requests.

Operational API commands ('type=op') can retrieve live session tables and system state metrics.

Dynamically adding or removing IP addresses from Dynamic Address Groups via User-ID tag registration API calls.

User-ID tag registration APIs allow automated addition and removal of IP addresses to Dynamic Address Groups instantly.

Triggering a configuration commit on Panorama to push updated security policies to managed firewalls.

API calls can initiate a commit on Panorama, pushing candidate configuration changes to managed firewalls.

Access to specific Device Groups or Templates, limiting administrators to only manage designated regions.

Device Group and Template permissions can be restricted per admin role to enforce geographical or functional boundaries.

Permissions to execute specific operational tasks, such as running packet captures or clearing sessions.

Operational task permissions can be granularly granted or denied in Admin Role Profiles.

Reserve 100% of allocated CPU and memory resources on the hypervisor to prevent hypervisor CPU stealing and memory swapping.

Reserving CPU and memory ensures predictable performance and prevents latency in database indexing and log processing.

Provision dedicated virtual disks for logging and system partitions using high-performance storage backends.

Separating and properly provisioning virtual disks for logs ensures high I/O throughput and prevents disk saturation.

action=get (or set/edit/delete) to specify the operation being performed on the configuration tree.

The 'action' parameter defines whether you are retrieving, creating, or modifying configuration data.

xpath specifying the exact XML path within the PAN-OS configuration hierarchy to target.

The 'xpath' parameter locates the exact XML element or subtree within the configuration database.

The administrator account used for API requests must have sufficient RBAC permissions to execute the requested API commands.

API requests inherit the permissions of the authenticated user; insufficient RBAC rights result in authorization errors.

HTTPS and XML/REST API access must be enabled and permitted in the Management Profile applied to the management interface.

Management profiles control which services (HTTPS, SSH, API) are accessible on management interfaces.

Virtual routers and static/dynamic routing protocol configurations.

Routing configurations are network-level settings managed through Templates.

Physical and logical interface settings (such as Ethernet, VLAN, and Loopback interfaces).

Interfaces are core network infrastructure settings configured via Templates.

Provision and manage bootstrapping configurations for VM-Series firewalls in cloud environments.

The plugin facilitates bootstrapping management across clouds.

Synchronize cloud tags and metadata to populate Dynamic Address Groups on managed firewalls.

Cloud metadata synchronization is a core capability of the VM-Series plugin.

Azure Service Principal (Client ID, Tenant ID, and Secret) with appropriate reader permissions

Azure API credentials are required for Panorama to query resource tags.

Panorama Cloud Services plugin installed and configured

The Cloud Services plugin enables API communication with Azure.

Dynamic Address Group object configured in Panorama referencing the cloud tags

DAGs are defined in Panorama to map the ingested cloud tags to IP addresses.

Configure jumbo frames (MTU 9001) where supported by the cloud virtual network and interfaces.

Jumbo frames reduce packet overhead and CPU cycles per gigabit transferred.

Enable Azure Accelerated Networking on all data plane network interfaces (NICs).

Accelerated Networking bypasses the host vSwitch to deliver higher packet throughput and lower latency.

Ensure the VM-Series instance size matches Palo Alto Networks verified sizing guidelines (vCPU/RAM).

Proper instance sizing is critical to avoid CPU exhaustion and packet drops.

Enabling IP Forwarding on all data plane network interfaces (NICs).

IP Forwarding is mandatory for GCP instances acting as routers/firewalls.

Attaching appropriate IAM service accounts and access scopes to allow API interactions.

Service accounts and access scopes allow the VM-Series to interact with GCP APIs.

Configuring VPC route tables with next-hop pointing to the VM-Series firewall interface or internal load balancer.

GPC routes must direct traffic to the firewall for inspection.

VM-Series firewalls can be scaled out horizontally across multiple availability zones behind the GWLB.

GWLB supports horizontal auto-scaling of security appliance pools across AZs.

GWLB uses the GENEVE protocol on UDP port 6081 to encapsulate packets sent to the VM-Series appliances.

GENEVE encapsulation over UDP 6081 is the standard mechanism for GWLB traffic wrapping.

The VM-Series firewall data interfaces must terminate the GENEVE encapsulated traffic.

VM-Series firewalls process the GENEVE-encapsulated packets received from the GWLB.

AWS S3 bucket containing the standard bootstrap folder structure (config, content, software, license)

AWS S3 is the primary supported mechanism for bootstrapping VM-Series firewalls.

AWS EC2 instance user-data field containing initialization properties

The AWS user-data field can pass init-cfg.txt properties directly to the firewall upon launch.

BGP (Border Gateway Protocol) running over IPsec for dynamic route propagation

BGP over IPsec is widely used to dynamically exchange routing updates between on-prem and cloud.

IPsec VPN tunnels using IKEv2 with pre-shared keys or certificates

IPsec VPN with IKEv2 is the industry standard for secure site-to-site hybrid connections.

App-ID utilizes signature inspection, protocol decoding, and heuristic analysis to identify applications accurately.

App-ID uses multi-stage inspection including signatures, decoders, and heuristics.

User-ID maps user identities to IP addresses, allowing administrators to write security policies based on Active Directory groups rather than IP addresses.

User-ID enables user- and group-based access control.