Select Two (Multi-Select) Questions

Configure a certificate profile that validates the LDAP server's certificate for administrator logins.

Why it fails: A certificate profile is used for SSL/TLS inspection or certificate-based authentication, not for LDAP bind authentication. While LDAPS can use certificates, the scenario requires group-based role assignment, which is handled by authentication and authorization profiles, not a certificate profile.

Enable User-ID on the management interface to discover the LDAP groups.

Why it fails: User-ID discovers IP-to-user mappings for traffic enforcement, not for administrator authentication. Enabling it on the management interface does not map LDAP groups to admin roles and is not part of the admin authentication workflow, so it would not satisfy the requirement.

Create a security policy rule that allows LDAP traffic from the management interface to the LDAP server.

Why it fails: Management-plane traffic to external authentication servers is handled by a management interface service route, not by a security policy rule. A security policy rule applies to data-plane traffic and would not permit the firewall's own LDAP queries, making this step ineffective for admin authentication.

Static Routing

Why it fails: Static routing is a core networking function available on the firewall without any licence; subscription entitlements cover dynamic updates such as Threat Prevention, WildFire, URL Filtering and DNS Security. It is tempting because routing features are sometimes bundled in advanced editions, but here no licence check applies.

Interface creation

Why it fails: Interface creation is a base system function available without any subscription; licences gate content and threat feeds, not interface definitions. It is tempting because interfaces underpin every licensed feature, but the subscription requirement attaches to the service consuming traffic, not the interface itself.

NAT

Why it fails: NAT is a core networking capability included in the base image, requiring no subscription licence. It is tempting because NAT policy interacts with licensed security processing, yet the address translation function itself is not gated; only subscription services such as threat prevention or DNS security need entitlement.

Same virtual router configuration

Why it fails: Not required.

Different management IP addresses

Why it fails: Management IPs should be different, but it's not a direct 'HA configuration' step like the others.

Create a security policy allowing traffic from the local zone to the VPN zone.

Why it fails: A security policy is necessary to permit traffic, but it is not a routing configuration. The question specifically asks for configurations required to enable routing of traffic into the tunnel. Security policies control whether traffic is allowed, but they do not influence the routing decision. Thus, this is not a correct answer for routing enablement.

Configure a NAT policy to translate traffic entering the tunnel.

Why it fails: NAT is not required for routing traffic into a VPN tunnel. In fact, NAT is often avoided for VPN traffic to preserve original addresses. While NAT may be used in some scenarios, it is not a prerequisite for routing traffic through the tunnel. This option is incorrect for the stated requirement.

Enable OSPF on the tunnel interface.

Why it fails: Enabling OSPF is not strictly required for basic site-to-site VPN routing. While dynamic routing can be used to learn remote networks, static routes are sufficient for many deployments. The question asks for required configurations to enable routing; OSPF is optional and depends on the network design. Therefore, it is not a mandatory step.

Syslog

Why it fails: Syslog is a logging and event-forwarding protocol; it carries no credential exchange, so it cannot authenticate administrators. It is tempting because syslog servers are often paired with authentication infrastructure, but the correct choices are RADIUS, TACACS+, LDAP, Kerberos and local database authentication.

NTP

Why it fails: NTP synchronises system clocks across devices; it performs no credential verification, so it cannot authenticate administrators to the firewall. It is tempting because accurate time is required for certificate and token validation, but the valid methods are RADIUS, TACACS+, LDAP, Kerberos and local database authentication.

DHCP

Why it fails: DHCP assigns IP addresses and network parameters to clients; it exchanges no authentication credentials, so it cannot verify administrator identity. It is tempting because DHCP can supply a management address, but the valid methods are RADIUS, TACACS+, LDAP, Kerberos and local database authentication.

Set the interface's OSPF network type to point-to-point.

Why it fails: The OSPF network type is automatically broadcast for Ethernet interfaces. While you can change it to point-to-point, it is not a required step for basic adjacency formation on a broadcast network. The default settings will work if both sides agree. This is an optional tuning parameter, not a mandatory configuration.

Configure a virtual link to the neighboring router's router ID.

Why it fails: Virtual links are used to connect OSPF areas to the backbone through a non-backbone area. They are not required for basic adjacency formation on a directly connected interface. In this scenario, the firewall and neighbor are directly connected, so a virtual link is unnecessary and would not help form the adjacency.

Enable OSPF graceful restart on the virtual router.

Why it fails: Graceful restart is an optional feature that helps with non-stop forwarding during restart. It is not required to form an adjacency or advertise routes. While it can be beneficial in production, it is not a mandatory step for initial OSPF configuration.

DNS

Why it fails: DNS resolves names to addresses; it does not forward event records to a SIEM, though DNS query logs themselves are a valuable telemetry source. It is tempting because DNS is ubiquitous and logged, and it would be correct if the question asked which protocol Syslog or CEF messages are commonly transported over.

ICMP

Why it fails: ICMP carries control and error messages such as echo requests, not event records, so it cannot transport log data to a SIEM. It is tempting because it is a common network protocol visible in firewall logs, and it would be correct if the question asked which protocol ping or path MTU discovery uses.

Telnet

Why it fails: Telnet forwards no logs to a SIEM; it is an interactive cleartext terminal protocol, and its lack of encryption or structured message framing disqualifies it. It is tempting because it is a TCP-based network protocol, and it would be the right answer if the question asked about insecure remote device administration.

Create a security policy rule.

Why it fails: A security policy rule controls permitted traffic between zones and does not attach or activate a zone protection profile. It is tempting because zone protection and policy rules are both configured under Policies, and creating a rule would be correct when permitting or denying specific application traffic across zones.

Assign the zone to a virtual router.

Why it fails: Virtual router membership determines routing and interface participation, not zone protection enforcement. It is tempting because zones are commonly bound to virtual routers during interface setup, and that assignment would be correct when defining which routed interfaces belong to a zone for Layer 3 forwarding.

Enable the 'Strict' mode on the interface.

Why it fails: Zone protection profiles attach to a security zone object; interface mode settings such as Strict are unrelated and cannot enable profile enforcement. It is tempting because interface configuration often accompanies zone hardening, and Strict mode would be correct when enforcing neighbour discovery or DHCP restrictions on an interface.

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Why it fails: In a Panorama-managed environment, device group configurations are managed on Panorama, not directly on managed firewalls. Using 'set' on each firewall would bypass Panorama and could cause configuration conflicts. The correct approach is to modify on Panorama and push.

Use the 'validate' action to ensure the configuration is valid before committing.

Why it fails: While 'validate' can check the candidate configuration for errors, it is not a required step for pushing configuration to managed devices. It is an optional best practice but not mandatory for the commit-all process. The essential steps are authentication and commit-all.

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Why it fails: While 'commit' with 'partial' can be used to commit specific changes, it is not required for pushing configuration to managed devices. The standard method is to use 'commit-all' to push to devices. The 'partial' parameter is for committing specific parts of the candidate configuration on a single device, not for Panorama to device push.

Use the <key> element to provide the API key for authentication.

Why it fails: While authentication is required, providing the API key via the <key> element is one valid method, but it is not the action that makes the rule active. The question states the script already authenticates with an API key, so this is not a missing step. Authentication alone does not commit the configuration; it only grants access to perform operations.

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Why it fails: The location element (such as 'shared' or 'vsys') determines where the rule is stored, but it does not activate the rule. Even if the rule is placed correctly, it remains in the candidate configuration until a commit is executed. Therefore, this is not one of the two actions required to make the rule active; it is a placement detail that must be correct but is not the activation step.

Include the <vsys> element to specify the virtual system for the rule.

Why it fails: Specifying the vsys is necessary to place the rule in the correct virtual system, but it is not the action that activates the rule. The rule could be created in the candidate configuration with or without the vsys element (though vsys is required for proper placement). However, the rule will not become active until a commit is performed, so this is not one of the two required actions.

Enable 'Default Information Originate' in the OSPF global settings.

Why it fails: 'Default Information Originate' is a Cisco IOS command, not a PAN-OS configuration option. PAN-OS uses redistribution profiles to control which routes are exported into OSPF. This option is incorrect because it references a command from a different vendor and does not exist in PAN-OS.

Enable 'Advertise Default Route' in the OSPF area configuration.

Why it fails: PAN-OS does not have a simple 'Advertise Default Route' checkbox in the OSPF area configuration. Instead, you must use redistribution profiles to inject the default route. This option is a common misconception because some other vendors provide such a feature, but in PAN-OS, redistribution is the correct method.

Set the OSPF router priority to a non-zero value to allow default route propagation.

Why it fails: OSPF router priority is used for DR/BDR election on broadcast networks. It has no effect on the advertisement of default routes. Setting a non-zero priority does not enable default route redistribution. This option confuses the role of router priority with route redistribution, which are unrelated concepts.

Configure a DHCP relay agent to forward requests to an external DHCP server.

Why it fails: A DHCP relay agent is used when the DHCP server is on a different subnet. In this scenario, the firewall itself is the DHCP server, so relay is not needed. Configuring relay would direct requests away from the firewall's own DHCP service, which is not the goal.

Create a security policy allowing DHCP traffic from the guest zone to the firewall's management interface.

Why it fails: DHCP traffic is allowed implicitly within the same zone or via the firewall's DHCP server function. A security policy is not required for the firewall to respond to DHCP requests on the interface where DHCP server is enabled. The firewall handles DHCP as a service, and no explicit policy is needed for the DHCP exchange itself.

Assign a static IP address to the guest client devices manually.

Why it fails: Assigning static IPs manually defeats the purpose of configuring a DHCP server. The administrator wants the firewall to provide IP addresses dynamically. Manual assignment is not scalable and does not utilize the DHCP server functionality being configured.

Management Profile

Why it fails: A management profile is attached to an interface to permit administrative access such as ping or HTTPS, not configured inside the virtual router. It tempts because interface settings appear alongside routing options, but management profiles are separate interface-level objects.

Tunnel Interface IPs

Why it fails: Tunnel interface IPs belong to the tunnel interface configuration, not the virtual router, which holds static routes, redistribution, and virtual-router-to-zone bindings. It tempts because route-based VPN traffic traverses the virtual router, but addressing is assigned on the tunnel interface itself.

Security Zones

Why it fails: Security zones are defined separately and then bound to interfaces; the virtual router references them for inter-zone routing but does not configure them. It tempts because zone membership determines which routes apply, yet zone objects are created in the Network zones section.

Default Gateway

Why it fails: A default gateway is a Layer 3 routing setting on the interface or virtual router, not a permitted management-service entry. It is tempting because management access requires routable connectivity, but the profile only enables services such as HTTPS, SSH, ping and SNMP.

Zone Assignment

Why it fails: Zone assignment is configured on the interface itself, not within the Interface Management Profile, which only toggles permitted management services. It is tempting because zones govern policy and traffic handling, yet they are irrelevant to which administrative protocols the interface answers.

DNS Server

Why it fails: DNS server addresses belong to interface or virtual-router network configuration, not the Interface Management Profile, which lists management services only. It is tempting because DNS is needed for management traffic, but the profile itself never defines resolver addresses.

Destination MAC address

Why it fails: A Service Route binds traffic to a source interface and next-hop gateway, not a Layer 2 destination. Specifying a MAC address applies to static ARP entries or Layer 2 forwarding decisions, so it cannot direct external traffic out a chosen egress interface. It would be correct where a next-hop device requires a fixed MAC mapping.

Default Gateway

Why it fails: A service route binds traffic to a source interface and source address; the default gateway is a routing-table entry, not part of the service route definition. The interface and its IP address determine egress. Default gateway configuration would be the right answer when defining a static route for general outbound forwarding.

VLAN Tag

Why it fails: A VLAN tag is a Layer 2 header field applied by an interface or subinterface; the service route itself only selects the source interface and source address. Tagging is configured separately on the physical or subinterface. VLAN tags would be the correct focus when segmenting traffic across a trunk carrying multiple networks.

Install an SSL certificate for the list source.

Why it fails: EDLs are fetched over HTTP or HTTPS, so an SSL certificate is only needed when the source enforces HTTPS with a certificate the firewall does not already trust; plain HTTP lists need none. It is tempting because certificate import is a genuine prerequisite for HTTPS-hosted lists, but the stem does not specify that.

Enable threat prevention logs.

Why it fails: Threat prevention logs record traffic verdicts after policy evaluation; they do not make the firewall fetch, parse or enforce an EDL. Enabling them is tempting because EDL hits appear in those logs, but logging is an observability setting, not a configuration step required for the list to function.

Restart the firewall.

Why it fails: EDL updates are applied dynamically without restarting the dataplane, so a reboot contributes nothing to integration. It is tempting because restarts do resolve some configuration-loading faults, but the required steps are creating the EDL object and referencing it in a policy rule, which take effect immediately.

proxy-server

Why it fails: Optional depending on network topology.

dhcp-client

Why it fails: Not strictly required for registration.

Virtual routers

Why it fails: Virtual routers are Layer 3 forwarding constructs that route traffic between zones; they are not assignable objects within a zone. Interfaces, addresses, and protocols are the assignable members. It is tempting because routers sit at zone boundaries, but zone membership applies to the interfaces attached to them, not the router itself.

Management interfaces

Why it fails: Management interfaces are assigned to administrators and roles, not to Security Zones, which group traffic-bearing interfaces by trust level. It is tempting because interfaces are genuinely zone-assignable, but only those carrying data traffic, not the management plane.

Virtual Router name

Why it fails: A virtual router name identifies a routing instance, not a traffic origin, so it cannot match packets as a source. It is tempting because virtual routers are configured on the firewall and appear in policy contexts, but a virtual router would be the correct choice when scoping routing or NAT behaviour rather than identifying source traffic.

Interface speed

Why it fails: Interface speed is a Layer 1/2 characteristic, not an addressable source identity; security policy sources match zones, IP addresses, users or interfaces. It is tempting because interfaces themselves are valid sources, but speed would be the correct selection only when defining QoS or link-selection criteria, not policy matching.

GlobalProtect version

Why it fails: GlobalProtect version is configured in the GlobalProtect portal or gateway settings, not in an Antivirus Profile, so it fails. It is tempting because both live under the Device tab, but an Antivirus Profile only exposes actions, decoders and threat exceptions for scanned content.

System hostname

Why it fails: System hostname is set in Device Setup, not in an Antivirus Profile, so it fails. It is tempting because both are device-level settings reached through the Device tab, but an Antivirus Profile only contains scan actions, protocol decoders and signature exceptions for malware inspection.