To enable access to a public-facing web server for both internal and internet clients using the FQDN public.webserver.acme.com , which resolves to the public address 99.99.99.2 , the necessary combination of NAT policies is:

C. Option C

Policy 11 : DMZ to Untrust

Source Zone: DMZ

Destination Zone: Untrust

Destination Address: Web_Server_Public_99.99.99.2

Destination Translation: address: Web_Server_Private_172.16.1.2

Policy 12 : Untrust to Untrust

Source Zone: Untrust

Destination Zone: Untrust

Destination Address: Web_Server_Public_99.99.99.2

Destination Translation: address: Web_Server_Private_172.16.1.2

These policies ensure that traffic destined for the public IP address 99.99.99.2 from both the DMZ and Untrust zones is properly translated to the internal web server's private IP address 172.16.1.2 .

References:

Palo Alto Networks - NAT Configuration: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/nat/nat-policy-rules

To capture a PCAP on your Panorama to troubleshoot DNS resolution issues, the appropriate CLI command is:

B. tcpdump snaplen 0 filter "port 53"

This command captures packets with no size limit (snaplen 0) and filters the traffic for port 53, which is used by DNS. This is the most straightforward and comprehensive way to capture all DNS traffic for analysis.

References:

Palo Alto Networks - Using tcpdump on PAN-OS: https://knowledgebase.paloaltonetworks.com

Palo Alto Networks - Troubleshooting Network Connectivity Issues: https://docs.paloaltonetworks.com

When SSL Forward Proxy decryption is enabled, and clients using Chrome need to see browser warnings for websites with invalid certificates, the following options will satisfy the requirement:

A. Create a Decryption Profile with the Block sessions with expired certificates option enabled : This option ensures that sessions with expired certificates are blocked, which will present a warning to the user.

B. Create a self-signed Forward Untrust enabled certificate : This certificate will be used for websites with invalid or untrusted certificates, prompting the browser to display a warning.

These configurations ensure that users are properly warned when accessing sites with invalid certificates, allowing them to decide whether to proceed.

References:

Palo Alto Networks - SSL Decryption Best Practices: https://docs.paloaltonetworks.com/best-practices

Palo Alto Networks - Configuring SSL Forward Proxy: https://knowledgebase.paloaltonetworks.com

Disabling App-IDs as part of a content update can be valid in the following circumstances:

B. When you want to immediately benefit from the latest threat prevention : Disabling certain App-IDs can help ensure that the latest threat prevention measures are applied without waiting for the App-IDs to be fully tested in a specific environment. This can be crucial in quickly addressing emerging threats.

D. When an organization operates a mission-critical network and has zero tolerance for downtime : In such environments, administrators might temporarily disable new or modified App-IDs to avoid potential disruptions caused by unverified or untested App-IDs. This ensures that the network remains stable and functional while the new App-IDs are evaluated in a controlled manner.

References:

Palo Alto Networks - Best Practices for Application and Threat Content Updates: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/app-id/manage-app-id/application-and-threat-content-updates

Palo Alto Networks - Application and Threat Content Release Notes: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/application-and-threat-content-release-notes

The default port used by the Terminal Services agent to communicate with a Palo Alto Networks firewall is 5007 . The Terminal Services agent (TS agent) integrates with Microsoft Terminal Services to associate user information with sessions, enabling User-ID to accurately map user identities to security policies. Reference: Palo Alto Networks Terminal Services Agent Documentation.

To delete all of the unused address objects on the firewall, the best method is:

B. Using CLI execute request configuration address-objects remove-unused-objects

This CLI command is designed to identify and remove all unused address objects in the firewall's configuration. It is the most efficient and accurate method for cleaning up unused objects without manually checking each one.

References:

Palo Alto Networks - PAN-OS CLI Quick Start: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-cli-quick-start

Palo Alto Networks - Removing Unused Address Objects: https://knowledgebase.paloaltonetworks.com