A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit.
Which two Security policy requirements must be included in the implementation plan? (Choose two answers)

• A. A pair of policies is required to control the flow of data traffic into and out of the security zone assigned to the tunnel interface.
• B. A policy must explicitly permit only the IKE application between the external-facing zone and local zone.
• C. The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer.
• D. A policy must explicitly permit the IPSec container application between the external-facing zone and local zone.

An administrator is configuring firewalls via a Panorama template to forward logs to a newly provisioned Strata Logging Service instance. The operational requirement is to maintain existing logging to on-premises Panorama log collectors for immediate, low-latency queries while also forwarding logs to Strata Logging Service for long-term archival. The administrator has already configured and enabled cloud logging connectivity.
Which additional step is necessary to meet the operational requirement?

• A. Enable log syncing and commit the template changes to both the on-premises and cloud collectors.
• B. Enable duplicate logging (cloud and on-premises) under Device - > Setup - > Management in the appropriate templates.
• C. In the collector group settings, add the Strata Logging Service as a secondary destination for the on- premises collector.
• D. Add the Panorama log collector and Strata Logging Service IP addresses to the cloud logging service routes to ensure dual-path cloud and on-premises reachability.

Which two services are configured by applying an SSL/TLS service profile? (Choose two.)

• A. Forward-Trust certificate
• B. Syslog server monitoring
• C. Log forwarding to Strata Logging Service
• D. Global Protect portal

An enterprise uses GlobalProtect with both user- and machine-based certificate authentication and requires pre-logon, OCSP checks, and minimal user disruption. They manage multiple firewalls via Panorama and deploy domain-issued machine certificates via Group Policy.
Which approach ensures continuous, secure connectivity and consistent policy enforcement?

• A. Configure a single certificate profile for both user and machine certificates. Rely solely on CRLs for revocation to minimize complexity.
• B. Deploy self-signed certificates on each firewall, allow IP-based authentication to override certificate checks, and use default GlobalProtect settings for user / machine identification.
• C. Distribute root and intermediate CAs via Panorama template, use distinct certificate profiles for user versus machine certs, reference an internal OCSP responder, and automate certificate deployment with Group Policy.
• D. Use a wildcard certificate from a public CA, disable all revocation checks to reduce latency, and manage certificate renewals manually on each firewall.

Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?

• A. Local firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.
• B. Panorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.
• C. When a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.
• D. The order of policy evaluation can be configured differently in different device groups.