Palo Alto Networks periodically releases new versions of the Prisma Access software and security features. Which of the following statements accurately describe how these updates and upgrades are communicated and managed for customers? (Select all that apply)

• A. Major feature updates and software upgrades are often performed globally in a rolling, phased manner to minimize service disruption.
• B. Customers must manually download new software versions for Prisma Access processing nodes from the support portal.
• C. Administrators can approve or defer the installation of minor software updates via the Cloud Management Console or Panorama.
• D. Customers are typically notified in advance of planned software upgrades for their Prisma Access environment.
• E. The process is designed to be non-disruptive, aiming to maintain existing user sessions and prevent outages during the upgrade.

An organization is configuring Security Policy rules on a Palo Alto Networks VM-Series firewall in a public cloud environment (e.g., AWS VPC) to segment application tiers. They have zones for 'Web-Tier', 'App-Tier', and 'DB-Tier'. They need to allow HTTP/HTTPS traffic from 'Web-Tier' to 'App-Tier' but apply deep threat inspection. They also need to allow database traffic (MS-SQL, MySQL) from 'App-Tier' to 'DB-Tier' but only for specific application servers. Which policy elements and configurations are essential for implementing these requirements? (Select all that apply)

• A. Security Policy rule: Source Zone 'App-Tier', Destination Zone 'DB-Tier', Source Address 'Specific App Server Address Group', Application 'ms-sql', 'mysql', Action 'allow', apply relevant security profiles (optional but recommended).
• B. Decryption Policy rule to decrypt HTTP/HTTPS traffic flowing from 'Web-Tier' to 'App-Tier'.
• C. User-ID configured to identify users accessing applications within the tiers.
• D. NAT policy rules configured for traffic between application tiers to translate private IP addresses.
• E. Security Policy rule: Source Zone 'Web-Tier', Destination Zone 'App-Tier', Application 'web-browsing' (or 'http', 'ssl'), Action 'allow', apply relevant Threat Prevention profile.

When a remote user's device attempts to connect to a GlobalProtect Gateway, and the GlobalProtect policy requires a Host Information Profile (HIP) check, where is the result of this HIP check (whether the device is compliant with configured HIP profiles) typically logged?

• A. Threat logs
• B. Decryption logs
• C. Traffic logs
• D. System logs
• E. HIP Match logs

An administrator is onboarding a new VM-Series firewall in a public cloud environment (e.g., AWS) and wants to manage it using Strata Cloud Manager (SCM). Unlike physical firewalls, VM-Series often leverage cloud-native capabilities for initial setup. Which method is commonly used for the initial setup and onboarding of a VM-Series firewall into SCM or Panorama in a cloud environment, facilitating Zero Touch Provisioning (ZTP)?

• A. Automatically discovering SCM via multicast on the cloud network.
• B. Connecting a serial console to the virtual machine for manual configuration.
• C. Using cloud-init or user data scripts provided during VM launch to bootstrap the firewall with initial configuration and SCM registration details.
• D. Uploading a saved configuration file from the local firewall I-Jl.
• E. Manually configuring the management interface and pointing it to SCM's IP address.

An organization has strict policies regarding employee access to certain types of websites, such as adult content, gambling, and illegal downloads. They are using Palo Alto Networks NGFWs with an Advanced URL Filtering subscription. Which configuration component on the firewall is used to define the actions (allow, block, alert, continue, override) that should be taken when a user attempts to access a URL belonging to a specific category?

• A. Threat Prevention profile
• B. Application Override policy
• C. Security Policy rule's Action tab
• D. URL Filtering profile
• E. Data Filtering profile