D. Upload the image to Panorama > Device Deployment > Software menu, and deploy it to the firewalls.

Explanation:
In an air-gapped environment where Panorama and firewalls lack internet access, the correct procedure is to:

1.Manually download the PAN-OS image from the Palo Alto Networks Customer Support Portal.
2.Upload the image to Panorama via Device Deployment > Software.
3.Deploy the image to the managed firewalls from this menu.
This path is specifically designed for offline software upgrades and allows Panorama to push the PAN-OS image to firewalls without needing internet connectivity.

❌ Why other options are incorrect:
A. Panorama > Software menu:
This menu is used to upgrade Panorama itself—not to deploy images to firewalls.
B. Device Deployment > Dynamic Updates:
This is for deploying content updates (App-ID, Threats, Antivirus)—not PAN-OS software.
C. Dynamic Updates menu:
Again, this handles content updates, not software upgrades.

🔗 Valid references:
Upgrade Panorama Without an Internet Connection
Offline Content and Software Installation Guide

A. Management plane CPU

Explanation:
In a Palo Alto Networks firewall, different planes handle different responsibilities:

Dataplane (DP):
Handles traffic processing (App-ID, Content-ID, session handling, encryption, etc.).
Uses dedicated CPUs (network processors, security processors).
Optimized for packet flow, not log forwarding.

Management plane (MP):
Handles management tasks like GUI/CLI, configuration commits, and log processing & log forwarding.
Whenever logs need to be sent to Panorama, SIEM, or external log collectors, this is done by the management plane CPU.

Packet buffers:
Buffers used in the dataplane for temporary packet storage.
If overutilized, you see packet drops — but unrelated to log forwarding.

On-chip packet descriptors:
Hardware structures in the dataplane to describe packets in processing pipelines.
Again, related to traffic handling, not log forwarding.
👉 Therefore, the correct component responsible for log forwarding is the Management Plane CPU.
If the firewall is forwarding a large volume of logs to Panorama, you should monitor MP CPU utilization for early signs of overloading.

Reference:
Palo Alto Networks TechDocs: Firewall Architecture Overview
PAN KB: Which plane processes what?

D. show session all filter nat source

Explanation:

Why This Command?
The show session all filter nat source command displays all sessions where source NAT is applied.
It filters sessions specifically for source NAT translations, which is what the administrator needs.

Breakdown of the Command:
show session all → Displays all active sessions.
filter nat source → Filters to show only sessions with source NAT.

Why Not the Other Options?
A. show session all filter nat-rule-source → Incorrect syntax (no such filter exists).
B. show running nat-rule-ippool rule "rule_name" → Shows NAT pool configuration, not active NAT sessions.
C. show running nat-policy → Displays configured NAT policies, not live NAT sessions.

Additional Useful NAT Commands:
show session all filter nat → Shows all NAT sessions (source & destination).
show running nat-policy → Lists configured NAT rules.
show session id → Inspects a specific NAT session.

Reference:
Palo Alto Networks CLI Reference Guide (under Session Monitoring & NAT Commands).

A. With the relevant configuration log filter inside Device > Log Settings

Explanation:
To generate email alerts when decryption rules are changed, you need to monitor configuration logs, because changes to security policies—including decryption rules—are recorded as configuration events.

The correct place to configure this is:
Device > Log Settings
Under Configuration Logs, apply a filter that matches changes to decryption rules.
Set up email forwarding for those filtered logs.
This ensures that any modification, disabling, or deletion of decryption rules triggers an email alert to the security team.

❌ Why Other Options Are Incorrect:
B. System log filter inside Objects > Log Forwarding System logs capture operational events, not configuration changes.
C. System log filter inside Device > Log Settings Again, system logs don’t track policy changes.
D. Configuration log filter inside Objects > Log Forwarding You must configure log forwarding for configuration logs under Device > Log Settings, not under Objects.

🔗 Authoritative Reference:
PUPUWEB: Configuring Email Alerts for Decryption Rule Changes

D. DoS Protection

Explanation:
There are several protection mechanisms in PAN-OS:

1.Zone Protection Profile
Applied per zone (ingress).
Provides broad flood protection (SYN floods, ICMP floods, UDP floods, reconnaissance protection, etc.).
It’s not granular to specific hosts — it protects the entire zone.
❌ Not the right answer here, because the question asks about specific critical systems.
DoS Protection Profile ✅
Applied per policy rule, which can match specific IPs, subnets, or services.
Provides granular flood protection for critical resources.
Can protect specific servers/endpoints against SYN/ICMP/UDP floods.
Exactly matches the requirement in the question: “granular defense against targeted flood attacks for specific critical systems accessed from the internet.”
3.Packet Buffer Protection
Protects the firewall itself from resource exhaustion (buffer overflows in the dataplane).
It is not about defending endpoints or servers.
4.Vulnerability Protection
Provides defense against exploits (e.g., buffer overflow attempts, protocol anomalies, exploit kits).
Works at the application/content layer.
Not for flood protection.

Why D is Correct:
The engineer wants to protect specific critical endpoints against flood attacks → That’s exactly what DoS Protection Profiles are for.

Reference:
Palo Alto Networks TechDocs: DoS Protection Profiles
Palo Alto Networks: Difference between Zone Protection and DoS Protection

C. Change the "GlobalProtect Gateway -> Agent -> Client Settings -> Split Tunnel -> No direct access to local network" setting to "off"

Explanation:
When GlobalProtect clients connect, they may lose access to local resources (like printers, file shares, or internal LAN services). This typically happens if the setting “No direct access to local network” is enabled under the GlobalProtect Gateway → Agent → Client Settings → Split Tunnel configuration.
This setting, when ON, blocks access to the local LAN and forces all traffic through the VPN tunnel (full tunnel mode). To allow users to reach both corporate and local resources, this must be turned OFF.

❌ Why the other options are incorrect:
A. GlobalProtect Gateway → Agent → Network Services...
This path doesn’t exist for controlling split tunneling. The relevant setting is under Client Settings, not Network Services.
B. GlobalProtect Portal → Satellite → Gateways...
Satellite configurations are for site-to-site VPN using GlobalProtect Satellite (branch offices), not end-user remote access clients. Not relevant here.
D. GlobalProtect Portal → Agent → App → Split Tunnel...
The Portal provides configuration to clients, but the actual split tunnel behavior is enforced at the Gateway (Agent → Client Settings). The Portal option here doesn’t control the “No direct access to local network” feature.

📖 Reference:
Palo Alto Networks Docs – GlobalProtect Agent Settings :
“The option No direct access to local network is available in the GlobalProtect Gateway → Agent → Client Settings → Split Tunnel tab. Enable this option to block users from accessing local LAN resources. Disable it to allow access.”

A. Enable NAT Traversal on Site B firewall
D. Match IKE version on both firewalls.

Explanation:
When configuring a VPN tunnel with a dynamic peer, specific settings must be matched on both sides of the connection to ensure successful negotiation.

A. Enable NAT Traversal on Site B firewall: NAT traversal (NAT-T) is essential when one or both endpoints have a dynamic public IP address and might be behind a NAT device. The Site A firewall uses a DHCP-assigned address, which means its address can change. If the Site B firewall is behind a NAT device or if the connection passes through one, enabling NAT-T ensures that the VPN packets can correctly traverse the NAT boundary. Without this, the connection will likely fail.
D. Match IKE version on both firewalls: The IKE Gateway configuration for Site A shows IKEv1 only mode. For a successful tunnel, the remote peer (Site B) must also be configured to use IKEv1. If Site B is set to IKEv2 or a different mode, the IKE negotiation will fail. Matching the IKE version is a fundamental requirement for any IPSec tunnel setup.

Why the Other Options Are Incorrect
B. Configure Local Identification on Site A firewall:
The provided image of the Site A configuration already shows that the Local Identification is configured as FQDN (email address) with the value user@acme.com. No change is needed for this setting.
C. Disable passive mode on Site A firewall:
The "Passive Mode" option on the Site A configuration is currently disabled (unchecked). Passive mode would cause the firewall to only listen for incoming connections and not initiate the connection itself. Since Site A has a dynamic IP address, it must be the initiator of the tunnel, so disabling passive mode is the correct setting. Therefore, this option does not require a change.