Explanation: The two attributes that a forward trust certificate should have for SSL Forward Proxy decryption are:
B: A private key: This is the key that the firewall uses to sign the certificates that it generates for the decrypted sessions. The private key must be securely stored on the firewall and not shared with anyone1.
D: A certificate authority (CA) certificate: This is the certificate that the firewall uses to issue the certificates for the decrypted sessions. The CA certificate must be trusted by the client browsers and devices that receive the certificates from the firewall1.

Explanation: To enable XML API access to a firewall for automation from a network segment routed through a Layer 3 sub-interface, the most straightforward approach is to use an Interface Management profile.
C. This can be achieved by:
Configuring an Interface Management profile and enabling HTTPS access on it.
This profile defines management services that are permitted on the interface, including HTTPS, which is required for XML API access.
Applying this Interface Management profile to the desired Layer 3 sub-interface.
This action enables HTTPS access (and thus XML API access) on the subinterface, allowing devices on the connected network segment to communicate with the firewall for automation purposes.
This solution allows for the secure extension of management capabilities to network segments without direct access to the dedicated management interface, facilitating automation and operational efficiency without necessitating changes to existing access configurations.

Explanation: To enable the firewall team to view and select from a list of usernames and user groups directly within Panorama policies for new security rule creation, User-ID group mapping should be configured in Panorama under User Identification. This feature allows Panorama to collect user and group information from various sources (like Active Directory) and use this information to create policies. By setting up User-ID group mapping, administrators can leverage user identity as criteria in security rules, enabling more granular access control and policy enforcement based on user or group membership, thereby enhancing the overall security posture.

Explanation: The type of policy in Palo Alto Networks firewalls that can use Device-ID as a match condition is QoS. This is because Device-ID is a feature that allows the firewall to identify and classify devices on the network based on their characteristics, such as vendor, model, OS, and role1. QoS policies are used to allocate bandwidth and prioritize traffic based on various criteria, such as application, user, source, destination, and device2. By using Device-ID as a match condition in QoS policies, the firewall can apply different QoS actions to different types of devices, such as IoT devices, laptops, smartphones, etc3. This can help optimize the network performance and ensure the quality of service for critical applications and devices.

Explanation: The Test Policy Match tool in Palo Alto Networks' management systems (such as Panorama or the firewall interface) allows administrators to simulate traffic against configured security policies. This tool is critical for ensuring that the correct policies are applied to specific traffic patterns and that no unintended access is granted.
Test Policy Match enables you to input parameters like source IP, destination IP, application, user, and more, and the system will determine which policy would apply.
It is especially useful for verifying the device-group hierarchy in multi-tenant or Panorama-managed environments, ensuring that inherited or overridden rules are correctly applied.
The tool also helps to proactively check that traffic will be blocked or allowed as intended, reducing misconfigurations and preventing unwanted traffic.
A. Preview Changes: This feature is used to review configuration changes before committing them but does not simulate or validate policy matches.
B. Managed Devices Health: This option is related to checking the health and connectivity status of managed devices, not policies.
D. Policy Optimizer: This tool is used to refine existing security policies by identifying overly permissive rules or unused objects, not for testing specific traffic matches.
Key Points: Why not the other options? The Test Policy Match tool is the most appropriate choice for the scenario described.

Explanation:
To apply tags automatically based on User-ID logs, the engineer must configure a Log Forwarding profile that specifies the criteria for matching the logs and the tags to apply. The Log Forwarding profile can be attached to a security policy rule or a decryption policy rule to enable auto-tagging for the traffic that matches the rule. The tags can then be used for dynamic address groups, policy enforcement, or reporting1.
References:
Use Auto-Tagging to Automate Security Actions, PCNSE Study Guide (page 49)

Explanation: To determine which sources an engineer can use to gather information about application patterns for creating custom signatures, let’s analyze each option based on PAN-OS 11.0 documentation and typical network troubleshooting practices.

A. Traffic Logs
Why It’s Correct:
How to Use:
Documentation Reference:

B. Data Filtering Logs
Why It’s Incorrect:
Documentation Reference:

C. Policy Optimizer
Why It’s Incorrect:
Documentation Reference:

D. Wireshark
Why It’s Correct:
How to Use:
Documentation Reference:

Summary of Correct Choices
Traffic Logs:
Wireshark: