The export named configuration snapshot operation is the most operationally efficient method to achieve the stated goal. This function, located under Device > Setup > Operations, allows the administrator to select a specific configuration version, including the live running-config.xml, and download it directly to an external location (the administrator's computer). This single action precisely fulfills the requirement of backing up only the running configuration externally before a maintenance window.

A. save named configuration snapshot: This action saves a copy of the running configuration as a snapshot file on the firewall's local disk, not to an external location.

B. export device state: This exports a comprehensive bundle that includes logs, licenses, and other system information, not only the running configuration as specified in the question.

D. save candidate config: This saves the candidate configuration (changes that have not been committed), not the active running configuration, and it saves the file locally on the firewall.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Manage Configuration Backups".

Section: Device > Setup > Operations

Content: The guide details the functions available under this menu. It specifies that Export Named Configuration Snapshot is used to "Export a configuration snapshot from the firewall to your local computer." It also clarifies that the running-config.xml is an available snapshot to export. This directly supports option C. The guide also confirms that Save Named Configuration Snapshot and Save Candidate Config save files locally on the firewall

and Export device state includes more than just the configuration file.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"Revert to a Previous Configuration Version".

Section: Save and Export Configuration Snapshots

Content: "To save a configuration snapshot to a location outside of the firewall

you must export it... Select Device > Setup > Operations and

in the Configuration Management section

click Export Named Configuration Snapshot." This explicitly states that exporting is the method for saving a configuration to an external location.

To create a security zone in PAN-OS, you must first navigate to the Network tab (Step 1) and select Zones from the left-hand navigation pane (Step 2). Clicking Add (Step 3) opens the Zone configuration dialog. Inside this dialog, the standard workflow matches the UI layout: you must first Specify Zone Name (Step 4), as it is the top-most field. Next, you Specify Zone Type (Step 5) (e.g., Layer 3, Layer 2, Tap) using the dropdown menu located below the name field. Finally, you Assign interfaces as needed (Step 6) in the "Interfaces" section at the bottom of the dialog to map physical or virtual interfaces to the new zone.

Palo Alto Networks. "Network > Zones." PAN-OS Web Interface Help. Accessed January 16, 2026.

Confirms the navigation path and the fields available (Name, Type, Interfaces) within the Zone dialog.

Palo Alto Networks. "Configure Interfaces and Zones." PAN-OS Administrator's Guide. Accessed January 16, 2026.

Section: "Configure the external interface... On the Config tab, select New Zone... In the Zone dialog, define a Name... Interface Type..."

Palo Alto Networks. "Security Zone Overview." PAN-OS Web Interface Help. Accessed January 16, 2026.

Details the purpose and configuration components of security zones.

The Palo Alto Networks firewall includes two predefined, default Security policy rules that are evaluated after all custom rules. The intrazone-default rule governs traffic that originates from and is destined for the same security zone. By default, the firewall trusts traffic within a zone, so the action for this rule is set to Allow. To prevent excessive log generation for this broadly permitted traffic, logging for this default rule is disabled by default. These settings ensure basic connectivity within a zone without overwhelming the log management system.

C. Log at Session End: This is a specific logging action that can be configured, but the default behavior for the intrazone-default rule is to have logging completely disabled.

D. Deny: This is the default action for the interzone-default policy, which applies to traffic moving between different security zones, not within the same zone.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: In the section "Objects > Security Policy > Default Security Policy Rules

" the documentation states: "The two predefined rules are: intrazone-default—Allows all traffic between interfaces in the same zone... By default

logging is not enabled for the default rules." This directly confirms that the default action is "Allow" and logging is disabled.

2. Palo Alto Networks

"PCNSA Study Guide

Version 11.0" (Official Publication): Chapter 4

"Securing Traffic with Security Policies

" under the "Default Security Policy Rules" subsection

explains: "The intrazone-default rule allows traffic to flow between interfaces in the same security zone... By default

neither of the default rules generates log entries." This corroborates the "Allow" action and disabled logging for the intrazone rule.

When configuring a Destination NAT (DNAT) policy in PAN-OS with multiple translated IP addresses, the firewall requires a method to distribute incoming sessions across the address pool. "IP Modulo" is a session distribution method available in the "Translated Packet" tab. This algorithm uses the source IP address and the modulo operator to deterministically assign a session to a specific translated IP address. This ensures session persistence, meaning subsequent sessions from the same source IP will be directed to the same translated IP, which is crucial for stateful applications.

A. Destination IP Hash: The available option is "Source IP Hash," which uses the source IP, not the destination IP, for the hash calculation.

B. Concurrent Sessions: This is a metric used for monitoring session load, not a method for distributing new sessions across a NAT pool.

C. Max Sessions: This is a configurable limit to control the maximum number of sessions allowed, not a distribution algorithm.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section describing NAT policy configuration

the "Translated Packet" tab options for Destination Address Translation are detailed. When using a pool of addresses

the "Distribution" field appears

which includes "IP Modulo" as a method to provide session persistence.

Reference: PAN-OS Administrator's Guide 10.2 > Policies > NAT > NAT Policy Rules > NAT Policy Rule Translation Tab. The guide states

"IP Modulo—The firewall uses the source IP address in the packet header as the key to select the translated destination IP address from the NAT pool. This ensures that sessions from the same source are always translated to the same destination address."

2. Palo Alto Networks Documentation Portal: The technical documentation for NAT Policy Rules explicitly lists the available session distribution methods.

Reference: Palo Alto Networks Docs > PAN-OS & Panorama > 10.2 > PAN-OS Administrator's Guide > NAT Policy Rule Translation Tab. This document lists the following distribution methods: Round-Robin

Source IP Hash

IP Modulo

Least Sessions

and Weighted Round-Robin. This confirms "IP Modulo" is a valid option and the others listed in the question are not.

The PAN-OS web interface provides a direct and non-disruptive method for resetting the hit count of a specific security policy rule. An administrator can navigate to the Security policy rulebase, select the desired rule(s), and then use the "Hit Count" menu at the bottom of the page to select the "Reset" option. This action clears the counter for the selected rules without impacting their enforcement or causing any traffic disruption, making it the standard operational procedure for this task.

A. First disable and then re-enable the rule.

This is not the designated procedure. Disabling a rule removes it from the active policy, which can create a temporary security gap, and is not the intended method for resetting a counter.

B. Reboot the data-plane.

Rebooting the data plane is a highly disruptive action that causes a network outage. While it would reset all hit counters, it is not a targeted or appropriate method for a single rule.

D. Type the CLI command reset hitcount .

This command syntax is incorrect. The correct operational command in the CLI to clear a security rule's hit count is clear rule-hit-count security rule , not reset hitcount.

---

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: In the section on managing security policies

the procedure for monitoring rule usage is detailed. It explicitly states the GUI method for resetting counters.

Reference: Chapter: Policies > Security

Section: "Monitor Policy Rule Usage".

Quote/Content: "To reset the hit count for one or more rules

select the rules and then select Hit Count > Reset." This directly validates option C as the correct procedure.

2. Palo Alto Networks PAN-OS® CLI Quick Start 11.0: This guide details the available operational commands. The command for clearing rule hit counts is specified

showing the syntax in the question is incorrect.

Reference: Section: Operational Mode Commands.

Content: The guide lists the command clear rule-hit-count with its various parameters (e.g.

security

nat). This confirms that the command reset hitcount as stated in option D does not exist.

Palo Alto Networks firewalls provide two primary mechanisms for configuring SYN flood protection thresholds. A Zone Protection profile is applied to an entire ingress zone to protect it from various flood attacks, including SYN floods. It uses thresholds (Alarm, Activate, Maximum) based on connections per second (CPS) to trigger mitigation actions.

For more granular protection of specific, critical resources (like a web server), a DoS Protection profile is used. This profile, applied via a DoS Protection policy rule, also contains configurable SYN flood thresholds to protect specific destination IP addresses or subnets from being overwhelmed. Both profiles are where the actual rate-limiting thresholds are defined.

A. QoS profile: This is incorrect. Quality of Service (QoS) profiles are used for bandwidth management and traffic prioritization, not for configuring security thresholds for DoS attacks.

D. DoS Protection policy: This is incorrect. The DoS Protection policy is a rule that applies a DoS Protection profile to specific traffic; the thresholds themselves are configured within the profile, not the policy.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Zone Protection and DoS Protection

" Section: "Configure Flood Protection." This section details the configuration of SYN flood protection within a Zone Protection Profile

stating

"For SYN

UDP

ICMP

ICMPv6

and Other IP floods

you can set thresholds for the rate of new sessions from a source or to a destination." It shows the fields for Alarm Rate

Activate Rate

and Maximum Rate.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policies

" Chapter: "DoS Protection

" Section: "DoS Protection Profiles and Policy Rules." This document explains

"A DoS Protection profile is a set of options that protects a group of targeted devices... from session-based DoS attacks." It further details configuring the profile: "For SYN Flood

select the Flood Protection tab... and specify the Alarm Rate

Activate Rate

and Maximum Rate..."

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Policies

" Chapter: "DoS Protection

" Section: "DoS Protection Profiles and Policy Rules." This source clarifies the relationship between the policy and profile: "A DoS Protection policy rule specifies the traffic that the DoS Protection profile protects... The policy rule does not define what to protect against; the profile does." This confirms that the thresholds are in the profile (B)

not the policy (D).

In the Palo Alto Networks firewall packet processing logic, traffic is first evaluated against the Security Policy rulebase. A session is created and matched against rules based on its attributes (e.g., zones, addresses, application, user). If the traffic matches a Security Policy rule with an "allow" action, the firewall then applies the Security Profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, etc.) that are attached to that specific rule. These profiles inspect the content of the now-allowed traffic for threats. If a threat is found, the Security Profile can then block the traffic. This sequence ensures that resource-intensive content inspection is only performed on traffic that has been explicitly permitted by policy.

A. Security Profiles are a data plane function used to inspect transit traffic. The management plane is for device administration and is not the primary domain for Security Profile inspection.

C. This reverses the operational order. A Security Policy rule must first match and allow the traffic before any Security Profiles are applied for content inspection.

D. Security Profiles are not applied to traffic matched by a rule with a "block" or "deny" action. Such traffic is dropped immediately, and no further inspection occurs.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section detailing the packet flow

the sequence clearly shows that after a session is matched to a Security Policy rule with an allow action

it then proceeds to content inspection where Security Profiles are applied.

Reference: "PAN-OS Architecture and Packet Flow" -> "Packet Flow Sequence in PAN-OS". The flow diagram and accompanying text indicate that "Security Policy" evaluation precedes "Content Inspection (Security Profiles)". Specifically

if the security policy action is allow

the firewall applies the security profiles. If the action is deny

the packet is discarded.

2. Palo Alto Networks Documentation

"Security Policy": The documentation on creating and managing Security Policy rules explicitly states that profiles are attached to rules to scan allowed applications for threats.

Reference: "Objects > Security Profiles". The overview states

"To protect your network from threats

you attach Security profiles to Security policy rules that allow traffic." This confirms that the prerequisite for profile application is a rule that allows traffic.

3. Palo Alto Networks Beacon

"The Life of a Packet": This official training resource details the packet flow. It describes the "slowpath" process where

after a session is created and the policy lookup results in a match to an allow rule

the packet is forwarded to Content-ID (which includes Security Profiles) for threat scanning.

Reference: Beacon Training

"The Life of a Packet in PAN-OS" module. Step 6 (Policy evaluation) must result in an "allow" for the packet to proceed to Step 7 (Content Inspection/Threat Prevention).

A Palo Alto Networks NAT policy rule logically identifies traffic based on its original packet characteristics. The absolute minimum requirements for matching traffic, as stated in official documentation, are the source and destination zones. To create a specific, functional rule (rather than one matching all traffic between zones), at least one address parameter is necessary. The destination address is a fundamental matching criterion, especially for Destination NAT (DNAT), where traffic to a specific public IP is translated. Therefore, the source zone, destination zone, and destination address represent the core information required to define the traffic flow that the NAT rule will act upon.

A. name: While the configuration utility requires a name for any rule, it is administrative metadata, not a logical criterion for matching network traffic.

C. destination interface: This is an optional field. The firewall determines the egress interface through a route lookup based on the destination zone and address.

1. Palo Alto Networks PAN-OS® 10.2 Administrator’s Guide. In the section on NAT configuration

the guide outlines the necessary information.

Section: NAT > NAT Policy > NAT Policy Rules.

Content: "The Original Packet section of a NAT policy rule defines the match criteria for traffic that will be subject to NAT. At a minimum

you must specify the source and destination zones of the traffic." This directly supports the requirement for Source Zone (B) and Destination Zone (E).

2. Palo Alto Networks PAN-OS® 10.2 Administrator’s Guide. The guide further details the information needed to create a meaningful rule.

Section: NAT > Configure NAT.

Content: The workflow prerequisites state an administrator must have: "The source zones and destination zones for the traffic you want to apply NAT to. The source addresses and destination addresses of the traffic you want to apply NAT to." This supports the inclusion of Destination Address (D) as a fundamental piece of required information for defining the rule's logic.

The Palo Alto Networks Single-Pass Parallel Processing (SP3) architecture is designed to perform security functions once per packet, minimizing latency. This architecture integrates multiple key technologies into a single, streamlined process. Two fundamental components of this architecture are App-ID, which identifies applications regardless of port or protocol, and User-ID, which maps IP addresses to specific users for policy enforcement. Both identification processes occur within the single pass, allowing the firewall to apply consistent, context-aware policies efficiently without the performance degradation associated with separate processing engines.

A. Layer-ID: "Layer-ID" is not a recognized term for a specific technology or component within the Palo Alto Networks SP3 architecture.

C. QoS-ID: While Quality of Service (QoS) is a feature, "QoS-ID" is not a standard component name within the SP3 architecture's core identification engines like App-ID or User-ID.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide Version 10.2.

Location: Chapter: Get Started > Fundamental Concepts of the Firewall > Single-Pass Architecture.

Quote: "The single-pass software architecture processes traffic by using the following technologies: App-ID

User-ID

Content-ID

and networking functions such as routing

NAT

and QoS. The single-pass architecture simplifies management

reduces latency

and increases throughput." This directly confirms that App-ID and User-ID are core technologies utilized in the architecture.

2. Palo Alto Networks. (2023). PA-400 Series Datasheet.

Location: Page 2

Section: "Key Security and Connectivity Features".

Content: The datasheet describes the core technologies that power the firewall. It lists "App-ID" for identifying all applications on all ports and "User-ID" for identifying users through integration with directory services. These are presented as foundational elements of the platform's single-pass processing capability.

3. Palo Alto Networks. (n.d.). What is a Next-Generation Firewall (NGFW)?

Location: Technology Section

"Single-Pass Architecture".

Content: This official web resource explains that the single-pass design "integrates multiple threat prevention disciplines (firewall

IPS

antivirus

URL filtering

etc.) into a single stream-based scan engine." It highlights App-ID and User-ID as the context-setting technologies that enable this integrated approach.

The Palo Alto Networks firewall (PAN-OS) processes URL filtering matches in a specific order of precedence, where the first match wins. The system first checks the URL Filtering Profile overrides, starting with the Block List (explicitly denied URLs) and then the Allow Lists (explicitly permitted URLs). If no match is found in the overrides, the system proceeds to categorization. It checks Custom URL Categories first to enforce user-defined patterns, followed by External Dynamic Lists (EDL). Finally, if the URL is not found in the custom or dynamic lists, the firewall queries the PAN-DB database. To minimize latency, it first checks the local data plane cache (Downloaded PAN-DB File) before querying the PAN-DB Cloud service.

Palo Alto Networks Knowledge Base, "How to Create Custom URL Categories," Section: Overview.

Quote: "The Palo Alto Networks firewall will process the filter as follows: Block list, Allow list, Custom category, Pre-defined category."

URL: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH5CAK

Palo Alto Networks Live Community (Knowledge Base), "Understanding URL Filtering Order / URL Filtering Precedence," Section: URL Filtering Order.

Quote: "Precedence is from the top down - First Match Wins: 1. Block list... 2. Allow list... 3. Custom Categories... 4. Cached (EDL)... 5. Pre-Defined Categories."

URL: https://live.paloaltonetworks.com/t5/general-topics/understanding-url-filtering-order-url-filtering-precedence/td-p/238682

Palo Alto Networks Tech Docs, "How Advanced URL Filtering Works," Section: URL Categorization.

Quote: "The firewall determines a website's URL category by comparing it to entries in 1) custom URL categories, 2) external dynamic lists (EDLs), and 3) predefined URL categories, in order of precedence."

URL: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/how-url-filtering-works

Palo Alto Networks Tech Docs, "URL Filtering Log Fields," Section: Threat/Content Name.

Context: Describes the distinction between local cache lookups and cloud lookups (PAN-DB Cloud) for performance.

URL: https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/url-filtering-log-fields