Using Panorama as a centralized management platform, an administrator can create a single custom Data Filtering profile, which is Palo Alto Networks' implementation of Data Loss Prevention (DLP). This profile is created once within Panorama's object configuration. It can then be applied consistently across security policies for both on-premises Next-Generation Firewalls (NGFWs) and the cloud-delivered Prisma Access service. This "define once, deploy everywhere" architecture simplifies administration and ensures uniform data protection policies across the entire hybrid enterprise network.

B. Two: This is incorrect because Panorama's function is to eliminate the need for separate configurations for each platform, providing a single point of management.

C. Three: This is incorrect as there is no standard architecture within the Palo Alto Networks ecosystem that would require creating the same custom profile in three separate locations.

D. Four: This is incorrect for the same reason as C; it implies a fragmented management model that is the opposite of what Panorama provides.

1. Palo Alto Networks. (2023). Prisma Access Administrator’s Guide. "Get Started with Data Loss Prevention". The documentation states: "If you use Panorama to manage both Prisma Access and your on-premise firewalls, you can create custom data patterns and data filtering profiles on Panorama and push them to both Prisma Access and your firewalls."

2. Palo Alto Networks. (2023). Panorama™ Administrator's Guide 10.2. "Manage Configuration for Prisma Access". This guide details how Panorama uses shared objects, templates, and device groups to apply consistent configurations, including security profiles like Data Filtering (DLP), to both NGFWs and Prisma Access from a single management interface.

3. Palo Alto Networks. (2023). Panorama™ Administrator's Guide 10.2. "Objects > Security Profiles > Data Filtering". This section describes the creation of Data Filtering profiles as shared objects within Panorama, which can then be referenced by policies targeting any managed device, including Prisma Access.