Basic Concept: Custom reports query specific log databases. PAN-OS supports detailed log databases such as Traffic, Threat, Data Filtering, and User-ID for custom reporting.

Why B is Correct: Traffic, threat, data filtering, and User-ID are valid detailed log sources for custom reports from the provided choices.

Why A is Wrong: Traffic, User-ID, URL is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Why C is Wrong: GlobalProtect, traffic, application statistics is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Why D is Wrong: Threat, GlobalProtect, application statistics, WildFire submissions is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Basic Concept: GlobalProtect split tunneling can separately control network routes and DNS resolution. Split DNS decides whether queries for specific domains use VPN-assigned DNS servers or local DNS.

Why D is Correct: The Both Network Traffic and DNS option allows selected domains to resolve through corporate DNS while other domains use the endpoint's local resolver.

Why A is Wrong: It specifies when the secondary DNS server is used for resolution to allow access to specific domains that are not managed by the VPN. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why B is Wrong: It allows users to access internal resources when connected locally and external resources when connected remotely using the same FQDN. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why C is Wrong: It allows devices on a local network to access blocked websites by changing which DNS server resolves certain domain names. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Basic Concept: A Forward Trust certificate used for SSL Forward Proxy must be trusted by endpoints. Otherwise users see certificate trust warnings for decrypted sites.

Why D is Correct: Installing the public CA certificate into client trust stores is the required next step because the firewall signs substitute server certificates during forward proxy decryption.

Why A is Wrong: Set the forward trust certificate as the SSL/TLS Service profile for the management interface. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Why B is Wrong: Create a Security policy rule that allows traffic from the certificate of the firewall to all the zones. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Why C is Wrong: Import the private key of the forward trust certificate onto the domain controller. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.