This approach meets all the requirements for securing east-west traffic within each Kubernetes cluster, maintaining consistent security policies across on-premises and cloud environments, and allowing for dynamic scaling of the CN-Series NGFWs as containerized workloads spin up or down. By using Kubernetes- native deployment tools (such as Helm), the CN-Series NGFWs can be deployed and scaled dynamically within each cluster. Local insertion into the service mesh or CNI ensures that the NGFW can inspect traffic at the appropriate points within the cluster.
Centralized management via Panorama ensures that security policies are uniform across both on-premises and cloud environments, providing visibility and control across all clusters.

A link group for HA link monitoring is built from data-plane interfaces that represent forwarding links, which includes Layer 3, Layer 2, and virtual wire interfaces, while TAP interfaces are excluded because they are receive-only and do not provide a meaningful link state for upstream connectivity monitoring.

Basic Concept: Terraform is a declarative Infrastructure as Code tool used to provision infrastructure consistently. In Palo Alto Networks deployments, it is commonly used to build cloud network components and instantiate VM-Series or Cloud NGFW resources.
Why C is Correct: Terraform is correct because it defines infrastructure state in code and automates repeatable NGFW deployment instead of manually building each firewall and network dependency.
Why A is Wrong: Logging services collect or forward telemetry after deployment. Terraform does not store performance logs; it provisions infrastructure resources.
Why B is Wrong: Real-time traffic inspection is performed by the NGFW data plane, not by Terraform.
Terraform only builds or changes infrastructure state.
Why D is Wrong: Threat intelligence synchronization is handled by Palo Alto Networks content services and firewall subscriptions, not Terraform.

Packet-Based Attack Protection is specifically designed to detect and mitigate abnormal or malformed packets such as non-SYN TCP packets and ICMP fragments, which are characteristic of packet-level attacks rather than floods, reconnaissance, or protocol misuse.