Basic Concept: Packet-Based Attack Protection in a Zone Protection profile handles malformed packet attacks such as non-SYN TCP floods and ICMP fragments, while flood and reconnaissance sections handle rate and scan behavior.
Why D is Correct: Packet-Based Attack Protection is correct because the examples are packet-structure
/evasion issues, not application protocol decoding or discovery scans.
Why A is Wrong: Protocol Protection is a Zone Protection category, but it protects a different attack family than the packet-level or flood/reconnaissance behavior described.
Why B is Wrong: Flood Protection is a Zone Protection category, but it protects a different attack family than the packet-level or flood/reconnaissance behavior described.
Why C is Wrong: Reconnaissance Protection is a Zone Protection category, but it protects a different attack family than the packet-level or flood/reconnaissance behavior described.

Pre-logon using machine certificates requires the GlobalProtect Gateway to authenticate endpoints based on certificate trust, which is achieved by creating a certificate profile that trusts the issuing CA and assigning it in the Gateway Agent → Client Authentication settings so the gateway can validate machine certificates during pre-logon authentication.

When implementing a new self-signed root certificate authority (CA) for SSL decryption on a Palo Alto Networks firewall, the subordinate CA certificate (which is generated by the firewall) must be imported into the trust stores of all client devices. This ensures that client devices trust the firewall as a valid certificate authority, enabling the firewall to decrypt and re-encrypt SSL traffic.
Importing the subordinate CA certificate into the client devices' trust stores is necessary for those devices to trust the new self-signed root CA and properly handle SSL decryption traffic.