Basic Concept: Authentication Portal creates User-ID mappings from a direct user authentication event on the firewall, making it more explicit than mappings inferred from server logs.
Why D is Correct: Authentication Portal is correct because the firewall itself validates the user and records the source IP mapping.
Why A is Wrong: X-Forwarded-For (XFF) headers is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why B is Wrong: Server monitoring is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why C is Wrong: GlobalProtect is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Enabling LACP in the HA passive state allows the passive firewall to negotiate and maintain the LACP session with the switch before it becomes active, so when a failover occurs the aggregate is already formed and traffic can pass with minimal convergence delay.

External zones in Palo Alto firewalls require explicitly enabling "Allow traffic from other VSYS" (or similar inter-VSYS traffic allowance) in their zone configurations to permit bidirectional flow between VSYS without physical external routing, even when VSYS visibility, policies, and inter- VR routes are already configured.
Why VSYS Visibility Alone Fails
While adding VSYS to each other's visible list enables awareness of external zones across VSYS boundaries, traffic still drops unless the external zones themselves permit inter-VSYS traversal, as zones enforce isolation by default beyond mere visibility.

Basic Concept: DDNS client functionality requires an IP-addressed routed interface. Layer 2 interfaces do not own the routed IP context needed for DDNS updates.
Why A is Correct: DDNS client is available on Layer 3 interfaces because it publishes the interface's IP mapping to DNS.
Why B is Wrong: NetFlow export is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why C is Wrong: QoS is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.
Why D is Wrong: Link monitoring is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.