In Panorama, without performing a context switch, the administrator can perform local configuration tasks directly on the connected firewall. The following operations can be done:
Modification of local security rules: Security rules can be modified directly on the connected firewall from the Panorama GUI.
Modification of a Layer 3 interface: Changes to the Layer 3 interfaces on the connected firewall can be done from Panorama, without needing to switch to the firewall's local interface.
Modification of the firewall device hostname: The firewall's hostname can be changed via Panorama.

Explicit web proxy mode requires client browsers to be manually configured to send traffic to the firewall's IP address and port, and integrating it with an Authentication policy using Kerberos enables seamless single sign-on with Active Directory credentials through native domain authentication without additional user interaction.

The Advanced Routing Engine (ARE) is supported on Palo Alto Networks firewalls that utilize the PAN-OS 11.0+ software and have the required hardware architecture. The supported models include PA-3200 Series, PA-5400 Series, PA-800 Series, and PA-400 Series. These models provide enhanced routing capabilities, including BGP, OSPF, and more complex routing policies.
PA-3260 and PA-5410 are part of the PA-3200 and PA-5400 Series, which are known to support ARE.
PA-850 and PA-460 are within the PA-800 and PA-400 Series, which also support ARE

Packet-Based Attack Protection is specifically designed to detect and mitigate abnormal or malformed packets such as non-SYN TCP packets and ICMP fragments, which are characteristic of packet-level attacks rather than floods, reconnaissance, or protocol misuse.

Basic Concept: Logical routers are available only after Advanced Routing is enabled globally. This is a general setting change on the firewall.
Why D is Correct: Checking advanced routing in General settings is the required first action before logical router objects can be configured.
Why A is Wrong: Changing the virtual router type from "default" to "advanced" is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
Why B is Wrong: Activating an advanced routing subscription is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.
Why C is Wrong: Committing a new advanced routing software module is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.