On a Palo Alto Networks firewall, LACP pre-negotiation means the interface actively sends LACP packets to negotiate the aggregate link instead of waiting for the peer.
LACP mode = Active → The device initiates LACP negotiations by sending LACP PDUs.
LACP mode = Passive → The device waits for the peer to initiate, so no pre-negotiation occurs.

To meet the requirement of data isolation for different regional business units while minimizing administrative overhead, the best approach is to establish separate Cloud Identity Engine (CIE) tenants for each business unit. Each tenant would be integrated with the relevant identity sources (such as on-premises AD, Azure AD, and Okta) for that specific region. This ensures that the identity data for each region is kept isolated and only relevant user and group data is distributed to the respective regional firewalls.
By maintaining a strict one-to-one mapping between CIE tenants and business units, the organization ensures that each region's firewall only receives the user and group data relevant to that region, thus meeting data sovereignty requirements and minimizing administrative complexity.

In Palo Alto Networks PAN-OS, the management interface (MGT) is distinct from the data plane interfaces.
Configuration of the management interface is handled under the deviceconfig system hierarchy within the Command Line Interface (CLI). By default, many Palo Alto Networks hardware appliances are set to a static IP address (typically 192.168.1.1), but in dynamic environments or cloud deployments, shifting to DHCP is often necessary for initial onboarding.
The correct command to enable this is set deviceconfig system type dhcp-client. When this command is executed in configuration mode, the firewall changes its management interface behavior from a static assignment to a DHCP client. Once the change is committed, the firewall will send a DHCP Discover packet out of the MGT port to obtain an IP address, subnet mask, and default gateway from a local DHCP server.
It is important to differentiate between deviceconfig (which handles system-level and management plane settings) and network (which handles data plane interfaces like Ethernet1/1). Options C and D are syntactically incorrect for PAN-OS, while Option B does not follow the standard hierarchy for system configuration. For engineers troubleshooting connectivity, verifying this setting via the command show deviceconfig system is a standard step to ensure the management plane is communicating correctly with the network infrastructure.

The maximum number of Log Collectors that can be added to a Log Collector Group is 18 plus 2 hot spares, ensuring redundancy and availability in case of failure. This allows for a total of up to
20 Log Collectors in a group, providing sufficient scalability and reliability for log collection.

Basic Concept: Cloud NGFW design depends on matching the managed firewall insertion model to the cloud network topology. Palo Alto Networks Cloud NGFW can be centrally inserted behind AWS Transit Gateway or deployed into Azure VNet/vWAN designs while Panorama maintains shared policy control.
Why B and D are Correct: The selected implementations preserve the existing hub-style designs, use managed Cloud NGFW rather than self-managed VM-Series compute where possible, and keep Security policy unified through Panorama.
Why A is Wrong: Deploying VM-Series firewalls in each AWS VPC would increase compute footprint and operational change. It also ignores the existing TGW-centered design and is not the managed Cloud NGFW pattern requested.
Why C is Wrong: Cloud NGFW for Azure in vWAN can be valid, but managing policy with local rules violates the requirement to unify Security policy across protected areas through Panorama.