GlobalProtect provides accurate, timely mappings by requiring user authentication on network changes, device posture shifts, or logon events, using both internal and external gateways for comprehensive coverage across remote and on-premises users without relying on external agents or syslog delays.

To enable both RADIUS and SAML authentication to run in parallel during the transition period, you need to configure an authentication sequence and an authentication profile that includes both authentication methods.
By creating an authentication sequence that includes both RADIUS and SAML server profiles, the firewall will attempt authentication with RADIUS first and, if that fails, will fall back to SAML. This enables both authentication types to function simultaneously during the transition period.
You can also configure an authentication profile that includes both the RADIUS Server Profile and the SAML Identity Provider server profile. This setup allows the firewall to use both RADIUS and SAML for authentication requests, and it will check both authentication methods in parallel.

Basic Concept: Azure zone resilience for VM-Series is normally achieved with multiple firewall instances across Availability Zones and Azure load balancing, not PAN-OS HA links across zones.
Why A is Correct: Deploying independent firewalls in different zones behind an Azure Load Balancer keeps traffic available if one zone fails.
Why B is Wrong: Implement a Terraform configuration that automatically redeploys the firewall in a new zone if the original one fails. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
Why C is Wrong: Use Azure Traffic Manager to direct traffic to a primary VM-Series firewall, with a second firewall in another zone as a failover target. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.
Why D is Wrong: Configure PAN-OS active/passive high availability (HA) between two VM-Series instances in separate Availability Zones using HA links over a VNet peering connection. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama- controlled policy design in this scenario.

Basic Concept: IPSec VPN implementations require both negotiation policy to the firewall/local endpoint and data traffic policy through the tunnel interface's zone.
Why A and C are Correct: The correct controls are to permit the IPSec container application to the local zone and to create policies for traffic entering and leaving the tunnel zone.
Why B is Wrong: A policy must explicitly permit only the IKE application between the external-facing zone and local zone. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Terraform is designed for declarative provisioning of infrastructure resources, including virtual machines, virtual networks, and interfaces in environments like VMware vSphere, making it the appropriate tool for deploying the VM-Series firewall and its underlying infrastructure components.