Palo Alto Networks documentation clearly states that when configuring the traffic replication feature in Prisma Access, you mustspecify an internal security applianceas the destination for the mirrored traffic.
This appliance, typically a Palo Alto Networks next-generation firewall or a third-party security tool, is responsible for receiving and analyzing the replicated traffic for various purposes like threat analysis, troubleshooting, or compliance monitoring.
Let's analyze why the other options are incorrect based on official documentation:
* B. Dedicated cloud storage location:While Prisma Access logs and other data might be stored in the cloud, themirrored trafficfor real-time analysis is directly streamed to a designated security appliance, not a passive storage location.
* C. Panorama:Panorama is the centralized management system for Palo Alto Networks firewalls. While Panorama can receive logs and manage the configuration of Prisma Access, it is not the direct destination for real-time mirrored traffic intended for immediate analysis.
* D. Strata Cloud Manager (SCM):Strata Cloud Manager is the platform used to configure and manage Prisma Access. It facilitates the setup of traffic replication, including specifying the destination appliance, but it does not directly receive or analyze the mirrored traffic itself.
Therefore, the mirrored traffic from the traffic replication feature in Prisma Access is directed to a specified internal security appliance for analysis.

Because the two data centers are joined by a private link, without any additional filtering each service connection can learn the mobile user IP pool routes for both regions and re-advertise them across that private inter-data-center link, creating a path for return traffic destined to European mobile users to be pulled toward the North American service connection (and vice versa) rather than staying within its own region. In default Prisma Access routing mode, the cleanest and most deterministic fix is applied at the source of the advertisement: configuring each service connection ' s outbound route filtering to exclude the mobile user pool prefixes belonging to the other region. This ensures the data center only ever learns the " local " region ' s mobile user routes from its adjacent service connection, so return traffic naturally stays on the correct, geographically appropriate path without depending on BGP path-selection tie-breaking. Options A and C attempt to solve the problem through CPE-side BGP attribute manipulation (community string preference or MED preference); while conceptually plausible in isolation, this places the burden of correct routing on customer-managed equipment reacting to attributes rather than eliminating the unwanted route at the source, and is not the documented approach for default routing mode. AS-path prepending (option D) only influences path preference when multiple paths exist for the same prefix - it does not prevent an undesired prefix from being learned or selected at all, making it an unreliable mechanism for this scenario.
Reference:Prisma Access - Service Connection Routing and Regional Traffic Steering for Mobile Users.

Because the on-premises firewall is redistributing User-ID information into Prisma Access over the service connection, the redistribution agent object must be configured within the template that actually governs the service connection ' s dataplane - the Service_Conn_Template - not the Remote_Network_Template, which applies to a different set of nodes entirely and would leave the redistribution agent unreachable from the path the data is actually traversing. Selecting the wrong template is a common and easily overlooked misconfiguration that silently prevents the mapping information from being ingested at all, which is why validating the Service_Conn_Template assignment (option D) is essential. Equally important is the Collector Pre-Shared Key: User-ID redistribution uses this shared secret to authenticate the connection between the redistributing firewall and the receiving collector, and any mismatch between the value configured on the on- premises firewall and the value configured in Prisma Access will cause the redistribution session to fail silently or be rejected, leaving remote network traffic unmapped even though the configuration otherwise looks complete - this is option C. Option A names the wrong template for a service-connection-sourced redistribution scenario, so it does not apply here. Option B, while port 5007 is indeed the standard User-ID redistribution port, describes a downstream security policy check that is secondary to first confirming the agent is bound to the correct template and authenticated correctly; a PSK mismatch or wrong template assignment will prevent the session regardless of policy.
Reference:Prisma Access - User-ID Redistribution from On-Premises Firewalls via Service Connection.

Disable Server Response Inspection (DSRI) is a performance-oriented Security policy rule setting that instructs the firewall to skip Layer 7 content inspection - which includes both App-ID continuation and all threat signature matching - on the server-to-client leg of a session, regardless of the application or protocol in use. Once enabled on a rule, it applies uniformly to every session matching that rule, not selectively to HTTP; protocols such as SMB and FTP, which are chatty in the return direction and commonly the reason DSRI is enabled in the first place, are affected exactly the same way as any other server-to-client flow. This makes option C the accurate description: all server-to-client traffic on that rule bypasses threat inspection, full stop. This is precisely why DSRI carries an operational risk that engineers must weigh deliberately: attaching a Threat Prevention profile to the same rule does not re-enable inspection or " win out " over the DSRI setting in any direction, which eliminates options B and D - the two settings are not designed to arbitrate against each other, and DSRI simply takes precedence for the return traffic. Because of this, DSRI should only ever be applied to rules governing traffic to servers that are already fully trusted, since checking the box removes visibility into exploits, malware, and data returned from that server regardless of any other profile attached to the rule.
Reference:PAN-OS Security Policy - Disable Server Response Inspection (DSRI) Behavior and Best Practice Assessment Checks.

Tenant-level isolation in the Strata Cloud Manager multitenant hierarchy is enforced at the point where an administrator account is added, not merely by the role assigned to them - an account added at the Parent Tenant level inherently has, or can be elevated to have, visibility spanning the tenant hierarchy, which directly conflicts with the requirement to restrict access to other tenants. This eliminates options A and C outright, since both place the team at the Parent Tenant. The correct placement is at the specific Child Tenant that the security team is meant to manage, which confines their administrative footprint to that tenant ' s configuration exclusively. Within that Child Tenant, the scope selection matters: choosing " All Apps & Services " (option B) is broader than the stated requirement of managing Security policy, and is not the documented scope selection paired with a Security Administrator role for policy-focused access - the correct, precisely-scoped selection is " Prisma Access & NGFW Configuration, " which grants full administrative rights over policy configuration (Security policy included) without extending into unrelated product areas or other tenants ' resources. Combined with the Security Administrator role, which governs Security policy administrative privileges specifically, this configuration satisfies both halves of the requirement: full policy management capability within the assigned tenant, and hard isolation from every other tenant in the deployment.
Reference:Strata Cloud Manager - Multitenant RBAC and Tenant Scope Assignment.