Explanation
A service route is the path from an interface on the firewall to a service on a server. Service routes provide access to external services such as DNS servers, external authentication servers or Palo Alto Networks services like the Customer Support Portal1. By default, the firewall uses the management (MGT) interface to access these services, but you can configure a data port (a regular interface) as an alternative2. A service route is not related to the firewall's management plane or the port assigned for the external service. A service route does not affect how the server sends its response to the firewall. References: 1:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/service-routes/service-routes-overview
2
:https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/service-routes/configure-service-route

Explanation
The Method section of the GlobalProtect portal configuration allows you to specify how users connect to the portal. The options are:
* user-logon (always on): The agent connects to the portal as soon as the user logs in to the endpoint.
* pre-logon then on-demand: The agent connects to the portal before the user logs in to the endpoint and then switches to on-demand mode after the user logs in.
* on-demand (manual user initiated connection): The agent connects to the portal only when the user initiates the connection manually. References:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/globalprotect/configure-the-globalprotect-po

Explanation
According to the Palo Alto Networks documentation , the command show system state filter displays the current state of the system and allows you to filter the output by a specific keyword. The keyword ethernet1/1 matches the interface name that the administrator wants to troubleshoot. The output of this command will show information about the transceiver type, tx-power, rx-power, vendor name, and part number for that interface2. Therefore, the correct answer is D. References:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/find-a-command 2
:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFmCAK

Explanation
The GlobalProtect portal provides the management functions for your GlobalProtect infrastructure The GlobalProtect gateways provide security enforcement for traffic from GlobalProtect apps The GlobalProtect app software runs on endpoints and enables access to your network resources

Explanation
According to the Palo Alto Networks documentation, "To view IKE and IPSec Crypto profiles in the logs, filter the System log for eventid equal to vpn (Monitor > Logs > System)." References:https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/vpn/set-up-site-to-site-vpn/set-up-ike-c