Explanation
An external zone is a type of zone that will allow different virtual systems to communicate with each other. An external zone is a special zone that is shared by all virtual systems on the firewall and can be used to route traffic between virtual systems without leaving the firewall. The external zone can also be used to route traffic to other zones within the same virtual system . The other options are not correct. A tap zone is a type of zone that is used to passively monitor traffic without affecting the flow of packets . A virtual wire zone is a type of zone that is used to create a transparent bridge between two network segments without changing the original IP addressing or routing3. A tunnel zone is a type of zone that is used to terminate VPN tunnels or other types of encapsulated traffic4. References:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/virtual-systems/communication-between-virtual-sy
2:
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/networking/configure-interfaces/configure-a-tap-in
3
:https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/networking/configure-interfaces/configure-a-virtu
4
:https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/networking/configure-interfaces/configure-a-tunne

Explanation
Step 1. In either the NGFW or in Panorama, on the Operations/Support tab, download the technical support file.
Step 2. Log in to the Customer Support Portal (CSP) and navigate to Tools > Best Practice Assessment.
Step 3. Upload or drag and drop the technical support file.
Step 4. Map the zone type and area of the architecture to each zone.
Step 5.Follow the steps to download the BPA report bundle.

Explanation
Adding a WildFire subscription can improve the security posture of the organization by providing protection against unknown malware in near real-time. With a WildFire subscription, the firewall can forward various file types for WildFire analysis, and can retrieve WildFire signatures for newly-discovered malware as soon as they are generated by the WildFire public cloud or a private cloud appliance. This reduces the exposure window and prevents further infection by the same malware.
References:https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-overview/wildfire-subscriptio

Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNqw

"The WildFire inline ML option present in the Antivirus profile enables the firewall dataplane to apply machine learning on PE (portable executable), ELF (executable and linked format) and MS Office files, and PowerShell and shell scripts in real-time." fromhttps://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/threat-prevention/wildfire-inline-ml