To protect against DNS misconfigurations, Advanced DNS Security and Advanced URL Filtering licenses (Option C) enable DNS sinkholing and domain monitoring. In an Anti-Spyware profile (Option D), the DNS Policies section allows adding specific domains to detect and block misconfigured records pointing to third- party sources.
Option A (Threat Prevention) lacks DNS-specific features for this use case. Option B (Vulnerability Protection) doesn't include DNS misconfiguration settings. Documentation confirms Anti-Spyware with DNS Security for this purpose.
Reference: PAN-OS 11.2 Administrator's Guide, "DNS Security" section; "Security Profiles" - Anti-Spyware Profile.

When a firewall's local configuration overrides a Panorama template, Panorama detects this discrepancy and marks the template as out of sync (Option A) in the UI (e.g., under Templates > Device status). This alerts administrators to resolve the conflict.
Option B (only Panorama reverts) is false; local commits can revert. Option C (not visible) is incorrect; sync status is visible. Option D (update template) doesn't occur automatically. Documentation explains this sync behavior.
Reference: Panorama Administrator's Guide, PAN-OS 11.2, "Templates" section - Override and Sync Status.

The two attributes that a forward trust certificate should have for SSL Forward Proxy decryption are:
* B: A private key. This is the key that the firewall uses to sign the certificates that it generates for the decrypted sessions. The private key must be securely stored on the firewall and not shared with anyone1.
* D: A certificate authority (CA) certificate. This is the certificate that the firewall uses to issue the certificates for the decrypted sessions. The CA certificate must be trusted by the client browsers and devices that receive the certificates from the firewall1.