Explanation:

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study- guide.pdf page 83

Virtual Desktop Infrastructure (VDI) and Virtual Machine (VM) environments, such as Citrix XenApp and XenDesktop or VMWare Horizon and Vcenter, support access natively through HTML5. You can RDP, VNC, or SSH to these machines through Clientless VPN without requiring additional third-party middleware.
In environments that do not include native support for HTML5 or other web application technologies supported by Clientless VPN, you can use third-party vendors, such as Thinfinity, to RDP through Clientless VPN. Reference: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect- clientless-vpn/supported-technologies
https://networkwiki.blogspot.com/2017/03/palo-alto-networks-clientless-vpn-and.html

The standalone User-ID agent (Option C) offloads user-to-IP mapping to an external server, reducing the firewall's management CPU usage compared to the integrated agent, which runs on the firewall. Option A is false; neither requires domain membership. Option B is incorrect; the integrated agent uses more resources.
Option D is false; the standalone agent can run on any server. The original answer (B) was incorrect, contributing to the 83% Core Concepts score.
Reference: PAN-OS 11.2 Administrator's Guide, "User-ID" section - Integrated vs. Standalone Agent.

* A and D are the best practice deployment modes for the firewall if the company wants to add threat prevention to the network without redesigning the network routing. This is because these modes allow the firewall to act as a transparent device that does not affect the existing network topology or routing1.
* A: VirtualWire mode allows the firewall to be inserted into any existing network segment without changing the IP addressing or routing of that segment2. The firewall inspects traffic between two interfaces that are configured as a pair, called a virtual wire. The firewall applies security policies to the traffic and forwards it to the same interface from which it was received2.
* D: Layer 2 mode allows the firewall to act as a switch that forwards traffic based on MAC addresses3.
The firewall inspects traffic between interfaces that are configured as Layer 2 interfaces and belong to the same VLAN. The firewall applies security policies to the traffic and forwards it to the appropriate interface based on the MAC address table3.
Verified References:
* 1: https://www.garlandtechnology.com/blog/whats-your-palo-alto-ngfw-deployment-plan
* 2: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/networking/configure-interfaces/virtual- wire.html
* 3: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/networking/configure-interfaces/layer-
2.html