Which two statements describe an external zone in the context of virtual systems (VSYS) on a Palo Alto Networks firewall? (Choose two.)

Question

Options

• AIt is associated with an interface within a VSYS of a firewall.
• BIt is a security object associated with a specific virtual router of a VSYS.
• CIt is not associated with an interface; it is associated with a VSYS itself.
• DIt is a security object associated with a specific VSYS.

• A
  94% (34)
• B
  3% (1)
• C
  3% (1)

Explanation

In PAN-OS virtual systems, an external zone is a special zone type used to enable inter-VSYS communication. Option A is correct because an external zone is indeed associated with an interface within a VSYS - specifically, it identifies the interface through which traffic will exit one VSYS and enter another on the same physical firewall. Option D is correct because an external zone is a security object scoped to and associated with a specific VSYS; it defines how that VSYS references the neighboring VSYS for policy enforcement. Option B is incorrect because external zones are not tied to virtual routers. Option C is incorrect in its framing - while an external zone references a peer VSYS, it is still configured with interface associations within the local VSYS context, not floating without interface binding.

No community discussion yet for this question.