Credential phishing prevention works by scanning username and password submissions to websites and comparing those submissions against valid corporate credentials.

The question asked for the required certificate attributes. not the actual certificate that is required, but the certificate attributes. Private key and SAN are the only certificate attributes in the question.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/decryption- concepts/decryption-san

Access domains control administrative access to specific Device Groups and templates, and also control the ability to switch context to the web interface of managed firewalls.
https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/panorama-overview/role- based-access-control/access-domains

Path monitoring allows you to verify connectivity to an IP address so that the firewall can direct traffic through an alternate route, when needed.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/policy-based- forwarding/pbf/path-monitoring-for-pbf

When an interface is configured as virtual wire, the routing table is not checked by the FW. If it enters one interface, it has to exit the other interface of the virtual wire, there is no exception.