Select the Parent Device Group (default is Shared) that will be just above the device group you are creating in the device group hierarchy.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNGFCA4

Define a Threshold
to indicate the minimum number of hours after an update becomes available before the firewall will download it.
For example, setting the Threshold to 10 means the firewall will not download an update until it is at least 10 hours old regardless of the schedule.
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device- dynamic-updates

If you want to block traffic from zone A to zone B and you have configured the security rule to block this traffic, lets say the first packet comes from zone A, we do a route lookup and find the destination zone to be zone B.
You will then do a policy lookup and see that there is a policy match. But since the action is set to "deny", the packet is dropped immediately. Firewall will only inspect the traffic if the policy it matched has action set to "allow".