B: There are two DoS protection mechanisms that the Palo Alto Networks firewalls support.
* Flood Protection - Detects and prevents attacks where the network is flooded with packets resulting in too many half-open sessions and/or services being unable to respond to each request. In this case the source address of the attack is usually spoofed.
* Resource Protection - Detects and prevent session exhaustion attacks. In this type of attack, a large number of hosts (bots) are used to establish as many fully established sessions as possible to consume all of a system's resources.
You can enable both types of protection mechanisms in a single DoS protection profile.
D: Provides additional protection between specific network zones in order to protect the zones against attack. The profile must be applied to the entire zone, so it is important to carefully test the profiles in order to prevent issues that may arise with the normal traffic traversing the zones.
When defining packets per second (pps) thresholds limits for zone protection profiles, the threshold is based on the packets per second that do not match a previously established session.
Incorrect Answers:
A: Vulnerability protection stops attempts to exploit system flaws or gain unauthorized access to systems. For example, this feature will protect against buffer overflows, illegal code execution, and other attempts to exploit system vulnerabilities.
C: Data Filtering helps to prevent sensitive information such as credit card or social security numbers from leaving a protected network.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/security-profiles

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/configure-ha- clustering

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/enumeration-of-rules-within- a-rulebase To keep track of rules within a rulebase, you can refer to the rule number, which changes depending on the order of a rule in the rulebase. The rule number determines the order in which the firewall applies the rule.
The universally unique identifier (UUID) for a rule never changes even if you modify the rule, such as when you change the rule name. The UUID allows you to track the rule across rule bases even after you deleted the rule.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEwCAK
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClG2CAK