In a Layer 3 deployment, the firewall routes traffic between multiple ports. Before you can Configure Layer 3 Interfaces, you must configure the Virtual Routers that you want the firewall to use to route the traffic for each Layer 3 interface.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure- interfaces/layer-3-interfaces

Add the new variable.
A variable name must start with the dollar ( $ ) symbol.
Name the new variable. In this example, the variables are named $DNS-primary and $DNS- secondary
.
Select the variable Type
and enter the corresponding value for the selected variable type.
For this example, select IP Netmask
.
(Optional
) Enter a description for the variable.
Click OK
and Close
https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/manage- templates-and-template-stacks/configure-template-or-template-stack- variables.html#id17B8D0PG0TA

C: PAN-DB categorizes URLs based on their content at the domain, file and page level, and receives updates from WildFire cloud-based malware analysis environment every 30 minutes to make sure that, when web content changes, so do categorizations. This continuous feedback loop enables you to keep pace with the rapidly changing nature of the web, automatically.
D: DNS is a very necessary and ubiquitous application, as such, it is a very commonly abused protocol for command-and-control and data exfiltration. This tech brief summarizes the DNS classification, inspection and protection capabilities supported by our next-generation security platform, which includes:
1. Malformed DNS messages (symptomatic of vulnerability exploitation attack).
2. DNS responses with suspicious composition (abused query types, DNS-based denial of service attacks).
3. DNS queries for known malicious domains. Our ability to prevent threats from hiding within DNS The passive DNS network feature allows you to opt-in to share anonymized DNS query and response data with our global passive DNS network. The data is continuously mined to discover malicious domains that are then added to the PAN-OS DNS signature set that is delivered daily, enabling timely detection of compromised hosts within the network and the disruption of command-and-control channels that rely on name resolution.

https://live.paloaltonetworks.com/t5/Management-Articles/What-are-Universal-Intrazone-and- Interzone-Rules/ta-p/57491