D is correct. You can configure Packet Buffer Protection at two levels: the device level (global) and if enabled globally, you can also enable it at the zone level https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-packet-buffer-protection.html

This is a practice Question, wont be on the test.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/packet-buffer-protection

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-packet-buffer-protection "You can configure Packet Buffer Protection at two levels: the device level (global) and if enabled globally, you can also enable it at the zone level."

D according to: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/configure-zone-protection-to-increase-network-security/configure-packet-buffer-protection You can configure Packet Buffer Protection at two levels: the device level (global) and if enabled globally, you can also enable it at the zone level. Global packet buffer protection (Device->Setup->Session) is to protect firewall resources and ensure that malicious traffic does not cause the firewall to become non-responsive. Packet buffer protection per ingress zone (Network->Zones) is a second layer of protection that starts blocking the offending IP address if it continues to exceed the packet buffer protection thresholds. The most effective way to block DoS attacks against a service behind the firewall is to configure packet buffer protection globally and per ingress zone. You can Enable Packet Buffer Protection for a zone, but it is not active until you enable packet buffer protection globally and specify the settings.