Exam PCNSE topic 1 question 341 discussion

Has to be C. Here's why: 1) API access over HTTPS is allowed by default on the management interface. 2) Configuring an Interface Management profile, with the HTTPS allowed, would mimik this access on the subinterface of the network segment. 3) Assigning an Interface Managment profile to a Layer 3 Ethernet interface does not preclude still using the built-in management interface as before. Thus fullfilling the requirement to not change existing access to the mangaement interface. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/about-the-pan-os-xml-api/structure-of-a-pan-os-xml-api-request/api-authentication-and-security#id12582d9a-f80e-42c3-a028-2fdbb5ff0bdd https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/use-interface-management-profiles-to-restrict-access

Correct answer is C

Option D Because: The statement says: "Without changing the existing access to the management interface" To which Palo Alto indicates the following: "The firewall uses the management (MGT) interface by default to access external services, such as DNS servers, external authentication servers, Palo Alto Networks® services such as software, URL updates, licenses and AutoFocus. An alternative to using the MGT interface is to configure a data port (a regular interface) to access these services. The path from the interface to the service on a server is known as a service route" https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes/service-routes-overview

C shall be enough