Palo Alto Networks Certified Network Security Administrator (PCNSA) — Question 127

Which statement is true about Panorama managed devices?

Answer options

• A. Panorama automatically removes local configuration locks after a commit from Panorama.
• B. Local configuration locks prohibit Security policy changes for a Panorama managed device.
• C. Security policy rules configured on local firewalls always take precedence.
• D. Local configuration locks can be manually unlocked from Panorama.

Correct answer: B

Explanation

Option B is correct because local configuration locks indeed prevent any Security policy changes on Panorama managed devices, ensuring centralized control. Options A and D are incorrect as they misrepresent the behavior of configuration locks, and option C is wrong since it does not accurately reflect the precedence of security policy rules in this context.