Which two zone types are valid when configuring a new security zone? (Choose two.)

When configuring a Palo Alto Networks NGFW, a security zone's type dictates the kind of interfaces it can contain and its operational mode. A Tunnel zone is a valid type used to group one or more tunnel interfaces, enabling the application of security policy to traffic traversing VPNs (e.g., IPSec, GRE). A Virtual Wire zone is another valid type used for transparent, "bump-in-the-wire" deployments. It contains a pair of virtual wire interfaces, allowing the firewall to inspect traffic passing through it without being a routed hop.

B. Intrazone: This describes a traffic flow direction (within the same zone), which is used in security policy rules, not a configurable zone type.

C. Internal: This is a common user-defined name for a zone (e.g., "internal-lan," "trust"), not a predefined functional type of zone.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "Objects > Zones". In the section "Configure a Security Zone

" the guide details the "Type" drop-down menu

which includes Tunnel and Virtual Wire as selectable options.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "Security Zone Overview". This document explicitly lists the available zone types: Tap

Virtual Wire

Layer 2

Layer 3

Tunnel

and External. This list confirms that 'Tunnel' and 'Virtual Wire' are valid types

while 'Intrazone' and 'Internal' are not.

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide

Version 11.0. "Security Policy". This section clarifies that "intrazone" refers to traffic where the source and destination zones are the same

distinguishing it as a policy concept rather than a zone type.