Which two zone types are valid when configuring a new security zone? (Choose two.)

In Palo Alto Networks PAN-OS, a security zone is a fundamental logical grouping of interfaces used to control and inspect network traffic. When creating a new security zone, an administrator must define its type, which strictly dictates the kind of interfaces that can be assigned to it. The system does not allow mixing different interface types within a single zone. According to official PAN-OS documentation, the valid zone types available in the configuration dropdown are Tap, Virtual Wire, Layer 2, Layer 3, Tunnel, and External. Consequently, Tunnel and Virtual Wire are officially supported zone types. The Tunnel zone type is specifically used for tunnel interfaces, while the Virtual Wire zone type is used for interfaces deployed in a transparent, bump-in-the-wire topology.

B. Intrazone: Intrazone is a security policy rule type (along with interzone and universal) used to control traffic within the same zone, not a configurable zone type.
C. Internal: While "Internal" is a very common user-defined naming convention for a trusted network zone, it is not a valid, system-defined zone type in PAN-OS.

1. Palo Alto Networks. (2023). PAN-OS 11.0 Administrator's Guide. Networking > Security Zones. Document ID: pan-os-admin-11-0.

2. Palo Alto Networks. (2022). PAN-OS 10.2 Administrator's Guide. Step-by-Step: Configure Interfaces and Zones. Document ID: pan-os-admin-10-2.