An engineer troubleshoots a Panorama-managed firewall that is unable to reach the DNS servers configured via a global template. As a troubleshooting step, the engineer needs to configure a local DNS server in place of the template value. Which two actions can be taken to ensure that only the specific firewall is affected during this process? (Choose two )

To modify a setting for a single firewall managed by Panorama without impacting other devices, an administrator has two primary methods. The first is to use the override feature within Panorama (C). This allows you to select a specific setting from a template within a template stack and define a different value that applies only to a designated firewall. The second method is to configure the setting directly on the firewall's local configuration (A). This change is specific to that device. Both actions ensure that only the target firewall is affected, which is ideal for troubleshooting a device-specific issue.

B. Change the DNS server on the global template: This action would incorrectly push the new DNS server configuration to all firewalls that inherit settings from that global template.
D. Configure a service route for DNS on a different interface: This changes the network path for DNS traffic but does not change the configured DNS server address, which is the specific troubleshooting step required by the question.

1. Palo Alto Networks Panorama Administrator's Guide 10.2, "Override a Template Setting": This section explicitly describes the override function. It states, "You can override a template setting to create a configuration that is specific to a firewall or to a template stack that is lower in the template stack hierarchy." This directly validates option C as the standard method for creating device-specific exceptions within the Panorama framework.

2. Palo Alto Networks Panorama Administrator's Guide 10.2, "Device Group and Template Precedence": This section details how configurations are merged. The firewall merges configurations from templates, device groups, and its own local settings. The documentation shows that a local firewall configuration is a distinct layer in the final running configuration, confirming that making a local change (Option A) is a valid action that affects only that device.

3. Palo Alto Networks Panorama Administrator's Guide 10.2, "Templates": The guide explains, "Templates allow you to create a configuration that you can then reuse for multiple firewalls." This principle confirms that modifying a global template (Option B) would have a widespread effect, making it incorrect for a single-device change.