PBF can address which two scenarios? (Choose two.)

Policy-Based Forwarding (PBF) allows administrators to create forwarding policies that override the firewall's route table. A primary use case is to route specific traffic, such as a high-bandwidth application like FTP, over a secondary or backup ISP link to preserve bandwidth on the primary link. Another key capability is providing resiliency; PBF rules can be configured with path monitoring. If the primary path becomes unavailable, the PBF rule can be disabled, allowing traffic to failover to a secondary path defined either in another PBF rule or in the main routing table, thus maintaining application connectivity.

C. Enabling the firewall to bypass Layer 7 inspection: This is incorrect. Security Policy rules, not PBF rules, determine the level of security inspection (including Layer 7 App-ID) applied to traffic. PBF only dictates the forwarding path.
D. Forwarding all traffic by using source port 78249 to a specific egress interface: This is incorrect. PBF rules match traffic based on criteria such as application or service (protocol and destination port), not the ephemeral source port of a session.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "Policy-Based Forwarding": "You can also use PBF to forward traffic to a specific egress interface or next-hop IP address when you have multiple ISP connections and you want to route traffic from a specific source or for a specific application over a connection that is not the preferred connection in your routing table." This directly supports option A.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "Policy-Based Forwarding": "To ensure that the firewall forwards PBF traffic only to active paths, you can enable path monitoring for the next-hop IP addresses in a PBF rule." This describes the mechanism for the failover scenario in option B.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2, "Policy-Based Forwarding Rule": The PBF rule configuration options listed under the "Service/URL Category" tab include "Service," which is defined as a protocol and destination port. There is no option to match based on a source port, making option D incorrect.