Question 295 - PCNSE discussion

According to the Palo Alto Networks documentation1, disabling "Share Unused Address and Service Objects with Devices" in Panorama Settings is a possible solution to reduce commit times for firewalls managed by Panorama. This option prevents Panorama from pushing address and service objects that are not used in any policy rules to the firewalls, which can reduce the size of the configuration and improve the commit performance. Therefore, the correct answer is A.

The other options are not relevant or effective for reducing commit times:

Update the apps and threat version using device-deployment: This option would not help because it is not related to the commit process. Updating the apps and threat version using device-deployment is a feature that allows Panorama to distribute content updates to firewalls without requiring a commit2.

Perform a device group push using the "merge with device candidate config" option: This option would not help because it is not related to the commit performance. Performing a device group push using the "merge with device candidate config" option is a feature that allows Panorama to merge the local changes on a firewall with the Panorama configuration without overwriting them3.

Use "export or push device config bundle" to ensure that the firewall is integrated with the Panorama config: This option would not help because it is not related to the commit performance. Using "export or push device config bundle" is a feature that allows Panorama to export or push a complete configuration bundle to a firewall, which can be useful for troubleshooting or migrating configurations4.

Reference: 1:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleLCAS 2: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewall-administration/managefirewalls/manage-content-updates-on-managed-firewalls/update-the-apps-and-threats-versionusing-device-deployment 3:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewalladministration/manage-firewalls/manage-firewall-configurations/perform-a-device-group-pushusing-the-merge-with-device-candidate-config-option 4:

https://docs.paloaltonetworks.com/panos/9-1/pan-os-admin/firewall-administration/manage-firewalls/manage-firewall-configurations/useexport-or-push-device-config-bundle-to-ensure-that-the-firewall-is-integrated-with-the-panoramaconfig