A network architect is planning the deployment of a new IPSec VPN tunnel to connect...

Basic Concept: IPSec VPN implementations require both negotiation policy to the firewall/local endpoint and data traffic policy through the tunnel interface's zone.

Why A and C are Correct: The correct controls are to permit the IPSec container application to the local zone and to create policies for traffic entering and leaving the tunnel zone.

Why B is Wrong: A policy must explicitly permit only the IKE application between the external-facing zone and local zone. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why D is Wrong: The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.