An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an...

Basic Concept: Split tunnel access routes do not automatically control DNS resolution. Split DNS must specify which domains use VPN-assigned DNS servers.

Why A is Correct: Configuring split DNS with internal corporate domains sends those queries to corporate DNS while leaving public browsing DNS local.

Why B is Wrong: DNS Proxy feature on the firewall to point clients to the gateway IP for DNS relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why C is Wrong: "DNS Forwarding" option on the gateway's tunnel interface relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why D is Wrong: NAT rule to allow DNS traffic from the GlobalProtect clients to the internal DNS servers relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.