this topic told us that when we use "Domain Credential Filter" method we should install user-id agent on AD ...

"the User-ID credential service then takes the collected usernames and password hashes and deconstructs the data into a type of bit mask called a bloom filter. Bloom filters are compact data structures that provide a secure method to check if an element (a username or a password hash) is a member of a set of elements (the sets of credentials you have approved for replication to the RODC). The User-ID credential service forwards the bloom filter to the User-ID agent; the firewall retrieves the latest bloom filter from the User-ID agent at regular intervals and uses it to detect usernames and password hash submissions. "

so the answer is D ....
sorry

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/prevent-credential-phishing/configure-credential-detection-with-the-windows-based-user-id-agent#id7ac5bd32-a389-4ac7-bedc-a47e62bde6ee

i think the answer is B .... the FW not know the password of users ... so can't check if password submit is the same corporate password ....
the only way is to check that username submit on website is the same corporate username by mapping ip to user ....
so the correct answer is B not D

Answer is D

This credential detection method enables the firewall to check for a valid corporate username and the associated password. The firewall determines if the username and password a user submits matches the same user’s corporate username and password.

https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/objects/objects-security-profiles-url-filtering/user-credential-detection

Sorry, Answer is B. Use the same link, I misread the answer before

I think ans is D.
https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/content-inspection-features/credential-phishing-prevention