PAN OS Networking Configuration

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

What is the purpose of an Aggregate Ethernet (AE) interface?

You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

How does the firewall determine which virtual router to use for a packet?

Which object type is required to enable GlobalProtect access for remote users?

Which interface type is used to manage the firewall over the network?

What is the effect of changing the HA heartbeat interval?

What is the purpose of an HA Control Link?

Why might OSPF adjacency stay in 'ExStart/Exchange' state?

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

What is the benefit of using a Loopback interface for a GlobalProtect portal?

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

Which option is required to use an interface in a security policy?

What is a 'Layer 3' interface in PAN-OS?

When configuring HA, what is 'Preemption'?

When using OSPF, what is the 'Router ID' used for?

Where do you configure the 'Heartbeat' interval for HA?

What is the purpose of a Security Zone?

A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?

How can you verify the status of a tunnel interface?

In BGP, which attribute is used to influence the path selection for outgoing traffic?

How do you add a new interface to an existing zone?

What is the purpose of 'Path Monitoring' in HA?

What is the default behavior when a firewall is configured for HA but the control link fails?

Why might a static route not be visible in the routing table?

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

What is the primary function of a Virtual Router?

What is the function of a 'Tap' mode interface?

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

When configuring an interface for DHCP client, where do you set this?

What happens to established sessions during an HA failover?

In BGP, what is a 'Route Map' used for?

What is the purpose of an 'Aggregate Ethernet' interface?

Which of these is a valid way to define a source IP in a policy?

Which command confirms that an OSPF neighbor relationship is in the 'Full' state?

What happens if a zone is not assigned to an interface?

When configuring a Static Route, what does the 'Metric' field do?

In GlobalProtect, what is the 'Portal' vs. 'Gateway'?

Which tab is used to configure physical interface settings like speed and duplex?

Which THREE routing protocols can be configured on a PAN-OS virtual router?

Which THREE items are required to configure a Site-to-Site VPN?

Which TWO items must match for an OSPF adjacency to form?

Which TWO settings are configured in a Virtual Router?

Which THREE items can be assigned to a Security Zone?

Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?

Which THREE things must be configured to allow HA between two firewalls?

Which THREE items are defined in an IKE Crypto Profile?

Which TWO interface types support IP addresses?

Which TWO conditions can trigger an HA failover?

Which TWO issues can prevent BGP from reaching the 'Established' state?

Which THREE components are involved in a VPN tunnel setup?

Which TWO items must be configured to allow external management access?

Which TWO components are involved in configuring GlobalProtect?

Which THREE items can be used as a 'Source' in a security policy?

Which THREE factors can affect the speed/throughput of a VPN tunnel?

Which TWO protocols can be used to manage the firewall?

Which TWO types of failover can be configured in HA?

Which TWO commands are useful for troubleshooting OSPF?

An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?

An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?

A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?

A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?

An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?

An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)

A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

An administrator is configuring a site-to-site VPN between two PAN-OS firewalls. The VPN will use a tunnel interface to route traffic. The administrator has created the IKE gateway and IPsec crypto profile. Which additional configuration is required to assign an IP address to the tunnel interface?

A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?

An administrator is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a single physical link that delivers both internet traffic (untagged) and IPTV multicast traffic (VLAN 300). The administrator wants to give the IPTV traffic its own security zone and apply a distinct security policy, while keeping the internet traffic in the existing untagged zone. Which configuration should the administrator use on the physical interface?

An engineer needs to configure a Palo Alto Networks firewall to act as a DHCP server for a network segment connected to Ethernet1/1. The engineer wants the firewall to assign IP addresses from the 192.168.10.0/24 subnet. Which configuration step is required?

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a subnet. The firewall interface is configured with a static IP address. Which additional step is required to enable DHCP server functionality on that interface?

An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?

A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?

A network engineer is configuring a site-to-site VPN between two PA-5220 firewalls. The engineer wants to ensure that if the primary ISP link fails, the VPN tunnel automatically re-establishes over a backup ISP link without manual intervention. Both firewalls have two ISP connections and the VPN is configured with a tunnel interface. Which PAN-OS feature should the engineer configure to achieve this?

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?

A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?

A network engineer is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The engineer wants the firewall to assign IP addresses to guests and also provide DNS server information. Which configuration step is necessary to achieve this?

An administrator is configuring a Palo Alto Networks firewall to route traffic between two internal networks. The firewall has two Layer 3 interfaces, Ethernet1/1 and Ethernet1/2, each assigned to different security zones and different virtual routers. The administrator wants traffic from the trust zone to reach the untrust zone, but the firewall is not routing the traffic. What is the most likely cause?

An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?

An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two internal networks: 172.16.1.0/24 on Ethernet1/1 and 172.16.2.0/24 on Ethernet1/2. The firewall has a single virtual router. The engineer wants to ensure that traffic from 172.16.1.0/24 to 172.16.2.0/24 is routed correctly. Which configuration is required?

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

A network engineer is configuring a Palo Alto Networks NGFW with a single virtual router that has two ISP-facing interfaces: ethernet1/1 (default route to 203.0.113.1) and ethernet1/2 (default route to 198.51.100.1). The engineer wants the firewall to automatically use ethernet1/2 when ethernet1/1 fails. What should the engineer configure?

A network engineer is configuring a Palo Alto Networks firewall to use DHCP on an interface for management access. The engineer wants the firewall to obtain an IP address from a DHCP server and also send its hostname to the DHCP server for DNS registration. Which DHCP client option should the engineer enable?

A network architect is designing a Palo Alto Networks firewall deployment with two virtual routers. The firewall has two interfaces, Ethernet1/2 and Ethernet1/3, both assigned to different zones. The architect wants to ensure that traffic from Ethernet1/2 can reach Ethernet1/3 without being routed through an external device. Which configuration is necessary?

A network administrator is setting up a Palo Alto Networks firewall and needs to configure an interface for outbound internet access. The ISP provides a static IP address, and the administrator wants to ensure that return traffic from the internet can reach the internal network. Which type of interface configuration is required?

A network engineer is configuring a Palo Alto Networks firewall to participate in OSPF with neighboring routers. The engineer wants to ensure that the firewall becomes the Designated Router (DR) on a broadcast network. Which two OSPF parameters should the engineer configure to influence DR election? (Choose two.)