Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
18 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?
license.txt
init-cfg.txt
The init-cfg.txt file is mandatory because it supplies the bootstrap parameters — including the Panorama IP address, device group, and template stack — that the VM-Series reads at first boot to register with Panorama. Without it, the firewall boots with no management-plane configuration and cannot authenticate to Panorama.
bootstrap.xml
config.cfg
An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?
panos_firewall_rule
panos_policy_rule
panos_security_policy
panos_security_rule
The panos_security_rule resource in the Palo Alto Networks Terraform provider declares a security policy rule, mapping its attributes to the firewall's rulebase. Applying it creates or updates the rule, which is the correct resource for this task.
You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?
The API Key is expired.
The JSON body is malformed.
The admin account lacks permissions for the requested object.
A 403 Forbidden response means the request reached the device but was refused, so authentication succeeded. The admin account authenticated to the API lacks the role or permission profile required for the requested object, unlike 401, which signals failed authentication.
The API endpoint URL is incorrect.
Which feature allows an NGFW to dynamically update security objects based on an external feed such as an IP list or URL list?
User-ID Mapping
Log Forwarding Profiles
External Dynamic Lists
External Dynamic Lists let the firewall periodically fetch an IP or URL list from an external server and reference it directly in policy, so objects update automatically as the feed changes. This satisfies the requirement for dynamic, feed-driven object updates without manual edits.
Dynamic Address Objects
An administrator wants to trigger a script automatically when a security policy is matched. Which feature can be used to send a notification to an external web server?
SNMP Trap Profile
Service Route Configuration
Syslog Server Profile
Log Forwarding Profile (HTTP destination)
A Log Forwarding Profile with an HTTP destination sends matched-policy logs directly to an external web server, satisfying the automatic notification requirement. Unlike syslog or email, the HTTP destination posts structured payloads to a URL, which can trigger server-side scripts. This is the native mechanism for webhook-style alerting on policy matches.
In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?
/var/bootstrap/
/config/bootstrap/
The VM-Series firewall's cloud-init routine scans /config/bootstrap/ during first boot, automatically detecting and processing any bootstrap package placed there. This satisfies the stem's requirement for automatic detection without manual intervention, since the firewall's init scripts explicitly target that directory rather than /opt or /var paths.
/etc/bootstrap/
/opt/paloalto/
Want more Integration And Automation practice?
Practice this domainYou are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?
Management Interface Settings
Management Interface Settings let you bind administrative access to a dedicated management interface and restrict permitted source addresses to the specified management subnet. This directly enforces the stem's constraint, because management-plane traffic is separated from data-plane interfaces, so only hosts within that subnet can reach the administrative services.
Service Route Configuration
Device > Setup > Session
Network Profile - Interface Management
Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?
Network > Virtual Routers
Network > Interfaces
Objects > Services
Device > Setup > Services
Device > Setup > Services holds the DNS server entries the firewall management plane uses for its own hostname resolution, such as update servers. This satisfies the requirement to configure the firewall's own DNS servers.
Which object type should be used to group multiple IP addresses to simplify security policy management?
Service Group
Address Object
Address Group
An Address Group bundles multiple IP addresses or subnets into a single named object, so security policies reference that group rather than each address individually. This satisfies the requirement to simplify policy management, since adding or removing addresses updates every rule using the group.
Tag
How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?
Create a static address group
Manually update the blocklist every hour
Configure an External Dynamic List (EDL)
An External Dynamic List is a firewall object pointing at an external URL that hosts the malicious IP list. The firewall polls and refreshes it automatically, so listed addresses are blocked without manual rule edits as the threat feed changes.
Use a Dynamic Address Group based on a registration API
Which tab in the web interface is used to create and manage security policies?
Policies
The Policies tab provides the central workspace for defining, ordering and deploying security rules, satisfying the requirement to create and manage security policies through the web interface. Rule creation, zone assignment, application filtering and policy commit all occur here, making it the only tab matching the stem's stated task.
Device
Objects
Network
If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?
HA synchronization
HA sync is the native method to maintain identical configurations in an HA pair.
Manual import/export
Panorama device groups
Schedule a daily push from the CLI
Want more PAN OS Device Setting Configuration practice?
Practice this domainWhich TWO actions must be performed to successfully configure a zone protection profile on a zone?
Create a security policy rule.
Apply the profile to the zone under Network > Zones.
Attaching the profile to the zone under Network > Zones binds the configured protections to that zone's ingress traffic, which is required for the profile to take effect. Creating the profile alone does nothing until it is applied here.
Assign the zone to a virtual router.
Create a Zone Protection Profile under Network > Network Profiles > Zone Protection.
The profile object itself must first exist under Network > Network Profiles > Zone Protection, defining flood, reconnaissance and packet-based protections. Without this object there is nothing to attach to a zone, making creation an essential configuration step.
Enable the 'Strict' mode on the interface.
A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?
Add the sub-interface to the default zone
Assign the sub-interface to a security zone
A sub-interface carries no zone membership until you assign it to a security zone; without this, policy lookup cannot match traffic and the interface stays unusable. Zone assignment is therefore the mandatory step that lets the firewall apply security policy to that sub-interface's tagged traffic.
Configure the sub-interface as a loopback
Enable DHCP server on the sub-interface
Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?
Network > Zones
Network > GlobalProtect > Gateways
Network > Virtual Routers
Network > Interfaces > Tunnel
The tunnel interface terminates the Site-to-Site VPN, so its IP address is configured under Network > Interfaces > Tunnel. This address provides the endpoint for routing and tunnel monitoring, which the physical interface cannot supply for the logical tunnel.
When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?
The adjacency will not form
OSPF neighbours must agree on dead interval values; a mismatch means each router expects hellos at different times, so the adjacency never reaches Full state. The timers are carried in hello packets and validated, causing the relationship to fail.
The firewall will use the lowest timer value
Only LSA type 1 updates are exchanged
The adjacency forms but drops packets
In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?
BGP peer failover
Heartbeat link synchronization
The heartbeat link continuously synchronises session and state data between the HA pair, so the passive firewall holds current connection tables. On failover it can forward existing sessions immediately, satisfying the requirement that it be ready to take over traffic without dropping flows.
ARP cache clearing
GlobalProtect gateway synchronization
Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?
Enable BGP on all interfaces
Configure multiple virtual routers
Configure interfaces in multiple OSPF areas
Configuring interfaces in multiple OSPF areas is what defines an Area Border Router: the device must hold at least one interface in the backbone (Area 0) and another in a non-backbone area, maintaining separate link-state databases per area. This satisfies the stem's ABR requirement directly.
Create a tunnel interface for each area
Want more PAN OS Networking Configuration practice?
Practice this domainThe vendor does not publish an exact question count for the NGFW-Engineer. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 3 domains: Integration And Automation, PAN OS Device Setting Configuration, PAN OS Networking Configuration. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks NGFW-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.