NGFW-Engineer Practice Test 1 — 10 Questions

Question 1

A security engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the PAN-OS XML API. The script must authenticate using an API key. Which HTTP header should be used to pass the API key in the request?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

key=<API_KEY> as a query parameter. The PAN-OS XML API authenticates requests using an API key passed as a query parameter named 'key'. This is the documented and supported method. Other headers like Authorization or X-API-Key are not used. The API key must be included in every request, and it is recommended to use HTTPS to protect the key during transmission.

Answer

Authorization: Bearer <API_KEY>

Answer

X-API-Key: <API_KEY>

Answer

X-PAN-KEY

Question 2

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

Accepted Answer

Configure an authorization profile that maps the LDAP group 'NGFW-Admins' to a read-write admin role and 'NGFW-Auditors' to a read-only role.. To authenticate administrators against LDAP and assign different privileges, the firewall needs an authentication profile to contact the directory and validate credentials, plus an authorization profile to map directory groups to admin roles. Together these provide both authentication and role-based authorization. Other options relate to data-plane features, certificate handling, or User-ID, none of which grant differentiated admin access based on LDAP group membership.

Answer

Configure a certificate profile that validates the LDAP server's certificate for administrator logins.

Answer

Enable User-ID on the management interface to discover the LDAP groups.

Answer

Create a security policy rule that allows LDAP traffic from the management interface to the LDAP server.

Question 3

An administrator wants to use a script to back up firewall configurations daily. Which management interface service must be enabled to allow the script to download the config file?

Accepted Answer

XML API. The XML API is the standard method for scripts to programmatically export configurations (running-config).

Answer

SNMP

Answer

Telnet

Answer

SSH

Question 4

Which TWO features require a valid subscription license?

Accepted Answer

URL Filtering. URL Filtering (B) requires a valid subscription license because it depends on Palo Alto Networks' cloud-hosted URL categorization database (BrightCloud/PAN-DB) that is continuously updated and licensed per firewall. Threat Prevention (C) also requires a valid subscription license since it relies on licensed signature and vulnerability content updates delivered through Dynamic Updates (Applications and Threats content) to detect exploits, malware, and C2 traffic. In contrast, Static Routing (A), Interface creation (D), and NAT (E) are core networking features built into PAN-OS and are available without any subscription, so they do not require a valid license.

Answer

Static Routing

Answer

Interface creation

Answer

NAT

Question 5

Which tab in the web interface is used to create and manage security policies?

Accepted Answer

Policies. The 'Policies' tab is where all firewall rule sets are managed.

Answer

Device

Answer

Objects

Answer

Network

Question 6

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

Accepted Answer

Enable HA session synchronization and select 'Session State' synchronization.. To preserve existing sessions during HA failover, session state synchronization must be enabled. This replicates the session table from the active firewall to the passive firewall, so the passive can take over without dropping established flows. Other HA settings like link aggregation, heartbeat encryption, or preempt mode do not provide session continuity.

Answer

Set the passive firewall to preempt mode to automatically become active after a failure.

Answer

Enable HA heartbeat encryption to secure communication between the firewalls.

Answer

Configure HA link aggregation to increase bandwidth between the firewalls.

Question 7

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

Accepted Answer

Layer 3 interface. A Layer 3 interface in PAN-OS is a routed interface that can be assigned an IP address and used as a gateway for a subnet. It operates at the network layer and can be assigned to a security zone, enabling routing between zones. This is the standard interface type for connecting to internal networks, DMZs, or the internet when the firewall is acting as a router. Layer 2, Virtual Wire, and Tunnel interfaces do not provide the same routing capabilities and are used for different purposes.

Answer

Virtual Wire interface

Answer

Tunnel interface

Answer

Layer 2 interface

Question 8

Which feature allows an NGFW to dynamically update security objects based on an external feed such as an IP list or URL list?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDL) allow the firewall to consume lists from external web servers and use them in policies automatically.

Answer

User-ID Mapping

Answer

Log Forwarding Profiles

Answer

Dynamic Address Objects

Question 9

You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?

Accepted Answer

init-cfg.txt. The 'init-cfg.txt' file is required for bootstrapping and contains the Panorama IP and authorization key to register the VM.

Answer

license.txt

Answer

bootstrap.xml

Answer

config.cfg

Question 10

Which THREE things must be configured to allow HA between two firewalls?

Accepted Answer

HA data link. HA requires configuration of HA links (control/data), enabling HA in the device settings, and ensuring identical hardware/version.

Answer

Same virtual router configuration

Answer

Different management IP addresses