NGFW-Engineer Practice Test 10 — 10 Questions

Question 1

Which THREE routing protocols can be configured on a PAN-OS virtual router?

Accepted Answer

RIP. PAN-OS supports OSPF, BGP, and RIP as the primary dynamic routing protocols.

Answer

IS-IS

Answer

EIGRP

Question 2

Which CLI command displays the API key if already generated for an admin?

Accepted Answer

The API key cannot be retrieved via CLI.. Actually, the API key is never displayed via CLI once created. The admin must regenerate it if forgotten.

Answer

show admin api-key

Answer

show config running

Answer

debug management-plane show-keys

Question 3

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

Accepted Answer

Management interface. The management interface is specifically designed for out-of-band management and allows you to restrict access via a management profile. You can specify permitted IP addresses and services. While other interfaces can be used for management in some designs, the dedicated management interface is the standard and most secure method for restricting management access.

Answer

Layer 3 interface

Answer

Layer 2 interface

Answer

Loopback interface

Question 4

When configuring a Static Route, what does the 'Metric' field do?

Accepted Answer

Determines route preference. The metric is used to choose between multiple routes to the same destination; a lower metric is preferred over a higher one.

Answer

Defines the interface bandwidth

Answer

Sets the tunnel timeout

Answer

Defines the next hop IP

Question 5

An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?

Accepted Answer

The two interfaces are in the same broadcast domain, and the firewall does not route between interfaces in the same subnet; it requires them to be in different subnets or use a different mechanism.. The correct answer is that the firewall does not route between interfaces in the same subnet. PAN-OS requires each Layer 3 interface to be in a unique subnet to perform routing. When two interfaces share a subnet, the firewall cannot determine which interface to use for routing, resulting in a route lookup failure. The solution is to assign different subnets or use a different design.

Answer

The firewall requires a static route for the directly connected subnet to be added manually to the virtual router.

Answer

The firewall does not allow two interfaces in different zones to have IPs in the same subnet; it requires a virtual router to resolve the conflict.

Answer

The firewall requires a policy-based forwarding rule to redirect traffic between the two interfaces.

Question 6

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

Accepted Answer

Virtual Router with path monitoring. Path monitoring within a Virtual Router enables the firewall to detect when a monitored path becomes unreachable and to remove the associated route from the routing table. This allows a backup default route to take over, achieving automatic ISP failover. Link aggregation and HA address different redundancy needs, while PBF does not provide automatic failover.

Answer

Policy-Based Forwarding (PBF)

Answer

High Availability (HA) active/passive

Answer

Link Aggregation Group (LAG)

Question 7

A security automation team is integrating a Palo Alto Networks NGFW with a third-party orchestration platform. The platform requires the firewall to send logs to an external syslog server for correlation. The team must configure the firewall to forward traffic logs to the syslog server. Which two configuration elements are required on the firewall to forward traffic logs to an external syslog server? (Choose two.)

Accepted Answer

A syslog server profile defining the server IP address and port. To forward traffic logs to an external syslog server, the firewall requires a syslog server profile that defines the server's address and port, and a log forwarding profile that matches traffic logs and references that syslog profile. The log forwarding profile is then attached to security policies. Enabling logging on a rule generates logs but does not forward them externally. Certificates and decryption policies are not required for basic syslog forwarding.

Answer

An SSL/TLS certificate for syslog communication

Answer

A decryption policy to inspect syslog traffic

Answer

A security policy rule with logging enabled at session end

Question 8

Why might OSPF adjacency stay in 'ExStart/Exchange' state?

Accepted Answer

MTU mismatch on the interfaces. An MTU mismatch between the two OSPF peers prevents them from exchanging large Database Description (DBD) packets, causing the state to hang in ExStart/Exchange.

Answer

Hello timer mismatch

Answer

Area ID mismatch

Answer

Authentication key mismatch

Question 9

An engineer is setting up a new Palo Alto Networks firewall and needs to configure the device to send logs to an external syslog server. Which configuration step is required to ensure that logs are forwarded to the syslog server?

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog and assign it to a log forwarding profile.. To forward logs to an external syslog server, you must create a syslog server profile that defines the server's IP address, port, facility, and log format. Then you create a log forwarding profile that references this server profile and attach it to the relevant security policies or log sources. This two-step process ensures that logs are both destined for the correct server and matched for forwarding. Without both components, logs remain local.

Answer

Add the syslog server IP address to the management interface allowed IP list.

Answer

Enable syslog forwarding globally under Device > Setup > Management > Logging.

Answer

Configure a syslog server under Device > Setup > Services > Syslog.

Question 10

Which THREE actions should be performed during a standard automation failure troubleshooting process?

Accepted Answer

Validate API key permissions for the target object.. Check logs, verify credentials, and test connectivity to the management interface.

Answer

Update the hardware firmware.

Answer

Perform a factory reset of the firewall.