NGFW-Engineer Practice Test 11 — 15 Questions

Question 1

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Accepted Answer

RADIUS. RADIUS (C) is correct because PAN-OS natively supports RADIUS as an external authentication server for VPN user authentication, allowing the firewall to forward user credentials to a RADIUS server for validation via the Authentication profile. LDAP (E) is also correct because PAN-OS supports LDAP servers (including Active Directory) for VPN user authentication, querying the directory to authenticate users and optionally retrieve group memberships for policy enforcement. SNMP (A) is incorrect because it is a network management protocol used for monitoring and collecting device statistics, not for authenticating VPN users. DHCP (B) is incorrect because it is used for dynamic IP address assignment, not user authentication. NTP (D) is incorrect because it synchronizes system clocks across devices and plays no role in authenticating VPN users.

Answer

SNMP

Answer

DHCP

Answer

NTP

Question 2

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. In a Palo Alto Networks Security Policy rule, the Actions tab contains the settings that determine how the firewall handles matching traffic, including the logging options 'Log at Session Start' (A) and 'Log at Session End' (D), which control whether a log entry is generated when the session begins and/or ends. The Actions tab also includes the 'Security Profiles' setting (C), which allows you to attach a Security Profile Group or individual profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and File Blocking) to the rule for threat inspection and content control. 'DNS Server' (B) is not part of a Security Policy rule; DNS server configuration is handled elsewhere, such as in the DNS Proxy or interface/global settings. 'NAT Policy' (E) is a separate policy type configured under the Policies > NAT tab, not an option within the Actions tab of a Security Policy rule.

Answer

DNS Server

Answer

NAT Policy

Question 3

Which TWO items must match for an OSPF adjacency to form?

Accepted Answer

Area ID. OSPF requires Area ID and Hello/Dead timers to match to form an adjacency.

Answer

Router Priority

Answer

Interface Speed

Answer

Interface Description

Question 4

Which THREE items are defined in an IKE Crypto Profile?

Accepted Answer

Hashing algorithm. IKE Crypto Profiles define encryption algorithms, hashing algorithms, and Diffie-Hellman groups for Phase 1.

Answer

Tunnel interface IP

Answer

Proxy ID

Question 5

What happens if a zone is not assigned to an interface?

Accepted Answer

The interface cannot be used in a policy. The interface cannot be used in a security policy, effectively making it unusable for traffic management through the firewall.

Answer

The interface drops all traffic

Answer

The firewall will automatically create a zone

Answer

The interface becomes a management-only port

Question 6

What is the best way to monitor the firewall's CPU and memory usage?

Accepted Answer

Dashboard system resources. The Dashboard tab contains system resources widgets that show real-time CPU and memory load.

Answer

The CLI 'show version'

Answer

System logs

Answer

The traffic logs

Question 7

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Accepted Answer

HA synchronization. High Availability (HA) synchronization ensures that configuration changes made on the primary firewall are mirrored to the secondary firewall.

Answer

Manual import/export

Answer

Panorama device groups

Answer

Schedule a daily push from the CLI

Question 8

Which tool in the Palo Alto Networks ecosystem is designed specifically for automated orchestration of security workflows?

Accepted Answer

Cortex XSOAR. Cortex XSOAR is the industry-leading SOAR platform designed for security orchestration and automation.

Answer

Panorama

Answer

AutoFocus

Answer

Expedition

Question 9

When using the Panorama API to push a configuration, what is the 'xpath' parameter used for?

Accepted Answer

To define the XML path of the object to modify.. The 'xpath' specifies the exact location in the configuration hierarchy where the change is being applied.

Answer

To set the commit message.

Answer

To authenticate the API session.

Answer

To specify the target firewall IP.

Question 10

What is a 'Layer 3' interface in PAN-OS?

Accepted Answer

Interface assigned an IP and virtual router. A Layer 3 interface is assigned an IP address and is associated with a virtual router to route traffic based on the routing table.

Answer

Interface bundled for link aggregation

Answer

Interface used only for management

Answer

Interface that passes all traffic without inspection

Question 11

Which TWO items must be configured to allow external management access?

Accepted Answer

Management Profile. External management requires an IP on the MGT interface and a Management Profile that permits access (like HTTPS/SSH).

Answer

Tunnel interface

Answer

Security Zone

Answer

Virtual Router

Question 12

Which TWO components are involved in configuring GlobalProtect?

Accepted Answer

Gateway. GP requires a Portal for distribution and a Gateway for traffic management.

Answer

Management Profile

Answer

Virtual Router

Answer

Aggregate Interface

Question 13

Which THREE factors can affect the speed/throughput of a VPN tunnel?

Accepted Answer

Encryption algorithm. VPN throughput is influenced by the encryption algorithm, the CPU load of the firewall, and the MTU settings.

Answer

Management IP

Answer

Zone color

Question 14

When using OSPF, what is the 'Router ID' used for?

Accepted Answer

Identifies the router in the OSPF domain. The Router ID is a unique 32-bit identifier used to identify the router in the OSPF autonomous system and is essential for forming adjacencies and identifying the source of LSAs.

Answer

Used to encrypt OSPF packets

Answer

Sets the path metric for routes

Answer

Determines the interface speed

Question 15

Which TWO methods can be used to update the security policy on a Palo Alto Networks NGFW programmatically?

Accepted Answer

REST API.. The XML API and the REST API (on newer versions) are the primary programmatic methods.

Answer

FTP configuration upload.

Answer

SNMP SET commands.

Answer

Serial console access.