NGFW-Engineer Practice Test 13 — 15 Questions

Question 1

Which TWO conditions can trigger an HA failover?

Accepted Answer

Hardware failure. Failovers can be triggered by hardware failure or by the firewall losing reachability to monitored paths.

Answer

BGP session reset

Answer

Excessive log generation

Answer

Change in management IP

Question 2

Which TWO items can be configured in a Virtual Router?

Accepted Answer

Dynamic Routing Protocols (BGP/OSPF). In a Palo Alto Networks virtual router, you can configure Dynamic Routing Protocols such as BGP and OSPF (Option A), because the virtual router is the Layer 3 routing instance that runs routing protocol processes and exchanges routes with peers. You can also configure Static Routes (Option E), since static routes are defined within the virtual router's routing table to direct traffic to specific next hops or interfaces. SSL Decryption (Option B) is a security profile/decryption policy function, not a virtual router setting. URL Filtering (Option C) is a security profile applied in security policy, not configured on the virtual router. DHCP Server (Option D) is configured on an interface or as a separate service, not as a virtual router routing feature.

Answer

SSL Decryption

Answer

URL Filtering

Answer

DHCP Server

Question 3

You are experiencing issues with traffic passing through the firewall. What command is used to see the session table in the CLI?

Accepted Answer

show session all. The 'show session all' command is the standard way to view active sessions on the firewall.

Answer

debug dataplane show sessions

Answer

show system info

Answer

test policy match

Question 4

What is the consequence of having overlapping IP subnets on different interfaces?

Accepted Answer

Routing ambiguity and traffic delivery failure. Overlapping subnets cause routing conflicts, leading to unpredictable traffic flow.

Answer

Nothing, the firewall handles it

Answer

Increased performance

Answer

The firewall will automatically bridge them

Question 5

Which tab allows you to configure the firewall's hostname and domain?

Accepted Answer

Device > Setup > Management. Device > Setup > Management > General Settings is the path for setting the firewall's identity.

Answer

Network > Interfaces

Answer

Objects > Addresses

Answer

Policies > Security

Question 6

What is the benefit of using a Loopback interface for a GlobalProtect portal?

Accepted Answer

Provides a stable IP address. A loopback interface provides a stable IP address that does not depend on the status of a physical link, ensuring the portal remains reachable even if a physical interface flaps.

Answer

Automatically encrypts traffic

Answer

Filters traffic based on source

Answer

Increases throughput for VPN users

Question 7

Which action in a security policy should be used to drop traffic silently without sending a notification to the client?

Accepted Answer

Drop. The 'Drop' action silently discards the packet, whereas 'Reset' sends a TCP RST or ICMP unreachable.

Answer

Reset

Answer

Reject

Answer

Deny

Question 8

Which TWO types of files can be included in a bootstrap package?

Accepted Answer

init-cfg.txt. Init-cfg.txt and software images are common components of bootstrap packages.

Answer

Hardware drivers.

Answer

SSL Certificate private key.

Answer

Binary user database.

Question 9

Which tab is used to view real-time log activity?

Accepted Answer

Monitor. The 'Monitor' tab provides real-time access to traffic, threat, and system logs.

Answer

Objects

Answer

Policies

Answer

Dashboard

Question 10

When configuring an interface, what is the role of a 'Security Zone'?

Accepted Answer

To associate the interface with policy rules. Assigning an interface to a security zone makes it eligible for participation in security policies.

Answer

To assign an IP address

Answer

To enable management

Answer

To handle routing

Question 11

Which tab is used to configure logging settings for a specific security policy?

Accepted Answer

Actions. The 'Actions' tab within the security policy edit window is where logging options are configured.

Answer

General

Answer

Source

Answer

Objects

Question 12

Which TWO protocols can be used to manage the firewall?

Accepted Answer

HTTPS. SSH and HTTPS are standard protocols used for remote management of the PAN-OS web/CLI interfaces.

Answer

DHCP

Answer

FTP

Answer

SMTP

Question 13

Which feature is used to ensure the firewall clock is accurate?

Accepted Answer

NTP. NTP (Network Time Protocol) settings under Device > Setup > Services are used to synchronize time.

Answer

DHCP

Answer

DNS

Answer

SNMP

Question 14

Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?

Accepted Answer

Pan-python. Pan-python is the standard library provided by Palo Alto Networks for interacting with the XML API using Python.

Answer

GlobalProtect API

Answer

ACC (Application Command Center)

Answer

Panorama XML CLI

Question 15

An administrator wants to trigger a script automatically when a security policy is matched. Which feature can be used to send a notification to an external web server?

Accepted Answer

Log Forwarding Profile (HTTP destination). Log Forwarding Profiles allow for HTTP/S integration to send notifications to webhooks or external servers when a log is generated.

Answer

SNMP Trap Profile

Answer

Service Route Configuration

Answer

Syslog Server Profile