NGFW-Engineer Practice Test 14 — 15 Questions

Question 1

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Accepted Answer

Root CA Certificate. SSL Forward Proxy requires a Root CA Certificate (A) because the firewall must present a certificate signed by a CA it controls to the internal client, impersonating the external server's certificate for each SSL session it intercepts. A Decryption Profile (B) is necessary because it defines the SSL protocol settings and security checks applied to the decrypted traffic, such as blocking expired certificates, untrusted issuers, and unsupported cipher suites. A Decryption Policy (D) is required to define which traffic is decrypted, specifying source/destination zones, addresses, users, and URL categories, and to attach the decryption profile that governs the session. App-ID (C) is not a required component for implementing SSL Forward Proxy; it is used in security policy for application identification and can be leveraged after decryption but is not a prerequisite for the decryption mechanism itself. User-ID (E) is likewise not required to implement SSL Forward Proxy; it is an optional identity feature used in policy matching and does not enable the decryption function.

Answer

App-ID

Answer

User-ID

Question 2

Which THREE items are required to configure a Site-to-Site VPN?

Accepted Answer

IPsec Tunnel. Site-to-Site VPNs require an IKE Gateway (Phase 1), an IPsec Tunnel (Phase 2), and a Tunnel interface to tie them together.

Answer

Aggregate Ethernet

Answer

GlobalProtect Portal

Question 3

Which command confirms that an OSPF neighbor relationship is in the 'Full' state?

Accepted Answer

show routing protocol ospf neighbor. The 'show routing protocol ospf neighbor' command displays the neighbor state, which should be 'Full' for a successfully established OSPF relationship.

Answer

show routing fib

Answer

show interface status

Answer

show system log

Question 4

What is the effect of changing the HA heartbeat interval?

Accepted Answer

Changes the detection time for peer failures. Changing the heartbeat interval affects how quickly the firewall detects a peer failure; shorter intervals increase sensitivity but also increase the risk of false failovers.

Answer

Disables session preemption

Answer

Changes the synchronization time for configuration

Answer

Changes the speed of the control link

Question 5

You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?

Accepted Answer

Device > Dynamic Updates. Dynamic update scheduling is configured under the Device tab in the PAN-OS web interface.

Answer

Objects > Dynamic Updates

Answer

Policies > Security > Dynamic Updates

Answer

Network > Interfaces > Dynamic Updates

Question 6

Which tab is used to configure physical interface settings like speed and duplex?

Accepted Answer

Network > Interfaces. The Network > Interfaces > Ethernet tab allows you to configure physical settings such as speed and duplex mode.

Answer

Device > Setup

Answer

Policies > Security

Answer

Network > Virtual Routers

Question 7

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

Accepted Answer

Threat Prevention Profiles. Threat Prevention profiles (specifically Anti-Spyware/Vulnerability Protection) detect command-and-control activity and suspicious traffic patterns.

Answer

GlobalProtect

Answer

NAT

Answer

URL Filtering

Question 8

A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?

Accepted Answer

PPPoE interface. The PPPoE interface type on a Palo Alto Networks firewall is specifically designed to negotiate a PPPoE session with an ISP, including authentication and dynamic IP address assignment. When an ISP requires PPPoE, configuring the Ethernet interface as a PPPoE interface is the correct approach. Other interface types like Layer 3 with DHCP or Layer 2 do not support the PPPoE protocol and would fail to establish the required connection.

Answer

Layer 3 interface with DHCP client enabled

Answer

Tunnel interface with IPsec

Answer

Layer 2 interface with VLAN tag

Question 9

An engineer is integrating a Palo Alto Networks NGFW with a CI/CD pipeline to automate policy updates. The pipeline uses the XML API and must ensure that changes are validated before committing. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Use type=op&cmd= to validate the candidate configuration.. To validate before committing, the pipeline must first stage changes in the candidate configuration using type=config&action=set, and then run validation using the operational command . These two steps ensure that changes are checked for errors before being committed.

Answer

Use type=commit&action=commit to validate the candidate configuration.

Answer

Use type=commit&action=partial to commit only validated changes.

Answer

Use type=config&action=delete to remove invalid objects before committing.

Question 10

An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?

Accepted Answer

Assign both interfaces to the same virtual router; no static routes are needed because the subnets are directly connected.. To route between two directly connected subnets, both interfaces must be assigned to the same virtual router. The firewall automatically creates directly connected routes for each interface's subnet. No static routes or dynamic routing protocols are needed because the routes are already in the routing table as connected routes.

Answer

Assign both interfaces to different virtual routers and configure inter-virtual-router routing.

Answer

Assign both interfaces to the same virtual router and configure a static route for each subnet.

Answer

Assign both interfaces to the same virtual router and enable OSPF to advertise the connected subnets.

Question 11

A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. Which API request type should be used?

Accepted Answer

type=export&category=configuration. To retrieve the full running configuration via the XML API, the export type with category=configuration is used. This returns the entire configuration in XML. Other methods like config get or op commands are for specific elements or operational tasks, not for exporting the complete running config.

Answer

type=op&cmd=

Answer

type=config&action=show

Answer

type=config&action=get

Question 12

An engineer needs to configure a Palo Alto Networks firewall to act as a DHCP server for a network segment connected to Ethernet1/1. The engineer wants the firewall to assign IP addresses from the 192.168.10.0/24 subnet. Which configuration step is required?

Accepted Answer

Create a DHCP Server profile and assign it to the interface under Network > DHCP > DHCP Server.. The correct step is to create a DHCP Server profile and assign it to the interface. This profile defines the pool of addresses, gateway, DNS, and lease parameters. The firewall then listens for DHCP requests on that interface and responds with addresses from the pool. Other options either enable client mode, relay, or security features not related to serving DHCP.

Answer

Assign a static IP address to the interface and enable DHCP snooping.

Answer

Enable DHCP on the interface Ethernet1/1 under Network > Interfaces > Ethernet.

Answer

Configure a DHCP Relay agent on the interface to forward requests to an external server.

Question 13

Which object type is required to enable GlobalProtect access for remote users?

Accepted Answer

GlobalProtect Gateway. The GlobalProtect Gateway is the entity that terminates the VPN tunnel and applies security policies to remote users.

Answer

GlobalProtect Zone

Answer

GlobalProtect Router

Answer

GlobalProtect Interface

Question 14

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Accepted Answer

Management Interface Settings. The Management Interface Settings allow you to define an allowed IP address list to restrict access to the management plane.

Answer

Service Route Configuration

Answer

Device > Setup > Session

Answer

Network Profile - Interface Management

Question 15

What is the purpose of 'Path Monitoring' in HA?

Accepted Answer

Monitor reachability of critical resources. Path Monitoring allows the firewall to monitor reachability to critical network resources (like a gateway or server); if the path fails, the firewall can trigger an HA failover.

Answer

Monitor link state of the peer

Answer

Monitor VPN tunnel state

Answer

Monitor traffic volume