NGFW-Engineer Practice Test 15 — 15 Questions

Question 1

A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a virtual router and assign both interfaces to it. To route traffic between Layer 3 interfaces, PAN-OS uses virtual routers. Assigning both interfaces to the same virtual router allows the firewall to use its routing table to forward packets between them. While security policies are needed to permit the traffic, the fundamental routing configuration is the virtual router assignment.

Answer

Assign both interfaces to the same security zone

Answer

Create a security policy allowing traffic between the two zones

Answer

Enable OSPF on both interfaces

Question 2

How can you verify the status of a tunnel interface?

Accepted Answer

Use the CLI command 'show interface tunnel.'. The 'show interface tunnel.' command displays the status, packet counts, and errors for the tunnel interface.

Answer

Check the system logs

Answer

Review the routing table

Answer

Ping the tunnel interface

Question 3

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

Accepted Answer

Device > Setup > Services. DNS settings for the firewall management plane are found under Device > Setup > Services.

Answer

Network > Virtual Routers

Answer

Network > Interfaces

Answer

Objects > Services

Question 4

What is the purpose of the 'Policy Optimizer' feature?

Accepted Answer

To identify and clean up unused rules. Policy Optimizer helps identify unused rules and improve policy efficiency by suggesting changes to security rules.

Answer

To increase throughput

Answer

To update threat signatures

Answer

To automatically create NAT rules

Question 5

An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?

Accepted Answer

Using the management interface for HA1 requires that the management interfaces are in the same subnet and that HA1 IP addresses are configured.. When using the management interface for HA1, you must configure HA1 IP addresses on both firewalls in the same subnet. This ensures that the control link can communicate. The management interface is not automatically set up for HA; explicit configuration is required. This is a valid and supported configuration, though often a dedicated HA1 interface is preferred.

Answer

Using the management interface for HA1 is not supported; HA1 must use a dedicated data interface.

Answer

HA2 must use the same interface as HA1; it cannot be configured on a separate interface.

Answer

HA2 can be configured on the same interface as HA1, but it is not recommended due to performance issues.

Question 6

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a subnet. The firewall interface is configured with a static IP address. Which additional step is required to enable DHCP server functionality on that interface?

Accepted Answer

Enable DHCP server in the interface's advanced settings and define an address pool.. The correct answer is to enable DHCP server in the interface's advanced settings and define an address pool. PAN-OS allows an interface with a static IP to function as a DHCP server. This is configured under the interface's IPv4 or IPv6 settings, where you specify the address pool, lease times, and other parameters. No external relay is needed.

Answer

Configure a DHCP relay agent to forward requests to an external DHCP server.

Answer

Create a security policy rule allowing DHCP traffic from the zone to the DHCP server.

Answer

Enable DHCP client on the interface to obtain an IP address dynamically.

Question 7

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

Accepted Answer

Proxy ID. The Proxy ID configuration in the IKE Gateway/IPsec tunnel settings defines exactly which traffic (source/destination/protocol) is permitted through the tunnel; unmatched traffic is dropped or routed outside the tunnel.

Answer

Re-key interval

Answer

Dead Peer Detection

Answer

IKE Crypto Profile

Question 8

Which TWO interface types support IP addresses?

Accepted Answer

Layer 3 interface. Layer 3 and Loopback interfaces support IP addresses.

Answer

Aggregate Ethernet (Layer 2)

Answer

Tap interface

Answer

Virtual Wire interface

Question 9

Which THREE features are associated with Threat Prevention?

Accepted Answer

Anti-Spyware. Threat Prevention is the Palo Alto Networks security subscription that bundles Anti-Spyware (A), Antivirus (B), and Vulnerability Protection (E) into a single license, so all three are correctly associated with it. Anti-Spyware (A) detects and blocks command-and-control traffic, spyware downloads, and DNS-based callbacks via signatures and DNS sinkholing. Antivirus (B) inspects traffic and file transfers for malware, viruses, and worms using stream-based and file-based signatures. Vulnerability Protection (E) blocks exploits targeting known software vulnerabilities (e.g., buffer overflows, code execution) with IPS-style signatures. Data Filtering (C) belongs to the Data Loss Prevention subscription, which identifies and controls sensitive data patterns, and URL Filtering (D) is a separate subscription that categorizes and controls web access, so neither is part of Threat Prevention.

Answer

Data Filtering

Answer

URL Filtering

Question 10

A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?

Accepted Answer

Management interface. The management interface on a Palo Alto Networks firewall is specifically designed for out-of-band management. It is separate from data interfaces and cannot be used for data traffic, ensuring dedicated management access. Assigning an IP address to the MGT interface allows administrators to connect via SSH or HTTPS without impacting data plane operations. Other interface types like Layer 3 or loopback can be used for management but are not dedicated solely to that purpose.

Answer

Layer 2 interface

Answer

Loopback interface

Answer

Layer 3 interface

Question 11

An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?

Accepted Answer

Enable 'Advertise Default Route' in the OSPF Area configuration and select 'Match'.. The 'Match' option under OSPF Area configuration for advertising a default route ensures the firewall originates a default route into OSPF only when a corresponding default route exists in its routing table. This conditional advertisement prevents the firewall from attracting traffic it cannot forward, which is critical for stable routing in scenarios where the default route may be learned dynamically or withdrawn.

Answer

Create a static route to 0.0.0.0/0 with a next-hop of 'discard' and redistribute static routes into OSPF.

Answer

Enable 'Advertise Default Route' in the OSPF Area configuration and select 'Always'.

Answer

Configure an OSPF export rule that matches the default route and set the metric to 0.

Question 12

An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?

Accepted Answer

The firewall uses the virtual router associated with the ingress interface to make the routing decision.. The firewall uses the virtual router associated with the ingress interface to perform the route lookup. This means the routing table of that virtual router is consulted. If the route points to an egress interface in another virtual router, the packet is dropped unless route leaking is configured. The egress virtual router is not used for the initial decision.

Answer

The firewall uses the virtual router associated with the egress interface to make the routing decision.

Answer

The firewall uses the virtual router with the lowest administrative distance for the destination network.

Answer

The firewall uses the virtual router that has a default route configured.

Question 13

What is the default behavior when a firewall is configured for HA but the control link fails?

Accepted Answer

Potential split-brain condition. If the HA control link fails, the firewalls may lose synchronization, and both could potentially try to become 'Active' (a split-brain scenario) unless heartbeat link monitoring is correctly configured.

Answer

The firewall reboots

Answer

Traffic is dropped immediately

Answer

The passive firewall takes over

Question 14

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

Accepted Answer

Local Database. Option A (Local Database) is correct because the Palo Alto Networks firewall maintains a built-in local user database where administrators can be created under Device > Administrators and authenticated directly against the firewall's management plane. Option C (RADIUS) is correct because the firewall supports external authentication profiles, including RADIUS, which can be assigned to administrator accounts for management-plane login. DNS (B) is a name-resolution service, DHCP (D) is for dynamic IP address assignment, and NTP (E) is for time synchronization — none of these authenticate administrators to the management plane.

Answer

DNS

Answer

DHCP

Answer

NTP

Question 15

Which TWO issues can prevent BGP from reaching the 'Established' state?

Accepted Answer

Blocked TCP port 179. BGP will not establish if there is a mismatch in AS numbers or if TCP port 179 is blocked.

Answer

Router ID mismatch

Answer

Keepalive timer mismatch

Answer

Area ID mismatch