NGFW-Engineer Practice Test 16 — 15 Questions

Question 1

In a complex automation environment, how can you ensure the integrity of the firewall configuration across multiple automated runs?

Accepted Answer

Performing periodic 'get' requests to verify current state against the desired state.. Regularly fetching and verifying the 'running-config' against a known-good baseline or source-of-truth is critical for integrity.

Answer

Using only the CLI.

Answer

Disabling the API after every run.

Answer

Using only static IP addresses.

Question 2

Which THREE steps are involved in the standard User-ID agentless configuration?

Accepted Answer

Configure a Service Account. In the standard User-ID agentless configuration, you must first configure a Service Account (option A) — a dedicated domain account with the required privileges (e.g., Event Log Readers, Distributed COM Users) that the firewall uses to query the Domain Controllers for security event logs. You must also enable WMI or WinRM (option C) on the Domain Controllers, since the firewall relies on these protocols (WMI/DCOM or WinRM) to remotely read the logon events that map users to IP addresses. Finally, you add the Domain Controller to Server Monitoring (option E) on the firewall, which registers the DC as a monitored source for User-ID so the firewall can pull the logon/logoff events. Option B (IPsec tunnel) is not part of User-ID agentless setup — it is a VPN/IPsec configuration unrelated to user mapping. Option D (install software on every user PC) describes the User-ID agent or GlobalProtect-based approach, not the agentless method, which requires no endpoint software.

Answer

Configure an IPsec tunnel

Answer

Install software on every user PC

Question 3

A security engineer is writing a Python script to automate the creation of a security rule on a Palo Alto Networks NGFW using the PAN-OS XML API. The script must ensure that the rule is placed in the correct position in the rulebase and that the configuration is committed. Which sequence of API calls should the script perform?

Accepted Answer

Use 'set' to create the rule, then 'move' to position it, then 'commit' to apply the changes.. To create and position a security rule via the XML API, the script must first use 'set' to add the rule to the candidate configuration. Then, it must use 'move' with appropriate parameters to specify the rule's position relative to other rules. Finally, 'commit' applies the candidate configuration to the running configuration.

Answer

Use 'edit' to create the rule, then 'commit' to apply the changes.

Answer

Use 'set' to create the rule, then 'commit' with a 'partial' parameter to apply only the rule change.

Answer

Use 'set' to create the rule with a specific 'loc' attribute, then 'commit' to apply the changes.

Question 4

What must you do after making any change in the web interface to make it active?

Accepted Answer

Commit the configuration. Changes on a Palo Alto firewall are 'staged' and only active once the 'Commit' button is pressed.

Answer

Log out

Answer

Refresh the browser

Answer

Save the configuration

Question 5

When configuring an interface for DHCP client, where do you set this?

Accepted Answer

Network > Interfaces > [Interface] > IPv4. In the Network > Interfaces > [Interface Name] > IPv4 tab, you can select 'DHCP' for the IP configuration.

Answer

Device > Setup > Management

Answer

Network > DHCP

Answer

Network > Virtual Router

Question 6

Which TWO items are required to configure a site-to-site IPsec VPN?

Accepted Answer

Tunnel Interface. A tunnel interface (Option A) is required because it is the logical interface that carries the encrypted traffic for the site-to-site IPsec VPN, and the IPsec tunnel is bound to it so that routes and security policies can direct traffic into the VPN. An IKE Gateway (Option E) is required because it defines the IKE Phase 1 parameters — peer IP address, pre-shared key or certificate, and IKE crypto profile — that establish the secure negotiation channel before IPsec Phase 2 is built. The DHCP Server (Option B) is not required, since a site-to-site VPN uses static peer addresses and does not depend on DHCP for tunnel establishment. A Management Profile (Option C) only controls which services (such as HTTPS, SSH, or ping) are permitted on an interface and is unrelated to VPN configuration. URL Filtering (Option D) is a security subscription feature for inspecting web traffic and plays no role in establishing a site-to-site IPsec VPN.

Answer

DHCP Server

Answer

Management Profile

Answer

URL Filtering

Question 7

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two internal networks: 172.16.1.0/24 on Ethernet1/1 and 172.16.2.0/24 on Ethernet1/2. The firewall has a single virtual router. The engineer wants to ensure that traffic from 172.16.1.0/24 to 172.16.2.0/24 is routed correctly. Which configuration is required?

Accepted Answer

Ensure both interfaces are configured as Layer 3 interfaces with IP addresses and assigned to the same virtual router.. To route between two directly connected networks, the firewall interfaces must be Layer 3 with IP addresses and assigned to the same virtual router. The virtual router automatically creates connected routes for these subnets, enabling routing. Security policies must also permit the traffic, but the routing configuration itself requires the interfaces to be in the same virtual router.

Answer

Assign both interfaces to the same security zone and create a security policy allowing intra-zone traffic.

Answer

Configure a static route for 172.16.2.0/24 pointing to Ethernet1/2.

Answer

Configure a policy-based forwarding rule to direct traffic from 172.16.1.0/24 to 172.16.2.0/24.

Question 8

You are deploying a new Palo Alto Networks NGFW at a branch office. The branch has a single ISP link that provides both IPv4 and IPv6 connectivity. You need to configure the firewall's external interface to obtain both an IPv4 and an IPv6 address dynamically from the ISP. What should you do?

Accepted Answer

Configure the interface as a Layer 3 interface, enable DHCP for IPv4, and enable DHCPv6 for IPv6.. A Layer 3 interface with both DHCP and DHCPv6 enabled allows the firewall to act as a client for both protocols, acquiring IPv4 and IPv6 addresses dynamically from the ISP. This is the standard method for dual-stack dynamic addressing on PAN-OS. Other options either do not support dynamic assignment or rely on protocols that may not be available.

Answer

Configure the interface as a Layer 3 interface and assign static IPv4 and IPv6 addresses provided by the ISP.

Answer

Configure the interface as a Layer 2 interface and enable PPPoE for both IPv4 and IPv6.

Answer

Configure the interface as a Layer 3 interface and enable DHCP for IPv4 only; IPv6 addresses are automatically assigned via SLAAC.

Question 9

A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?

Accepted Answer

Create an aggregate interface group (AE) on each firewall with the same interface name and configure LACP in active mode on the member interfaces.. Aggregate Ethernet (AE) interfaces are the correct method to bundle multiple physical links into a single logical link using LACP. The same AE interface name must be used on both firewalls to ensure consistent configuration and seamless failover. LACP in active mode allows the firewall to initiate the LACP negotiation with the switch, forming a port-channel. This configuration ensures that the switch sees a single logical link from each firewall, even though only the active firewall forwards traffic.

Answer

Create a tunnel interface and assign the physical interfaces as tunnel endpoints to achieve link aggregation.

Answer

Enable Link Aggregation on the firewall by configuring a VLAN interface with multiple physical interfaces as members.

Answer

Configure a redundant interface group on each firewall and set the redundancy mode to active-active.

Question 10

You are troubleshooting a REST API integration issue where the firewall returns '400 Bad Request'. What should you check first?

Accepted Answer

The request payload syntax.. A 400 error indicates that the request sent by the client is malformed or invalid according to the API schema.

Answer

The server's internal firewall status.

Answer

The network latency between client and firewall.

Answer

The API Key expiry date.

Question 11

An administrator wants to change the firewall's hostname and configure the timezone to UTC. Which configuration path should the administrator use?

Accepted Answer

Device > Setup > Management. The hostname and timezone are configured under Device > Setup > Management. This tab contains general system settings, including hostname, timezone, DNS, and login banner. Changing the timezone to UTC is common for standardizing log timestamps. The other paths are for different configuration areas.

Answer

Device > Administrators

Answer

Device > Setup > Services

Answer

Network > Interfaces > Management

Question 12

A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)

Accepted Answer

Enable OSPF globally and configure areas and interfaces under the virtual router.. To enable OSPF on a Palo Alto Networks firewall, you must first create a virtual router and assign the relevant interfaces to it. Then, within that virtual router, you enable OSPF globally and configure areas and interface participation. These two tasks are essential for OSPF to form adjacencies and exchange routes. Other tasks like BGP configuration, loopback interfaces, or enabling OSPF on the management interface are not required for basic OSPF operation.

Answer

Enable OSPF on the management interface.

Answer

Set up a loopback interface with an IP address.

Answer

Configure BGP for route redistribution.

Question 13

What is the primary function of a Virtual Router?

Accepted Answer

Maintain the routing table. A Virtual Router maintains the routing table and processes packets based on destination IP, performing route lookups for traffic.

Answer

Provide security inspection

Answer

Manage VPN tunnel encryption

Answer

Store firewall logs

Question 14

You are configuring a Palo Alto Networks firewall to authenticate administrators using an external LDAP server. You want to ensure that only members of the 'IT-Admins' group can log in with read-write privileges, while other authenticated users have read-only access. What should you configure?

Accepted Answer

Create an authentication profile that points to the LDAP server, and assign an administrator role based on the LDAP group.. Authentication profiles in PAN-OS allow integration with LDAP servers. By creating an authentication profile and assigning it to administrator accounts, you can authenticate against LDAP. To assign roles based on group membership, you can use group mapping profiles that map LDAP groups to PAN-OS roles. This ensures IT-Admins get read-write access while others get read-only.

Answer

Configure a RADIUS server profile and use vendor-specific attributes to assign roles.

Answer

Create a local administrator account for each IT-Admins member and assign read-write role, and a generic read-only account for others.

Answer

Configure a SAML authentication profile and map SAML attributes to roles.

Question 15

You are configuring a Security Profile to detect and prevent malware. Which profile is most appropriate for identifying malicious files being downloaded?

Accepted Answer

WildFire Analysis. The WildFire Analysis profile is specifically designed to identify and sandbox suspicious files to detect malware.

Answer

Data Filtering

Answer

URL Filtering

Answer

Vulnerability Protection