NGFW-Engineer Practice Test 17 — 15 Questions

Question 1

An engineer is configuring a Palo Alto Networks firewall to use a custom certificate for the management interface (Web UI). The certificate is issued by an internal CA and has a CN of 'firewall.example.com'. After importing the certificate and private key, the engineer configures the management interface to use this certificate. However, when accessing the Web UI via https://firewall.example.com, the browser still shows a certificate warning. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The certificate is not trusted by the browser because the internal CA is not in the browser's trust store.. The most likely cause is that the internal CA's root certificate is not trusted by the browser. Even with the correct certificate configured on the firewall, the browser will warn until the CA is trusted. The CN matches, the private key likely matches, and the custom certificate is presumably applied. Therefore, the missing trust chain is the issue.

Answer

The certificate's CN does not match the hostname used to access the firewall.

Answer

The management interface is not configured to use the custom certificate; it is still using the default certificate.

Answer

The private key does not match the certificate.

Question 2

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. Traffic Logs (A) are correct because they record session-level details such as source/destination, application, and action, and can be exported to external syslog or log-collection servers for retention and analysis. Threat Logs (C) are also correct because they capture security events like IPS, antivirus, and URL-filtering hits, and are designed to be forwarded off-box to external logging infrastructure. Firmware Logs (B) are not a forwardable log type; firmware updates are administrative events, not a log category sent to external servers. Hardware Logs (D) are not a standard forwardable log type; hardware health is monitored via system/health alerts rather than a dedicated external log stream. Interface Stats (E) are performance counters shown in monitoring dashboards, not logs forwarded to an external server.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 3

An administrator wants to use a specific user's group membership for policy enforcement. What is the requirement?

Accepted Answer

Enable User-ID on the zone. User-ID must be configured to map users to groups for group-based policy enforcement.

Answer

Create a local user database

Answer

Increase the policy limit

Answer

Enable SSL decryption

Question 4

Where do you view the system logs to troubleshoot hardware issues?

Accepted Answer

Monitor > Logs > System. The 'Monitor' tab > 'Logs' > 'System' is the central place to see all system-level events.

Answer

Dashboard

Answer

Device > Setup

Answer

Network > Interfaces

Question 5

Which type of interface is used for connecting to a Layer 3 network?

Accepted Answer

Layer 3. A Layer 3 interface is required for routing traffic between subnets.

Answer

Virtual Wire

Answer

Layer 2

Answer

Aggregate

Question 6

A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?

Accepted Answer

In the Network > Interfaces > Tunnel section, by editing the tunnel interface.. The tunnel interface IP address is configured on the tunnel interface, which is located under Network > Interfaces > Tunnel. This IP is used for routing and as the source address for traffic sent through the VPN. The other options are related to VPN configuration but do not include the tunnel interface IP setting.

Answer

In the Network > IPSec Tunnels section, under the Proxy ID tab.

Answer

In the IKE Gateway configuration, under the Advanced tab.

Answer

In the IPSec Crypto Profile configuration.

Question 7

A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?

Accepted Answer

Create an OSPF area and add the interface as an OSPF interface in the Virtual Router configuration.. OSPF on PAN-OS is configured within a virtual router. You must define an OSPF area and then add the Layer 3 interface to that area. This step activates OSPF on the interface, allowing it to form adjacencies. Without adding the interface to an OSPF area, the firewall will not participate in OSPF on that interface, regardless of other settings.

Answer

Configure a static route to the neighbor and enable OSPF via the CLI with 'set protocol ospf enable'.

Answer

Enable OSPF globally under Device > Setup > Routing.

Answer

Assign the interface to the 'trust' zone and enable OSPF in the zone protection profile.

Question 8

When managing multiple firewalls through Panorama, what is the best way to ensure an automation script performs the same action on all devices in a device group?

Accepted Answer

Targeting the device group via the API.. The API allows targeting the device group directly, which Panorama then propagates to the individual firewalls.

Answer

Looping through each firewall IP.

Answer

Manually logging into each firewall.

Answer

Using a broadcast address.

Question 9

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

Accepted Answer

Configure interfaces in multiple OSPF areas. To be an ABR, the firewall must have interfaces in Area 0 and at least one other non-zero area, configured within the OSPF protocol settings in the virtual router.

Answer

Enable BGP on all interfaces

Answer

Configure multiple virtual routers

Answer

Create a tunnel interface for each area

Question 10

A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. The engineer wants to ensure the response is in a structured format that can be easily parsed by a Python script. Which API request type should be used?

Accepted Answer

type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']. To retrieve configuration data in a structured XML format suitable for parsing, the type=config API with action=get and an XPath is the correct approach. Operational commands return text blobs, keygen is for authentication, and export is for file downloads.

Answer

type=op&cmd=

Answer

type=export&category=configuration

Answer

type=keygen&user=admin&password=admin

Question 11

An engineer is writing a Python script using the pan-os-python library to update an address group on a PA-VM firewall. The script must ensure that the change is only staged and not committed until a separate approval process completes. Which method should be used to push the modified configuration to the firewall's candidate configuration?

Accepted Answer

firewall.apply(). The requirement is to stage a configuration change without committing it. The apply() method in pan-os-python synchronizes the local object's state to the firewall's candidate configuration, leaving the commit for a later step. commit() would immediately apply the change, add() only creates new objects, and op() is for operational commands.

Answer

firewall.commit(sync=True)

Answer

firewall.add(address_group)

Answer

firewall.op('edit')

Question 12

You are setting up a new Palo Alto Networks firewall in a branch office. The management interface needs to be reachable from the internal network for administrators to manage the device. You have configured the management interface with an IP address and default gateway. Which additional configuration is required to allow management access from the internal network?

Accepted Answer

Configure a management profile on the management interface that permits HTTPS and SSH from the internal subnet.. Management profiles are used to enable management services on an interface and restrict them to specific IP addresses. To allow internal administrators to manage the firewall, you need to attach a management profile to the management interface that permits the desired services from the internal subnet.

Answer

Enable HTTP and Telnet on the management interface to allow access.

Answer

Create a security policy rule allowing traffic from the internal zone to the management interface.

Answer

Set the management interface to be in the same security zone as the internal network.

Question 13

A security team wants Panorama to automatically push a new security policy rule to all managed firewalls as soon as a change is saved in a specific device group. Which Panorama feature should they configure to accomplish this?

Accepted Answer

A commit trigger that fires when the device group configuration changes.. Commit triggers in Panorama are designed for automated, event-driven configuration pushes. When a change is committed in a device group or template, the trigger can immediately commit that configuration to the managed firewalls, ensuring the new rule takes effect without waiting for a scheduled interval. This is the standard mechanism for near-real-time policy distribution from Panorama.

Answer

A dynamic address group that includes the newly created rule's source addresses.

Answer

A log forwarding profile applied to the device group.

Answer

A scheduled commit that runs every five minutes on all managed devices.

Question 14

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

Accepted Answer

Network > Interfaces > Tunnel. Tunnel interfaces act as logical points for VPN traffic and are assigned IP addresses in the Network > Interfaces > Tunnel tab.

Answer

Network > Zones

Answer

Network > GlobalProtect > Gateways

Answer

Network > Virtual Routers

Question 15

A security automation script uses the XML API to retrieve logs from a Palo Alto Networks firewall. The script needs to filter logs for a specific source IP and time range. Which API request correctly retrieves the filtered logs?

Accepted Answer

type=log&log-type=traffic&query=(addr.src in 10.1.1.1) and (receive_time geq '2023/01/01 00:00:00'). The correct API for retrieving filtered logs is type=log with log-type and a query parameter. The query uses the firewall's log filter syntax to specify source IP and time range. Operational commands have a different structure, and config or export APIs are not for log retrieval.

Answer

type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/log-settings

Answer

type=export&category=traffic&filter=src-10.1.1.1

Answer

type=op&cmd=(addr.src in 10.1.1.1)