NGFW-Engineer Practice Test 18 — 15 Questions

Question 1

When automating log forwarding to an external SIEM, what is the best practice regarding the management plane load?

Accepted Answer

Use Log Collectors to offload log processing.. Offloading log management to dedicated log collectors or using efficient forwarding profiles prevents management plane degradation.

Answer

Enable debug logging on all policies.

Answer

Increase the log rate limit on the firewall.

Answer

Send logs via serial console.

Question 2

Which object type should you use to handle large lists of URLs that you want to block or allow?

Accepted Answer

External Dynamic List. External Dynamic Lists (EDL) are specifically designed to ingest and manage large lists of URLs, IPs, or domains.

Answer

Address Group

Answer

URL Category

Answer

Service Group

Question 3

A security engineer needs to programmatically create a new address object in a Palo Alto Networks NGFW using the XML API. The engineer authenticates with an API key and sends a POST request to /api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/address&element=

10.1.1.5/32

. The API returns a success response. However, the address object does not appear in the candidate configuration when checked via the web interface. What is the most likely cause?

Accepted Answer

The xpath specified is incorrect for the target vsys, so the object was created in a different location or not at all.. The XML API's set action writes directly to the candidate configuration. A success response indicates the request was syntactically valid and processed, but it does not confirm the object is in the expected vsys. The xpath must accurately reflect the target vsys and hierarchy. A mismatch can cause the object to be created elsewhere or the request to succeed without the desired effect. Verifying the xpath and checking the candidate config in the correct vsys resolves the issue.

Answer

The API key used lacks the necessary permissions to modify the candidate configuration, so the change was silently discarded.

Answer

The API request must include the parameter &commit=true to apply the change to the candidate configuration.

Answer

The XML API requires a two-step process: first create the object with action=set, then activate it with action=enable.

Question 4

An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?

Accepted Answer

The OSPF instance is not enabled on the virtual router 'VR-Trust'.. OSPF must be enabled on the virtual router and the interface must be included in an OSPF area. Without this, the firewall will not send or process OSPF hello packets, preventing adjacency formation. The interface being Layer 3 and assigned to a zone is necessary but not sufficient; the OSPF configuration on the virtual router is the critical missing step.

Answer

The interface is not configured as a Layer 3 interface in the Network > Interfaces section.

Answer

The interface is not assigned to a security zone.

Answer

The virtual router does not have a static route to the OSPF neighbor.

Question 5

You are setting up a new Palo Alto Networks NGFW and need to configure the management interface. Which parameter must be configured to allow administrative access from a remote subnet?

Accepted Answer

Default gateway. To allow remote management from a different subnet, the management interface must have a default gateway configured. This enables the firewall to route responses back to the remote administrator's network. Other settings like DNS, NTP, or login banner are not required for basic connectivity, though they may be useful for other purposes.

Answer

DNS server

Answer

NTP server

Answer

Login banner

Question 6

Which THREE items are part of the 'Device > Setup' configuration?

Accepted Answer

Services (DNS/NTP). The 'Device > Setup' section in PAN-OS contains the Services tab, where DNS servers, NTP servers, and other global services are configured, so option C is correct. It also includes the Management tab, which holds Management Interface settings such as IP address, default gateway, and permitted IP addresses, making option D correct. The Operations tab within Device > Setup provides configuration backup and restore, as well as other operational tasks, so option E is correct. Address objects (A) are configured under the Objects tab, and Security Policy rules (B) are configured under the Policies tab, so neither belongs to Device > Setup.

Answer

Address objects

Answer

Security Policy rules

Question 7

Which option is required to use an interface in a security policy?

Accepted Answer

Assign a security zone. You must assign a security zone to an interface; only then can that zone be used in a security policy rule.

Answer

Configure an IP address

Answer

Define a management profile

Answer

Enable a virtual router

Question 8

A security team is integrating a Next-Generation Firewall with an orchestration platform using the XML API. The platform needs to retrieve the current running configuration of a specific security policy rule named 'Allow-Web'. Which API request should the engineer use?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Allow-Web']. The XML API's config type with the get action allows retrieval of specific configuration objects using an XPath expression. The XPath must accurately reflect the configuration hierarchy, including the device entry, vsys, and the path to the security rule. This method returns the exact rule configuration without requiring a full configuration dump. It is the most efficient and precise way to fetch a single policy rule's settings.

Answer

GET /api/?type=op&cmd=

Allow-Web

Answer

GET /api/?type=op&cmd=

Answer

GET /api/?type=config&action=show&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Allow-Web']

Question 9

You need to configure a Palo Alto Networks firewall to resolve domain names for its management traffic. Which DNS configuration should you set?

Accepted Answer

Device > Setup > Management > DNS Settings. DNS settings for the firewall's management plane are configured under Device > Setup > Management > DNS Settings. This is where you specify the DNS servers that the firewall uses for its own name resolution. The other options are either for different purposes (DNS Proxy for clients) or do not exist.

Answer

Objects > DNS Servers

Answer

Network > DNS Proxy

Answer

Device > Setup > Services > DNS

Question 10

Which TWO types of NAT are supported in PAN-OS?

Accepted Answer

Source NAT. PAN-OS supports Source NAT (option A), which translates the source IP address of packets—typically implemented via NAT policies that rewrite the source address as traffic egresses a zone, commonly used for hide NAT (many-to-one) or dynamic IP/port translation so internal hosts can reach external networks. PAN-OS also supports Destination NAT (option B), which translates the destination IP address (and optionally port) of incoming packets—typically used for inbound port forwarding or publishing internal servers to external clients. These two are the fundamental NAT types configurable in PAN-OS NAT policies, and both can be combined in a single policy. The other options are not PAN-OS NAT types: Global NAT (C) is not a PAN-OS NAT category, Layer 2 NAT (D) is not a supported NAT type in PAN-OS (NAT operates at Layer 3), and Application NAT (E) is not a PAN-OS NAT type—application identification is handled by App-ID, not NAT.

Answer

Global NAT

Answer

Layer 2 NAT

Answer

Application NAT

Question 11

An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?

Accepted Answer

panos_security_rule. The 'panos_security_rule' resource is the standard Terraform resource for managing security policies on Palo Alto Networks devices.

Answer

panos_firewall_rule

Answer

panos_policy_rule

Answer

panos_security_policy

Question 12

An engineer is automating a Next-Generation Firewall to dynamically register IP addresses from a custom cloud inventory system. The solution must update a Dynamic Address Group (DAG) using the XML API. After authenticating, the engineer sends a request to the /api/?type=user-id&action=set endpoint with an XML payload containing inside a tag. The API responds with success, but the address does not appear in the DAG. What is the most likely cause?

Accepted Answer

The XML payload must include a element specifying the DAG's tag name.. Dynamic Address Groups rely on tags to map registered IP addresses to the correct group. The User-ID API's register action adds an IP to the User-ID table, but the DAG only includes addresses that carry the tag specified in the group's match criteria. The payload must include a element with the appropriate tag name. Without it, the address is registered but not associated with any DAG.

Answer

The API key used for authentication does not have permissions to modify User-ID entries.

Answer

The persistent attribute must be set to 1 for the address to appear in the DAG.

Answer

The API call must use the /api/?type=config&action=set endpoint to modify DAG membership.

Question 13

In an AWS Lambda function automating firewall changes, why should you use the 'pan-os-python' library with 'xapi' directly rather than the higher-level classes?

Accepted Answer

To reduce latency and overhead in serverless environments.. In serverless environments like Lambda, managing long-lived sessions or complex object hierarchies is often less efficient than raw XML requests via XAPI.

Answer

To avoid installing dependencies.

Answer

Because higher-level classes are not compatible with Python.

Answer

To bypass authentication requirements.

Question 14

An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?

Accepted Answer

OSPF dynamic cost based on HA state. OSPF dynamic cost based on HA state allows the firewall to automatically adjust its OSPF interface cost depending on whether it is active or passive. In an active/passive HA pair, the passive firewall advertises a higher cost, so OSPF routing prefers the active firewall. If a failover occurs, the newly active firewall lowers its cost, and traffic shifts accordingly. This provides deterministic routing behavior without manual intervention.

Answer

OSPF graceful restart

Answer

OSPF link-state advertisement (LSA) throttling

Answer

OSPF cost adjustment via HA priority

Question 15

What is the purpose of an Aggregate Ethernet (AE) interface?

Accepted Answer

Combine physical links for higher bandwidth and redundancy. AE interfaces provide increased bandwidth and link redundancy by bundling multiple physical ports into a single logical interface.

Answer

Connect two virtual routers

Answer

Increase the number of available VLANs

Answer

Create a secure VPN tunnel