NGFW-Engineer Practice Test 19 — 15 Questions

Question 1

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the interface as a Layer 3 interface and assign it to a virtual router.. To assign an IP address to a firewall interface for routing, the interface must be configured as a Layer 3 interface and associated with a virtual router. The virtual router handles routing decisions, and the IP address is set on the interface. This enables the firewall to route traffic between zones. Other interface types like Layer 2, Tap, or Virtual Wire do not support IP address assignment for routing.

Answer

Configure the interface as a Tap interface and assign it to a virtual wire.

Answer

Configure the interface as a Layer 2 interface and assign it to a VLAN.

Answer

Configure the interface as a Virtual Wire interface and assign it to a zone.

Question 2

Which TWO objects can be used as a source in a Security Policy?

Accepted Answer

Address Object. In a Security Policy, the source field identifies the origin of traffic, and an Address Object (B) is a valid source because it represents IP addresses, subnets, or ranges that traffic originates from. A User Group (D) is also a valid source because policies can match traffic based on the authenticated user or group identity of the session's originator. Service Objects (A) define Layer 4 port/protocol information and belong in the Service/Application field, not the source. An Interface (C) is a zone or ingress point used in the source zone field, not a source object itself. An Application (E) identifies the application being used and is placed in the Application field, not the source.

Answer

Service Object

Answer

Interface

Answer

Application

Question 3

A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?

Accepted Answer

A PBF policy with a source address match and application filters for HTTP and HTTPS.. Policy-based forwarding rules can match on source address and application. To forward only HTTP and HTTPS traffic from a specific source, the PBF policy must include both a source address match and application filters for those applications. This ensures that other traffic from the same source follows the normal routing table.

Answer

A PBF policy with a source address match and a next-hop virtual router.

Answer

A static route with a next-hop that is reachable only from the trust zone.

Answer

A PBF policy with a destination address match and a service object for HTTP and HTTPS.

Question 4

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

Accepted Answer

TCP port 179 is blocked or no route to peer. The 'Active' state in BGP usually indicates the firewall is trying to initiate a TCP connection to the neighbor, but is failing, often due to routing or firewall policy blocking port 179.

Answer

Keepalive timer mismatch

Answer

AS number mismatch

Answer

Router ID is the same

Question 5

What is the recommended way to manage certificates on a Palo Alto Networks firewall?

Accepted Answer

Use the Device > Certificate Management tab. The Certificate Management section under Device > Certificate Management allows for importing, generating, and managing certificates.

Answer

Apply them via a security policy

Answer

Store them in a global address object

Answer

Manually copy files to the CLI

Question 6

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Accepted Answer

Configure an External Dynamic List (EDL). External Dynamic Lists (EDL) allow the firewall to ingest and act upon lists of IPs or URLs from a remote source.

Answer

Create a static address group

Answer

Manually update the blocklist every hour

Answer

Use a Dynamic Address Group based on a registration API

Question 7

Which THREE items are found under the 'Network' tab?

Accepted Answer

Zones. Under the 'Network' tab in PAN-OS (Palo Alto Networks firewall web interface), the correct items are Zones (A), Interfaces (B), and Virtual Routers (E). Zones (A) are logical segmentation constructs configured under Network > Zones, used to group interfaces and define trust boundaries for security policy enforcement. Interfaces (B) are configured under Network > Interfaces, where you set up Layer 2, Layer 3, virtual wire, tunnel, or loopback interfaces and assign them to zones. Virtual Routers (E) are found under Network > Virtual Routers, where routing instances, static routes, and dynamic routing protocols (OSPF, BGP, RIP) are configured. Security Profiles (C) are not under the Network tab; they reside under the Objects tab (Objects > Security Profiles) since they define threat inspection settings like antivirus, anti-spyware, and vulnerability protection. Certificate Management (D) is also not under Network; it is located under the Device tab (Device > Certificate Management) for managing device and trusted certificates.

Answer

Security Profiles

Answer

Certificate Management

Question 8

A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?

Accepted Answer

Verify security policies allow traffic to the gateway. Check if the portal/gateway IP is reachable via ping and if the correct security policies allow the GP traffic from the external zone.

Answer

Increase the tunnel encryption level

Answer

Check the local PC's DHCP settings

Answer

Clear the routing cache on the client

Question 9

A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?

Accepted Answer

Add a static route in the virtual router with destination 0.0.0.0/0 and next-hop 203.0.113.1.. The firewall uses its virtual router to make forwarding decisions. To reach the internet, it needs a default route pointing to the next-hop gateway. Adding a static route with destination 0.0.0.0/0 and the next-hop IP address ensures that all traffic without a more specific route is sent to the ISP. This is the fundamental step for internet connectivity.

Answer

Enable OSPF on ethernet1/1 to dynamically learn the default route.

Answer

Create a policy-based forwarding rule to redirect all traffic to 203.0.113.1.

Answer

Configure a NAT rule to translate all outbound traffic to the firewall's external IP address.

Question 10

A network administrator needs to configure a Palo Alto Networks firewall to send syslog messages to an external server for auditing. Which configuration path should the administrator use to add a syslog server?

Accepted Answer

Device > Server Profiles > Syslog. To send syslog messages to an external server, you must first create a syslog server profile under Device > Server Profiles > Syslog. This profile defines the server's details. Then, you can use this profile in log forwarding configurations to direct specific logs to that server. The other paths are for different purposes: log forwarding profiles, interface settings, and management settings.

Answer

Objects > Log Forwarding

Answer

Device > Setup > Management

Answer

Network > Interfaces

Question 11

What is the purpose of an HA Control Link?

Accepted Answer

Synchronize configuration and state. The HA Control Link is used to synchronize configuration and state information between the two firewalls in an HA pair.

Answer

Monitor external ISP connectivity

Answer

Manage the firewall from the internet

Answer

Forward user traffic

Question 12

An administrator is configuring a site-to-site VPN between two PAN-OS firewalls. The VPN will use a tunnel interface to route traffic. The administrator has created the IKE gateway and IPsec crypto profile. Which additional configuration is required to assign an IP address to the tunnel interface?

Accepted Answer

Create a tunnel interface under Network > Interfaces > Tunnel, then assign an IP address in the interface settings.. Tunnel interfaces in PAN-OS are created as logical interfaces under Network > Interfaces > Tunnel. They require an IP address to function as the local endpoint for the VPN. This IP is used for routing traffic into the tunnel. The IKE gateway and IPsec crypto profile handle the secure channel, but the tunnel interface IP is essential for the data plane.

Answer

Assign the IP address directly in the IKE gateway configuration under the Advanced tab.

Answer

Configure the IP address in the IPsec crypto profile under the Tunnel Interface field.

Answer

Use the 'set network interface tunnel ip' command in the CLI to assign the IP address.

Question 13

An administrator is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a single physical link that delivers both internet traffic (untagged) and IPTV multicast traffic (VLAN 300). The administrator wants to give the IPTV traffic its own security zone and apply a distinct security policy, while keeping the internet traffic in the existing untagged zone. Which configuration should the administrator use on the physical interface?

Accepted Answer

Create a Layer 3 subinterface for VLAN 300 and assign it to a new zone, while leaving the parent interface untagged for internet traffic.. Using a Layer 3 subinterface for VLAN 300 allows the firewall to route tagged IPTV traffic separately from untagged internet traffic. The subinterface can be assigned to a new zone, enabling distinct security policies. This is the correct way to handle multiple logical networks on one physical interface while maintaining Layer 3 routing.

Answer

Use a loopback interface with a VLAN tag and assign it to the IPTV zone.

Answer

Configure the physical interface as a Layer 2 interface and create two VLAN objects for internet and IPTV traffic.

Answer

Create a virtual wire between two physical interfaces and map VLAN 300 to a separate virtual wire.

Question 14

A network security engineer is deploying a Palo Alto Networks NGFW in a data center that uses a single public IP address block. The engineer must allow several internal web servers to be reached from the internet using different public IP addresses, but only has one egress interface. Which configuration should be used to meet this requirement?

Accepted Answer

Configure a destination NAT rule with a unique public IP address for each internal server, using the same external interface.. Destination NAT allows inbound connections to be redirected from a public IP address to an internal private IP address. By configuring multiple destination NAT rules with distinct public IP addresses on the same external interface, the engineer can publish multiple internal servers without adding interfaces. Source NAT, virtual routers, or port-based differentiation do not satisfy the requirement for unique public IPs per server.

Answer

Configure a source NAT rule with a unique public IP address for each internal server, using the same external interface.

Answer

Create a separate virtual router for each internal server and assign a different public IP address to each virtual router interface.

Answer

Use a single public IP address and differentiate internal servers by TCP port numbers in the destination NAT rule.

Question 15

A firewall administrator is configuring a Palo Alto Networks NGFW and needs to ensure that management access to the firewall's web interface is only allowed from the internal network 10.0.0.0/24. The management interface is on a dedicated out-of-band network. Which configuration should the administrator use?

Accepted Answer

Configure an Interface Management Profile on the management interface with permitted IP addresses 10.0.0.0/24 and enable HTTPS.. Interface Management Profiles are the correct tool to restrict management access to a firewall interface. By assigning a profile to the management interface that permits only 10.0.0.0/24 and enables HTTPS, the administrator ensures that only hosts in that subnet can reach the web interface. Security policies, NAT rules, and administrative roles do not control source IP access to management services.

Answer

Set up a NAT rule to translate the management interface IP to a private IP and restrict access via a security policy.

Answer

Create a security policy rule allowing traffic from 10.0.0.0/24 to the management interface IP on port 443.

Answer

Create an administrative role that only allows access from 10.0.0.0/24 and assign it to the admin user.