NGFW-Engineer Practice Test 2 — 10 Questions

Question 1

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a management IP address, configure a default gateway, and restrict management access to specific IP addresses via the management interface settings.. The management interface should be configured with a static IP address and default gateway for reliable remote access. To secure management, restrict access to specific trusted IP addresses using the permitted IP list in the management interface settings. This prevents unauthorized hosts from attempting to connect to the management interface.

Answer

Assign a management IP address and enable DHCP client on the management interface.

Answer

Assign a management IP address and configure a security policy to allow management traffic from any zone.

Answer

Assign a management IP address and enable HTTP for management access.

Question 2

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Accepted Answer

Assign an IP address to the tunnel interface.. To route traffic into a site-to-site VPN tunnel, the tunnel interface must have an IP address to serve as a next-hop, and a static route must direct traffic for the remote network to that tunnel interface. These two steps ensure the firewall can forward packets into the tunnel. Dynamic routing and security policies are separate concerns that may be needed for full connectivity but are not the routing configuration itself.

Answer

Create a security policy allowing traffic from the local zone to the VPN zone.

Answer

Configure a NAT policy to translate traffic entering the tunnel.

Answer

Enable OSPF on the tunnel interface.

Question 3

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Accepted Answer

LDAP. LDAP (A) is correct because the firewall can be configured to query an external LDAP directory (e.g., Active Directory or OpenLDAP) to validate administrator credentials, making it a legitimate authentication method. Local Database (B) is also correct because the firewall maintains its own internal user database where administrator accounts and password hashes are stored and checked locally when external authentication is unavailable or not desired. Syslog (C) is not an authentication method; it is a logging protocol used to send event and traffic logs to a remote server. NTP (D) is a time-synchronization protocol that keeps device clocks accurate and plays no role in verifying administrator identity. DHCP (E) is used to dynamically assign IP addresses and network parameters to clients, not to authenticate administrators.

Answer

Syslog

Answer

NTP

Answer

DHCP

Question 4

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

Accepted Answer

Create an OSPF area and assign the Layer 3 interface to that area.. The two required steps are enabling OSPF on the virtual router with a router ID, and creating an OSPF area with the interface assigned to it. These steps ensure OSPF is active and the interface participates in the OSPF domain. Without a router ID, OSPF cannot start; without area assignment, the interface will not send or receive OSPF hellos. Other options like virtual links, network type changes, and graceful restart are optional and not needed for basic adjacency and route advertisement.

Answer

Set the interface's OSPF network type to point-to-point.

Answer

Configure a virtual link to the neighboring router's router ID.

Answer

Enable OSPF graceful restart on the virtual router.

Question 5

Which TWO protocols are commonly used for log forwarding to SIEMs?

Accepted Answer

HTTPS. Syslog (E) is correct because it is the de facto standard protocol for forwarding log and event messages from network devices, servers, and appliances to a central SIEM collector, typically over UDP/TCP port 514 or TLS port 6514. HTTPS (B) is correct because many SIEM and log-ingestion APIs accept log data over HTTPS (TCP 443), providing encryption and authentication for agent- or API-based forwarding. DNS (A) is a name-resolution protocol, not a log transport, so it does not belong. ICMP (C) is used for diagnostics and error messaging (e.g., ping), not log delivery. Telnet (D) is a cleartext remote-terminal protocol and is not used for forwarding logs to SIEMs.

Answer

DNS

Answer

ICMP

Answer

Telnet

Question 6

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

Accepted Answer

Active/Active uses both firewalls for session processing. Active/Active mode allows both firewalls to process traffic simultaneously and requires link aggregation or specific load balancing, whereas Active/Passive only uses one firewall for traffic.

Answer

Active/Active is only for Layer 2 deployments

Answer

Active/Passive uses both firewalls for session processing

Answer

Active/Passive requires dedicated HA links

Question 7

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

Accepted Answer

Enable OSPF on the virtual router and assign the interface to an OSPF area.. To form an OSPF adjacency, the firewall must have OSPF enabled on the virtual router and the participating interface must be assigned to an OSPF area. This allows the firewall to send and receive Hello packets. Without these steps, the firewall will not participate in OSPF, regardless of other settings.

Answer

Create a static route to the ISP router and enable OSPF on the virtual router.

Answer

Configure a loopback interface and assign it to the same OSPF area as the ISP router.

Answer

Set the interface type to Layer 2 and enable OSPF on the Layer 2 interface.

Question 8

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Accepted Answer

URL Filtering Profile. URL Filtering profiles control access to specific categories of websites.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 9

You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?

Accepted Answer

The XPath in the API call does not correctly specify the Device Group or Vsys context.. The XML API requires precise XPath syntax. If the object exists in the GUI but the API fails, it is often due to the object being nested within a specific Device Group or Vsys that was not properly specified in the XPath.

Answer

The API key does not have the 'Superuser' role.

Answer

The XML document must be wrapped in a <request> tag.

Answer

The API service is disabled on the management interface.

Question 10

What is the primary function of a Security Profile Group?

Accepted Answer

To bundle multiple security profiles into one object. A Security Profile Group allows you to bundle multiple security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) into a single object for easy policy assignment.

Answer

To manage NAT rules

Answer

To apply profiles to specific users

Answer

To group multiple security policies