NGFW-Engineer Practice Exam 2 — 20 Questions

Question 1

You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account lacks permissions for the requested object.. A 403 error indicates that the API key provided has insufficient permissions or the admin account associated with the key lacks the necessary role to access the resource.

Answer

The API Key is expired.

Answer

The JSON body is malformed.

Answer

The API endpoint URL is incorrect.

Question 2

What is the default action for the 'interzone-default' security policy?

Accepted Answer

Drop. The default security policy for traffic moving between different zones is to drop it.

Answer

Alert

Answer

Allow

Answer

Reset

Question 3

You need to perform a packet capture on a specific firewall interface. Which tool is used?

Accepted Answer

Monitor > Packet Capture. The Packet Capture tool under Monitor > Packet Capture allows for selecting interfaces and defining filters.

Answer

Policies > Security

Answer

Device > Setup > Logging

Answer

Network > Interfaces

Question 4

If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?

Accepted Answer

The Management Plane is overloaded.. A 503 error often indicates that the management plane is overloaded, or the XML API service is busy processing a previous command.

Answer

The endpoint is incorrect.

Answer

The API Key is invalid.

Answer

SSL handshake failed.

Question 5

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

Accepted Answer

Apply the profile to the zone under Network > Zones.. Option D is correct because a zone protection profile must first be created as an object under Network > Network Profiles > Zone Protection before it can be referenced anywhere; this defines the flood, reconnaissance, and packet-based attack protections. Option B is correct because after the profile exists, it must be attached to the target security zone under Network > Zones (in the Zone Protection Profile field) for the protections to take effect on that zone's ingress traffic. Option A is incorrect because security policy rules control permitted traffic and are not required to bind a zone protection profile to a zone. Option C is incorrect because assigning a zone to a virtual router is part of basic Layer 3 zone configuration, not zone protection profile configuration. Option E is incorrect because 'Strict' mode is not a valid interface setting for enabling zone protection; there is no such required toggle.

Answer

Create a security policy rule.

Answer

Assign the zone to a virtual router.

Answer

Enable the 'Strict' mode on the interface.

Question 6

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

Accepted Answer

Generate an API key on Panorama using an admin account with sufficient privileges.. To automate policy deployment with Panorama, first generate an API key for authentication. Then, after modifying the candidate configuration on Panorama, use the 'commit-all' action to push the changes to the managed firewalls. This ensures the policies are applied to the devices.

Answer

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Answer

Use the 'validate' action to ensure the configuration is valid before committing.

Answer

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Question 7

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Accepted Answer

Include the config and set elements in the API request.. To activate a new security rule created via the XML API, the script must first ensure the rule is added to the candidate configuration by including 'type=config' and 'action=set' in the request. Then, a separate commit request with 'action=commit' is required to push the candidate configuration to the running configuration. Without both steps, the rule will not take effect.

Answer

Use the <key> element to provide the API key for authentication.

Answer

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Answer

Include the <vsys> element to specify the virtual system for the rule.

Question 8

A company uses a SOAR platform to enrich and block indicators of compromise. The SOAR playbook must add malicious IP addresses to an External Dynamic List (EDL) hosted on an internal web server that the firewall already consumes. Which action should the playbook take?

Accepted Answer

Update the file on the internal web server that the firewall retrieves as the EDL source.. External Dynamic Lists are designed for exactly this use case: a firewall retrieves a list from an HTTP or HTTPS URL on a refresh interval, and any change to the source file is picked up automatically without a commit. A SOAR playbook can simply append or rewrite the file on the internal web server, and the firewall will enforce the new indicators after its next refresh. This keeps policy static and indicator management dynamic.

Answer

Use the SOAR platform to push a new security policy rule directly to the firewall for each malicious IP.

Answer

Configure the SOAR platform as a syslog target and send the IPs as log entries for the firewall to parse.

Answer

Call the firewall XML API to create a new address object for each IP and add it to a security policy rule.

Question 9

A security engineer is using the PAN-OS XML API to update the description of an existing address object named 'WebServer' in the 'Shared' location. The API request is sent with the correct API key and the following XPath: /config/shared/address/entry[@name='WebServer']. The server responds with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account used to generate the API key lacks write permission for the 'Shared' location.. The 403 Forbidden response indicates an authorization failure. Even with a valid API key, the admin account's role must have write permission for the target location. In this case, the 'Shared' location requires sufficient privileges to modify address objects. Checking the admin role's permissions and ensuring it includes write access to the relevant configuration area resolves the issue.

Answer

The API request is missing the required 'type=config' parameter.

Answer

The XPath is malformed and does not match any existing object.

Answer

The API key is invalid or expired.

Question 10

An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?

Accepted Answer

Another administrator or automation process changed the candidate configuration between the script's edit and its commit, and the commit included that other change.. The candidate configuration is shared among management sessions, and the commit operation commits whatever is in the candidate at the moment it runs. Without acquiring a config lock, a script's edit can be interleaved with changes from another session, and the subsequent commit will include those other changes. Locking the candidate before editing and releasing it after committing prevents this race condition.

Answer

The firewall rejected the edit because the rule name already existed and the API returned a success code while ignoring the change.

Answer

The edit request was applied to the running configuration instead of the candidate configuration.

Answer

The commit endpoint requires an API key with superuser role, and the script's key lacks the necessary permission, so the commit silently reverted the change.

Question 11

An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?

Accepted Answer

GET /restapi/v10.0/Policies/SecurityRules?location=shared. The PAN-OS REST API uses the 'location' query parameter to specify the scope for policy retrieval. For shared policies, the value is 'shared'. The correct HTTP method is GET, as it is used to retrieve data without modifying it. Other methods or parameters would not correctly return the desired list of security rules.

Answer

GET /restapi/v10.0/Policies/SecurityRules?type=shared

Answer

POST /restapi/v10.0/Policies/SecurityRules with a JSON body specifying 'location': 'shared'

Answer

GET /restapi/v10.0/Policies/SecurityRules/Shared

Question 12

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Accepted Answer

Create a log forwarding profile and apply it to the security policy that matches the desired traffic.. To forward logs from a specific security policy, you create a log forwarding profile and attach it to that security policy. This ensures only logs from that policy are sent. Other methods like assigning to management interface or zones are incorrect because log forwarding is policy-specific.

Answer

Configure a syslog server profile and assign it to the management interface.

Answer

Use a log filter in the syslog server profile to exclude logs from other policies.

Answer

Create a log forwarding profile and apply it to the security zone where the traffic originates.

Question 13

A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?

Accepted Answer

init-cfg.txt. For VM-Series firewalls, the init-cfg.txt file is the correct bootstrap configuration file. It includes parameters like panorama-server and auth-key that enable automatic registration with Panorama. Other filenames are not recognized by the bootstrap process, so they would not achieve the desired automatic connection.

Answer

bootstrap.xml

Answer

auth-key.txt

Answer

panorama-config.txt

Question 14

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

Accepted Answer

Source NAT with dynamic IP and port (PAT) using the interface address.. The branch requires that all outbound traffic from the internal subnet appears to come from a single public IP. Source NAT with dynamic IP and port, using the interface address, translates both source IP and port, enabling many-to-one translation. This is the standard method for sharing one public IP among many internal hosts while preserving return path routing via the firewall's session table.

Answer

Source NAT with static IP mapping to a one-to-one public address.

Answer

Destination NAT with dynamic IP and port using the interface address for inbound traffic.

Answer

Destination NAT with a static IP mapping to the internal server.

Question 15

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Accepted Answer

Policies > Security. Security policy rules are created under Policies > Security. This tab allows you to specify match criteria such as zones, addresses, and applications, and to set actions like allow or deny. It is also where you attach security profiles for inspection. The other tabs serve different purposes: NAT for address translation, Zones for zone definition, and Applications for custom app signatures.

Answer

Network > Zones

Answer

Policies > NAT

Answer

Objects > Applications

Question 16

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

Accepted Answer

Configure a Path Monitoring profile on the primary default route.. Path Monitoring on a static route allows the firewall to periodically ping a specified IP address through that route. If the pings fail, the route is withdrawn, and the backup route takes over. This provides automatic failover for static routes, which is necessary when not using dynamic routing protocols.

Answer

Enable OSPF on both ISP interfaces and configure equal-cost multipath.

Answer

Set the backup default route with a higher administrative distance than the primary.

Answer

Configure a static route with a lower metric on the backup ISP and enable BFD.

Question 17

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Accepted Answer

Configure a Path Monitoring profile on the default route for the primary ISP.. Path Monitoring on a static default route enables the firewall to track reachability of a target IP. If the target is unreachable through the primary ISP, the route is withdrawn, and the secondary route becomes active. This provides automatic failover. The other options either require dynamic routing, manual intervention, or do not address link failure detection.

Answer

Enable OSPF on the ISP-facing interfaces to dynamically learn routes.

Answer

Set the secondary ISP interface to a lower administrative distance than the primary.

Answer

Configure a Policy-Based Forwarding (PBF) rule to redirect traffic to the secondary ISP.

Question 18

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

Accepted Answer

MTU mismatch on the interfaces. The EXSTART state in OSPF is part of the database exchange process where routers negotiate master/slave roles. If the Maximum Transmission Unit (MTU) on the interfaces does not match, the routers cannot successfully exchange database description packets, and the adjacency remains stuck in EXSTART. Checking MTU settings is a key troubleshooting step for this issue. Area mismatches, hello interval mismatches, and duplicate router IDs would cause different neighbor states.

Answer

Mismatched OSPF area IDs

Answer

Duplicate router IDs

Answer

Incorrect OSPF hello interval

Question 19

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

Accepted Answer

Some websites are excluded from decryption by a no-decrypt policy or are in a predefined category that is not decrypted.. Decryption exclusions, whether by predefined categories or custom no-decrypt policies, prevent the firewall from decrypting certain traffic. This results in some websites not being decrypted. Certificate errors on other sites may be due to certificate pinning. The correct answer identifies the selective exclusion as the cause for non-decryption.

Answer

The decryption policy is not matching because the SSL traffic is using a non-standard port.

Answer

The forward trust certificate is not installed on the firewall.

Answer

The decryption profile is set to block sessions with untrusted issuers, causing the firewall to bypass decryption.

Question 20

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name