NGFW-Engineer Practice Exam 3 — 20 Questions

Question 1

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Accepted Answer

Check if the tunnel interface is in the correct Security Zone. Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.

Answer

Reboot the firewall

Answer

Disable the security policy

Answer

Update the GlobalProtect client version

Question 2

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Accepted Answer

Destination NAT. Destination NAT maps a public IP to an internal private IP, enabling access to internal servers.

Answer

Source NAT

Answer

Static Route

Answer

Security Policy

Question 3

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. PAN-OS supports forwarding almost all log types (Traffic, Threat, System, etc.) to external log collectors.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 4

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. Common actions include 'Allow', 'Deny', 'Drop', 'Reset', and log forwarding configuration.

Answer

DNS Server

Answer

NAT Policy

Question 5

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Accepted Answer

The IKE Gateway configuration has a mismatched Local/Peer ID.. An 'init-passive' state indicates that the firewall is waiting for the peer to initiate the connection, suggesting a mismatch in initiator/responder settings or phase 1 proposal parameters.

Answer

The physical interface is not in the correct zone.

Answer

The security policy is missing a rule for IPsec traffic.

Answer

The tunnel interface is not assigned an IP address.

Question 6

What is the primary function of a Virtual Router?

Accepted Answer

Maintain the routing table. A Virtual Router maintains the routing table and processes packets based on destination IP, performing route lookups for traffic.

Answer

Provide security inspection

Answer

Manage VPN tunnel encryption

Answer

Store firewall logs

Question 7

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name

Question 8

Which TWO settings are configured in a Virtual Router?

Accepted Answer

Static Routes. Virtual routers handle static routes and dynamic routing protocols (like OSPF/BGP).

Answer

Management Profile

Answer

Tunnel Interface IPs

Answer

Security Zones

Question 9

Which THREE settings are configured in a Layer 3 interface?

Accepted Answer

Virtual Router. L3 interfaces require an IP address, a zone assignment, and an association with a virtual router.

Answer

Aggregate setting

Answer

Management Profile

Question 10

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Accepted Answer

HA synchronization. High Availability (HA) synchronization ensures that configuration changes made on the primary firewall are mirrored to the secondary firewall.

Answer

Manual import/export

Answer

Panorama device groups

Answer

Schedule a daily push from the CLI

Question 11

Which tab is used to view real-time log activity?

Accepted Answer

Monitor. The 'Monitor' tab provides real-time access to traffic, threat, and system logs.

Answer

Objects

Answer

Policies

Answer

Dashboard

Question 12

What is the default action for the 'interzone-default' security policy?

Accepted Answer

Drop. The default security policy for traffic moving between different zones is to drop it.

Answer

Alert

Answer

Allow

Answer

Reset

Question 13

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

Accepted Answer

To define the scope of security policies. Zones are logical groupings of interfaces that allow for the application of security policies to traffic moving between them.

Answer

To segment the network for routing

Answer

To increase bandwidth

Answer

To manage user identities

Question 14

What is the recommended method to update the firewall's threat signatures?

Accepted Answer

Dynamic Updates. Dynamic Updates under Device > Dynamic Updates allows for downloading and installing the latest signature packages.

Answer

Manual firmware upgrade

Answer

App-ID update

Answer

Policy import

Question 15

Which TWO types of NAT are supported in PAN-OS?

Accepted Answer

Source NAT. Source NAT and Destination NAT are the two primary NAT types.

Answer

Global NAT

Answer

Layer 2 NAT

Answer

Application NAT

Question 16

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

Accepted Answer

TCP port 179 is blocked or no route to peer. The 'Active' state in BGP usually indicates the firewall is trying to initiate a TCP connection to the neighbor, but is failing, often due to routing or firewall policy blocking port 179.

Answer

Keepalive timer mismatch

Answer

AS number mismatch

Answer

Router ID is the same

Question 17

What is the effect of changing the HA heartbeat interval?

Accepted Answer

Changes the detection time for peer failures. Changing the heartbeat interval affects how quickly the firewall detects a peer failure; shorter intervals increase sensitivity but also increase the risk of false failovers.

Answer

Disables session preemption

Answer

Changes the synchronization time for configuration

Answer

Changes the speed of the control link

Question 18

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

Accepted Answer

Proxy ID. The Proxy ID configuration in the IKE Gateway/IPsec tunnel settings defines exactly which traffic (source/destination/protocol) is permitted through the tunnel; unmatched traffic is dropped or routed outside the tunnel.

Answer

Re-key interval

Answer

Dead Peer Detection

Answer

IKE Crypto Profile

Question 19

Which TWO issues can prevent BGP from reaching the 'Established' state?

Accepted Answer

Blocked TCP port 179. BGP will not establish if there is a mismatch in AS numbers or if TCP port 179 is blocked.

Answer

Router ID mismatch

Answer

Keepalive timer mismatch

Answer

Area ID mismatch

Question 20

How do you ensure that a specific security policy rule is only active during business hours?

Accepted Answer

Create a Schedule object. The 'Schedule' object allows you to define time-based constraints for policy rules.

Answer

Use a Security Profile

Answer

Use a Dynamic Address Group

Answer

Manually disable it