NGFW-Engineer Practice Test 2 — 25 Questions

Question 1

Which file type is required for an External Dynamic List (EDL) to function correctly?

Accepted Answer

Plain text (.txt). EDLs expect raw text files formatted appropriately for the list type, accessible via HTTP/HTTPS.

Answer

Binary (.bin)

Answer

Executable (.exe)

Answer

Encrypted (.zip)

Question 2

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Accepted Answer

Configure an External Dynamic List (EDL). External Dynamic Lists (EDL) allow the firewall to ingest and act upon lists of IPs or URLs from a remote source.

Answer

Create a static address group

Answer

Manually update the blocklist every hour

Answer

Use a Dynamic Address Group based on a registration API

Question 3

Which type of interface is used for connecting to a Layer 3 network?

Accepted Answer

Layer 3. A Layer 3 interface is required for routing traffic between subnets.

Answer

Virtual Wire

Answer

Layer 2

Answer

Aggregate

Question 4

Where do you view the system logs to troubleshoot hardware issues?

Accepted Answer

Monitor > Logs > System. The 'Monitor' tab > 'Logs' > 'System' is the central place to see all system-level events.

Answer

Dashboard

Answer

Device > Setup

Answer

Network > Interfaces

Question 5

Which THREE configuration items are required in the 'init-cfg.txt' file for a VM-Series firewall to join a Panorama server?

Accepted Answer

panorama-server. The Panorama IP, the serial number (or auth code), and the device group are standard parameters.

Answer

proxy-server

Answer

dhcp-client

Question 6

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Accepted Answer

Configure Agentless User-ID via Server Monitoring. The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Answer

Use IP-to-User static mapping

Answer

Enable GlobalProtect for internal users

Answer

Use the User-ID Agent on a Windows Server

Question 7

Which object type should be used to group multiple IP addresses to simplify security policy management?

Accepted Answer

Address Group. Address Groups allow the grouping of multiple address objects, simplifying policy rules.

Answer

Service Group

Answer

Address Object

Answer

Tag

Question 8

Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?

Accepted Answer

Pan-python. Pan-python is the standard library provided by Palo Alto Networks for interacting with the XML API using Python.

Answer

GlobalProtect API

Answer

ACC (Application Command Center)

Answer

Panorama XML CLI

Question 9

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Accepted Answer

Packet Capture (PCAP). Packet capture and session flow logging are the most granular tools available in PAN-OS.

Answer

System Logs

Answer

URL Filtering Logs

Answer

Threat Logs

Question 10

Which tab in the web interface is used to create and manage security policies?

Accepted Answer

Policies. The 'Policies' tab is where all firewall rule sets are managed.

Answer

Device

Answer

Objects

Answer

Network

Question 11

Which THREE data sources can an NGFW use to dynamically populate address objects?

Accepted Answer

External Dynamic Lists.. EDLs, User-ID mapping, and API-based injection are primary methods.

Answer

Static IP addresses only.

Answer

Manual packet captures.

Question 12

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Accepted Answer

Application. App-ID is enforced when you specify an Application and a Service (or leave it as application-default).

Answer

Profile Group

Answer

Zone

Answer

Action

Question 13

Which tab is used to configure logging settings for a specific security policy?

Accepted Answer

Actions. The 'Actions' tab within the security policy edit window is where logging options are configured.

Answer

General

Answer

Source

Answer

Objects

Question 14

Which feature must be enabled to inspect traffic for threats?

Accepted Answer

Security Profile Group. Security profiles (Vulnerability Protection, Antivirus, etc.) must be attached to security policies to perform threat inspection.

Answer

NAT policy

Answer

Log Forwarding

Answer

App-ID

Question 15

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Accepted Answer

URL Filtering Profile. URL Filtering profiles control access to specific categories of websites.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 16

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Accepted Answer

Check if the tunnel interface is in the correct Security Zone. Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.

Answer

Reboot the firewall

Answer

Disable the security policy

Answer

Update the GlobalProtect client version

Question 17

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Accepted Answer

Destination NAT. Destination NAT maps a public IP to an internal private IP, enabling access to internal servers.

Answer

Source NAT

Answer

Static Route

Answer

Security Policy

Question 18

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. PAN-OS supports forwarding almost all log types (Traffic, Threat, System, etc.) to external log collectors.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 19

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. Common actions include 'Allow', 'Deny', 'Drop', 'Reset', and log forwarding configuration.

Answer

DNS Server

Answer

NAT Policy

Question 20

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Accepted Answer

The IKE Gateway configuration has a mismatched Local/Peer ID.. An 'init-passive' state indicates that the firewall is waiting for the peer to initiate the connection, suggesting a mismatch in initiator/responder settings or phase 1 proposal parameters.

Answer

The physical interface is not in the correct zone.

Answer

The security policy is missing a rule for IPsec traffic.

Answer

The tunnel interface is not assigned an IP address.