NGFW-Engineer Practice Test 2 — 25 Questions

Question 1

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Generate an API key on Panorama using an admin account with sufficient privileges.. To automate policy deployment with Panorama, first generate an API key for authentication. Then, after modifying the candidate configuration on Panorama, use the 'commit-all' action to push the changes to the managed firewalls. This ensures the policies are applied to the devices.

Answer

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Answer

Use the 'validate' action to ensure the configuration is valid before committing.

Answer

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Question 2

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Accepted Answer

Include the config and set elements in the API request.. To activate a new security rule created via the XML API, the script must first ensure the rule is added to the candidate configuration by including 'type=config' and 'action=set' in the request. Then, a separate commit request with 'action=commit' is required to push the candidate configuration to the running configuration. Without both steps, the rule will not take effect.

Answer

Use the <key> element to provide the API key for authentication.

Answer

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Answer

Include the <vsys> element to specify the virtual system for the rule.

Question 3

A company uses a SOAR platform to enrich and block indicators of compromise. The SOAR playbook must add malicious IP addresses to an External Dynamic List (EDL) hosted on an internal web server that the firewall already consumes. Which action should the playbook take?

Accepted Answer

Update the file on the internal web server that the firewall retrieves as the EDL source.. External Dynamic Lists are designed for exactly this use case: a firewall retrieves a list from an HTTP or HTTPS URL on a refresh interval, and any change to the source file is picked up automatically without a commit. A SOAR playbook can simply append or rewrite the file on the internal web server, and the firewall will enforce the new indicators after its next refresh. This keeps policy static and indicator management dynamic.

Answer

Use the SOAR platform to push a new security policy rule directly to the firewall for each malicious IP.

Answer

Configure the SOAR platform as a syslog target and send the IPs as log entries for the firewall to parse.

Answer

Call the firewall XML API to create a new address object for each IP and add it to a security policy rule.

Question 4

A security engineer is using the PAN-OS XML API to update the description of an existing address object named 'WebServer' in the 'Shared' location. The API request is sent with the correct API key and the following XPath: /config/shared/address/entry[@name='WebServer']. The server responds with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account used to generate the API key lacks write permission for the 'Shared' location.. The 403 Forbidden response indicates an authorization failure. Even with a valid API key, the admin account's role must have write permission for the target location. In this case, the 'Shared' location requires sufficient privileges to modify address objects. Checking the admin role's permissions and ensuring it includes write access to the relevant configuration area resolves the issue.

Answer

The API request is missing the required 'type=config' parameter.

Answer

The XPath is malformed and does not match any existing object.

Answer

The API key is invalid or expired.

Question 5

An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?

Accepted Answer

Another administrator or automation process changed the candidate configuration between the script's edit and its commit, and the commit included that other change.. The candidate configuration is shared among management sessions, and the commit operation commits whatever is in the candidate at the moment it runs. Without acquiring a config lock, a script's edit can be interleaved with changes from another session, and the subsequent commit will include those other changes. Locking the candidate before editing and releasing it after committing prevents this race condition.

Answer

The firewall rejected the edit because the rule name already existed and the API returned a success code while ignoring the change.

Answer

The edit request was applied to the running configuration instead of the candidate configuration.

Answer

The commit endpoint requires an API key with superuser role, and the script's key lacks the necessary permission, so the commit silently reverted the change.

Question 6

An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?

Accepted Answer

GET /restapi/v10.0/Policies/SecurityRules?location=shared. The PAN-OS REST API uses the 'location' query parameter to specify the scope for policy retrieval. For shared policies, the value is 'shared'. The correct HTTP method is GET, as it is used to retrieve data without modifying it. Other methods or parameters would not correctly return the desired list of security rules.

Answer

GET /restapi/v10.0/Policies/SecurityRules?type=shared

Answer

POST /restapi/v10.0/Policies/SecurityRules with a JSON body specifying 'location': 'shared'

Answer

GET /restapi/v10.0/Policies/SecurityRules/Shared

Question 7

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Accepted Answer

Create a log forwarding profile and apply it to the security policy that matches the desired traffic.. To forward logs from a specific security policy, you create a log forwarding profile and attach it to that security policy. This ensures only logs from that policy are sent. Other methods like assigning to management interface or zones are incorrect because log forwarding is policy-specific.

Answer

Configure a syslog server profile and assign it to the management interface.

Answer

Use a log filter in the syslog server profile to exclude logs from other policies.

Answer

Create a log forwarding profile and apply it to the security zone where the traffic originates.

Question 8

A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?

Accepted Answer

init-cfg.txt. For VM-Series firewalls, the init-cfg.txt file is the correct bootstrap configuration file. It includes parameters like panorama-server and auth-key that enable automatic registration with Panorama. Other filenames are not recognized by the bootstrap process, so they would not achieve the desired automatic connection.

Answer

bootstrap.xml

Answer

auth-key.txt

Answer

panorama-config.txt

Question 9

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

Accepted Answer

Source NAT with dynamic IP and port (PAT) using the interface address.. The branch requires that all outbound traffic from the internal subnet appears to come from a single public IP. Source NAT with dynamic IP and port, using the interface address, translates both source IP and port, enabling many-to-one translation. This is the standard method for sharing one public IP among many internal hosts while preserving return path routing via the firewall's session table.

Answer

Source NAT with static IP mapping to a one-to-one public address.

Answer

Destination NAT with dynamic IP and port using the interface address for inbound traffic.

Answer

Destination NAT with a static IP mapping to the internal server.

Question 10

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Accepted Answer

Policies > Security. Security policy rules are created under Policies > Security. This tab allows you to specify match criteria such as zones, addresses, and applications, and to set actions like allow or deny. It is also where you attach security profiles for inspection. The other tabs serve different purposes: NAT for address translation, Zones for zone definition, and Applications for custom app signatures.

Answer

Network > Zones

Answer

Policies > NAT

Answer

Objects > Applications

Question 11

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

Accepted Answer

Configure a Path Monitoring profile on the primary default route.. Path Monitoring on a static route allows the firewall to periodically ping a specified IP address through that route. If the pings fail, the route is withdrawn, and the backup route takes over. This provides automatic failover for static routes, which is necessary when not using dynamic routing protocols.

Answer

Enable OSPF on both ISP interfaces and configure equal-cost multipath.

Answer

Set the backup default route with a higher administrative distance than the primary.

Answer

Configure a static route with a lower metric on the backup ISP and enable BFD.

Question 12

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Accepted Answer

Configure a Path Monitoring profile on the default route for the primary ISP.. Path Monitoring on a static default route enables the firewall to track reachability of a target IP. If the target is unreachable through the primary ISP, the route is withdrawn, and the secondary route becomes active. This provides automatic failover. The other options either require dynamic routing, manual intervention, or do not address link failure detection.

Answer

Enable OSPF on the ISP-facing interfaces to dynamically learn routes.

Answer

Set the secondary ISP interface to a lower administrative distance than the primary.

Answer

Configure a Policy-Based Forwarding (PBF) rule to redirect traffic to the secondary ISP.

Question 13

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

Accepted Answer

MTU mismatch on the interfaces. The EXSTART state in OSPF is part of the database exchange process where routers negotiate master/slave roles. If the Maximum Transmission Unit (MTU) on the interfaces does not match, the routers cannot successfully exchange database description packets, and the adjacency remains stuck in EXSTART. Checking MTU settings is a key troubleshooting step for this issue. Area mismatches, hello interval mismatches, and duplicate router IDs would cause different neighbor states.

Answer

Mismatched OSPF area IDs

Answer

Duplicate router IDs

Answer

Incorrect OSPF hello interval

Question 14

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

Accepted Answer

Some websites are excluded from decryption by a no-decrypt policy or are in a predefined category that is not decrypted.. Decryption exclusions, whether by predefined categories or custom no-decrypt policies, prevent the firewall from decrypting certain traffic. This results in some websites not being decrypted. Certificate errors on other sites may be due to certificate pinning. The correct answer identifies the selective exclusion as the cause for non-decryption.

Answer

The decryption policy is not matching because the SSL traffic is using a non-standard port.

Answer

The forward trust certificate is not installed on the firewall.

Answer

The decryption profile is set to block sessions with untrusted issuers, causing the firewall to bypass decryption.

Question 15

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name

Question 16

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

Accepted Answer

Configure a static route to 0.0.0.0/0 and ensure it is active in the virtual router.. To advertise a static default route into OSPF on a Palo Alto Networks firewall, you must first ensure the static default route exists and is active in the virtual router. Then, you need to create a redistribution profile that matches the default route and apply it as an export rule in the OSPF configuration. This two-step process ensures that the default route is injected into OSPF and propagated to neighbors. Without both steps, the default route will not be advertised.

Answer

Enable 'Default Information Originate' in the OSPF global settings.

Answer

Enable 'Advertise Default Route' in the OSPF area configuration.

Answer

Set the OSPF router priority to a non-zero value to allow default route propagation.

Question 17

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

Accepted Answer

Destination NAT with port translation (PAT). Destination NAT with port translation enables the firewall to use the destination port to distinguish between multiple internal servers that share a single public IP address. This is the standard method for conserving public addresses while hosting several services. The other NAT types either do not consider the destination port or are meant for outbound or internal hairpin traffic, not inbound service publishing.

Answer

Source NAT with dynamic IP and port

Answer

Destination NAT with a static IP mapping

Answer

U-Turn NAT with a static route

Question 18

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

Accepted Answer

Management interface. The dedicated management interface is designed for out-of-band management, providing isolation from data traffic. It has its own IP address and is in a separate zone, ensuring that management access is not mixed with data plane traffic. This meets the requirement for isolation and secure management.

Answer

Layer 2 interface

Answer

Layer 3 interface

Answer

Virtual wire interface

Question 19

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

Accepted Answer

Assign all three interfaces (GigabitEthernet1/1, GigabitEthernet1/2, and the tunnel interface) to a single virtual router, and place each interface in its own zone.. A single virtual router in PAN-OS can contain multiple Layer 3 interfaces, including physical and tunnel interfaces, and will route traffic between them based on its routing table. Assigning each interface to its own zone allows granular security policies. This design efficiently routes between internal, guest, and tunnel networks without the complexity of multiple virtual routers.

Answer

Configure all interfaces as Layer 2 and use VLANs to segment the networks, then route between VLANs using a Layer 3 subinterface.

Answer

Create three separate virtual routers, one for each network, and configure static routes between them.

Answer

Use policy-based forwarding to direct traffic between the networks, and assign each interface to a different virtual router.

Question 20

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

Accepted Answer

Configure the subinterface with the appropriate VLAN tag and assign it to a Layer 3 security zone.. A Layer 3 subinterface must be associated with a VLAN tag to correctly identify and process the tagged guest traffic on the physical interface. It also must be placed in a Layer 3 security zone so that security policy and routing can be applied to that traffic. Without both the tag and zone assignment, the firewall cannot enforce policy or route the guest network.

Answer

Set the parent interface to Layer 2 mode and create a VLAN interface for the guest network.

Answer

Enable jumbo frames on the parent interface to accommodate the additional VLAN header.

Answer

Create a VLAN object under Network > VLANs and assign it to the subinterface.