NGFW-Engineer Practice Test 4 — 25 Questions

Question 1

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

Accepted Answer

Active/Active uses both firewalls for session processing. Active/Active mode allows both firewalls to process traffic simultaneously and requires link aggregation or specific load balancing, whereas Active/Passive only uses one firewall for traffic.

Answer

Active/Active is only for Layer 2 deployments

Answer

Active/Passive uses both firewalls for session processing

Answer

Active/Passive requires dedicated HA links

Question 2

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

Accepted Answer

Virtual Router. Static routes for tunnel traffic are configured in the Virtual Router associated with the tunnel interface.

Answer

Tunnel Interface settings

Answer

Zone settings

Answer

Security Policy

Question 3

What is a 'Layer 3' interface in PAN-OS?

Accepted Answer

Interface assigned an IP and virtual router. A Layer 3 interface is assigned an IP address and is associated with a virtual router to route traffic based on the routing table.

Answer

Interface bundled for link aggregation

Answer

Interface used only for management

Answer

Interface that passes all traffic without inspection

Question 4

In BGP, what is a 'Route Map' used for?

Accepted Answer

Manipulate BGP attributes. A Route Map is used to filter, modify, or manipulate BGP attributes during the import or export of routes, providing granular control over routing policy.

Answer

Monitor OSPF neighbors

Answer

Configure static route metrics

Answer

Limit the number of peers

Answer

Encrypt BGP sessions

Question 5

Which TWO factors contribute to a successful BGP peer establishment?

Accepted Answer

TCP connectivity on port 179. BGP requires matching Autonomous System numbers and TCP connectivity (port 179) between the peers.

Answer

Matching interface speed

Answer

OSPF adjacency

Answer

Matching router descriptions

Question 6

Which TWO interface types support IP addresses?

Accepted Answer

Layer 3 interface. Layer 3 and Loopback interfaces support IP addresses.

Answer

Aggregate Ethernet (Layer 2)

Answer

Tap interface

Answer

Virtual Wire interface

Question 7

A firewall is experiencing high CPU usage during traffic spikes. You suspect that App-ID is performing too much scanning on internal traffic. Which action should you take to optimize performance while maintaining security?

Accepted Answer

Create an Application Override policy for known trusted internal traffic.. Creating an App-ID override or adjusting security policies to use more specific signatures can reduce unnecessary processing, but creating an Application Filter/Group is the standard method for management; however, using 'Application Override' is the direct way to bypass App-ID for known, trusted traffic.

Answer

Increase the packet buffer size in Device > Setup.

Answer

Disable the Content-ID engine globally.

Answer

Enable 'Strict' mode in the App-ID engine.

Question 8

Which object type is required to enable GlobalProtect access for remote users?

Accepted Answer

GlobalProtect Gateway. The GlobalProtect Gateway is the entity that terminates the VPN tunnel and applies security policies to remote users.

Answer

GlobalProtect Zone

Answer

GlobalProtect Router

Answer

GlobalProtect Interface

Question 9

What is the purpose of 'Path Monitoring' in HA?

Accepted Answer

Monitor reachability of critical resources. Path Monitoring allows the firewall to monitor reachability to critical network resources (like a gateway or server); if the path fails, the firewall can trigger an HA failover.

Answer

Monitor link state of the peer

Answer

Monitor VPN tunnel state

Answer

Monitor traffic volume

Question 10

How do you delete a security policy rule?

Accepted Answer

Policies > Security > Delete. In the Policies > Security tab, select the rule and click the 'Delete' button at the bottom of the page.

Answer

Network > Zones > Delete

Answer

Device > Setup > Delete

Answer

Right-click the rule and 'Remove'

Question 11

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Accepted Answer

Root CA Certificate. SSL decryption requires a root CA certificate, a profile, and the activation of decryption on the policy.

Answer

App-ID

Answer

User-ID

Question 12

Which TWO items can be configured in a Virtual Router?

Accepted Answer

Dynamic Routing Protocols (BGP/OSPF). Virtual routers handle routing table lookups, static routes, and dynamic routing protocols (OSPF/BGP).

Answer

SSL Decryption

Answer

URL Filtering

Answer

DHCP Server

Question 13

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Accepted Answer

RADIUS. RADIUS and LDAP are standard industry protocols used for VPN authentication.

Answer

SNMP

Answer

DHCP

Answer

NTP

Question 14

Which THREE features are associated with Threat Prevention?

Accepted Answer

Anti-Spyware. Threat prevention includes Antivirus, Anti-Spyware, and Vulnerability Protection profiles.

Answer

Data Filtering

Answer

URL Filtering

Question 15

Which interface type is used to manage the firewall over the network?

Accepted Answer

Management interface. The Management interface (MGT) is the dedicated port for out-of-band management of the PAN-OS firewall.

Answer

Aggregate Ethernet interface

Answer

Tunnel interface

Answer

Loopback interface

Question 16

What is the benefit of using a Loopback interface for a GlobalProtect portal?

Accepted Answer

Provides a stable IP address. A loopback interface provides a stable IP address that does not depend on the status of a physical link, ensuring the portal remains reachable even if a physical interface flaps.

Answer

Automatically encrypts traffic

Answer

Filters traffic based on source

Answer

Increases throughput for VPN users

Question 17

Where do you configure the 'Heartbeat' interval for HA?

Accepted Answer

Device > High Availability > General. The heartbeat interval is configured in the HA > General > Election Settings or Heartbeat settings depending on the specific PAN-OS version and HA mode.

Answer

Device > Setup > Management

Answer

Network > Virtual Routers

Answer

Network > Interfaces > HA

Question 18

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

Accepted Answer

Assign the sub-interface to a security zone. Interfaces must be assigned to a security zone before they can be referenced in a security policy.

Answer

Add the sub-interface to the default zone

Answer

Configure the sub-interface as a loopback

Answer

Enable DHCP server on the sub-interface

Question 19

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

Accepted Answer

Local Database. Administrators can authenticate using local database accounts or external services like RADIUS or TACACS+.

Answer

DNS

Answer

DHCP

Answer

NTP

Question 20

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

Accepted Answer

Network > Interfaces > Tunnel. Tunnel interfaces act as logical points for VPN traffic and are assigned IP addresses in the Network > Interfaces > Tunnel tab.

Answer

Network > Zones

Answer

Network > GlobalProtect > Gateways

Answer

Network > Virtual Routers