NGFW-Engineer Practice Test 5 — 25 Questions

Question 1

Which object defines the encryption settings for a Site-to-Site VPN?

Accepted Answer

IKE Crypto Profile. The IKE Crypto Profile defines the encryption, hashing, and DH group settings for the IKE negotiation phase.

Answer

Virtual Router

Answer

IPsec Crypto Profile

Answer

Tunnel Interface

Question 2

How does the firewall determine which virtual router to use for a packet?

Accepted Answer

Based on the virtual router assigned to the ingress interface. The firewall uses the virtual router associated with the ingress interface to perform the routing lookup for the packet.

Answer

Based on the zone of the destination interface

Answer

Based on the destination port

Answer

Based on the source IP address

Question 3

Which TWO items must match for an OSPF adjacency to form?

Accepted Answer

Area ID. OSPF requires Area ID and Hello/Dead timers to match to form an adjacency.

Answer

Router Priority

Answer

Interface Speed

Answer

Interface Description

Question 4

Which THREE things must be configured to allow HA between two firewalls?

Accepted Answer

HA data link. HA requires configuration of HA links (control/data), enabling HA in the device settings, and ensuring identical hardware/version.

Answer

Same virtual router configuration

Answer

Different management IP addresses

Question 5

Which TWO components are involved in configuring GlobalProtect?

Accepted Answer

Gateway. GP requires a Portal for distribution and a Gateway for traffic management.

Answer

Management Profile

Answer

Virtual Router

Answer

Aggregate Interface

Question 6

When configuring an interface for DHCP client, where do you set this?

Accepted Answer

Network > Interfaces > [Interface] > IPv4. In the Network > Interfaces > [Interface Name] > IPv4 tab, you can select 'DHCP' for the IP configuration.

Answer

Device > Setup > Management

Answer

Network > DHCP

Answer

Network > Virtual Router

Question 7

What is the purpose of an 'Aggregate Ethernet' interface?

Accepted Answer

Combine interfaces for throughput/redundancy. Aggregate Ethernet (AE) allows you to combine multiple physical interfaces into one logical interface for higher throughput and link redundancy.

Answer

Route traffic to different zones

Answer

Apply security policies to specific VLANs

Answer

Manage HA links

Question 8

Which tab is used to configure physical interface settings like speed and duplex?

Accepted Answer

Network > Interfaces. The Network > Interfaces > Ethernet tab allows you to configure physical settings such as speed and duplex mode.

Answer

Device > Setup

Answer

Policies > Security

Answer

Network > Virtual Routers

Question 9

Which THREE components are involved in a VPN tunnel setup?

Accepted Answer

IKE Gateway. VPNs require IKE gateways, IPsec crypto profiles, and tunnel interfaces.

Answer

GlobalProtect Portal

Answer

Aggregate Ethernet

Question 10

Which THREE items can be used as a 'Source' in a security policy?

Accepted Answer

User. Policies can use addresses, address groups, or users as the source of traffic.

Answer

Virtual Router name

Answer

Interface speed

Question 11

In GlobalProtect, what is the 'Portal' vs. 'Gateway'?

Accepted Answer

Portal distributes config, Gateway handles traffic. The Portal is responsible for distributing the configuration/client software, while the Gateway handles the actual tunnel and traffic enforcement.

Answer

Portal handles traffic, Gateway distributes config

Answer

They are the same thing

Answer

Portal is for internal users only

Question 12

Which TWO conditions can trigger an HA failover?

Accepted Answer

Hardware failure. Failovers can be triggered by hardware failure or by the firewall losing reachability to monitored paths.

Answer

BGP session reset

Answer

Excessive log generation

Answer

Change in management IP

Question 13

Which TWO commands are useful for troubleshooting OSPF?

Accepted Answer

show routing protocol ospf rib. The 'show routing protocol ospf neighbor' and 'show routing protocol ospf rib' commands are essential for debugging OSPF neighbors and learned routes.

Answer

show system processes

Answer

show hardware

Answer

show log routing

Question 14

Why might a static route not be visible in the routing table?

Accepted Answer

Next hop is unreachable. If the next hop is not reachable through an interface associated with the virtual router, the static route is considered invalid and will not be installed in the RIB.

Answer

The firewall is in HA passive mode

Answer

The destination is a public IP

Answer

The route has a high metric

Answer

The interface is in a different zone

Question 15

When configuring a Static Route, what does the 'Metric' field do?

Accepted Answer

Determines route preference. The metric is used to choose between multiple routes to the same destination; a lower metric is preferred over a higher one.

Answer

Defines the interface bandwidth

Answer

Sets the tunnel timeout

Answer

Defines the next hop IP

Question 16

What is the function of a 'Tap' mode interface?

Accepted Answer

Monitor traffic without being inline. Tap mode interfaces allow the firewall to monitor traffic by receiving a copy of the traffic (via a SPAN port), without being inline.

Answer

Route traffic between subnets

Answer

Provide high availability

Answer

Encrypt VPN tunnels

Question 17

Which command confirms that an OSPF neighbor relationship is in the 'Full' state?

Accepted Answer

show routing protocol ospf neighbor. The 'show routing protocol ospf neighbor' command displays the neighbor state, which should be 'Full' for a successfully established OSPF relationship.

Answer

show routing fib

Answer

show interface status

Answer

show system log

Question 18

Which THREE routing protocols can be configured on a PAN-OS virtual router?

Accepted Answer

RIP. PAN-OS supports OSPF, BGP, and RIP as the primary dynamic routing protocols.

Answer

IS-IS

Answer

EIGRP

Question 19

Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?

Accepted Answer

Check firewall System and GlobalProtect logs. Troubleshooting often involves checking the client logs and reviewing the firewall's GlobalProtect logs.

Answer

Change the encryption algorithm

Answer

Reload the firewall firmware

Answer

Restart the management plane

Question 20

Which TWO items must be configured to allow external management access?

Accepted Answer

Management Profile. External management requires an IP on the MGT interface and a Management Profile that permits access (like HTTPS/SSH).

Answer

Tunnel interface

Answer

Security Zone

Answer

Virtual Router