NGFW-Engineer Practice Test 2 — 30 Questions

Question 1

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Accepted Answer

Configure Agentless User-ID via Server Monitoring. The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Answer

Use IP-to-User static mapping

Answer

Enable GlobalProtect for internal users

Answer

Use the User-ID Agent on a Windows Server

Question 2

Which object type should be used to group multiple IP addresses to simplify security policy management?

Accepted Answer

Address Group. Address Groups allow the grouping of multiple address objects, simplifying policy rules.

Answer

Service Group

Answer

Address Object

Answer

Tag

Question 3

Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?

Accepted Answer

Pan-python. Pan-python is the standard library provided by Palo Alto Networks for interacting with the XML API using Python.

Answer

GlobalProtect API

Answer

ACC (Application Command Center)

Answer

Panorama XML CLI

Question 4

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Accepted Answer

Packet Capture (PCAP). Packet capture and session flow logging are the most granular tools available in PAN-OS.

Answer

System Logs

Answer

URL Filtering Logs

Answer

Threat Logs

Question 5

Which tab in the web interface is used to create and manage security policies?

Accepted Answer

Policies. The 'Policies' tab is where all firewall rule sets are managed.

Answer

Device

Answer

Objects

Answer

Network

Question 6

Which THREE data sources can an NGFW use to dynamically populate address objects?

Accepted Answer

External Dynamic Lists.. EDLs, User-ID mapping, and API-based injection are primary methods.

Answer

Static IP addresses only.

Answer

Manual packet captures.

Question 7

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Accepted Answer

Application. App-ID is enforced when you specify an Application and a Service (or leave it as application-default).

Answer

Profile Group

Answer

Zone

Answer

Action

Question 8

Which tab is used to configure logging settings for a specific security policy?

Accepted Answer

Actions. The 'Actions' tab within the security policy edit window is where logging options are configured.

Answer

General

Answer

Source

Answer

Objects

Question 9

Which feature must be enabled to inspect traffic for threats?

Accepted Answer

Security Profile Group. Security profiles (Vulnerability Protection, Antivirus, etc.) must be attached to security policies to perform threat inspection.

Answer

NAT policy

Answer

Log Forwarding

Answer

App-ID

Question 10

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Accepted Answer

URL Filtering Profile. URL Filtering profiles control access to specific categories of websites.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 11

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Accepted Answer

Check if the tunnel interface is in the correct Security Zone. Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.

Answer

Reboot the firewall

Answer

Disable the security policy

Answer

Update the GlobalProtect client version

Question 12

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Accepted Answer

Destination NAT. Destination NAT maps a public IP to an internal private IP, enabling access to internal servers.

Answer

Source NAT

Answer

Static Route

Answer

Security Policy

Question 13

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. PAN-OS supports forwarding almost all log types (Traffic, Threat, System, etc.) to external log collectors.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 14

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. Common actions include 'Allow', 'Deny', 'Drop', 'Reset', and log forwarding configuration.

Answer

DNS Server

Answer

NAT Policy

Question 15

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Accepted Answer

The IKE Gateway configuration has a mismatched Local/Peer ID.. An 'init-passive' state indicates that the firewall is waiting for the peer to initiate the connection, suggesting a mismatch in initiator/responder settings or phase 1 proposal parameters.

Answer

The physical interface is not in the correct zone.

Answer

The security policy is missing a rule for IPsec traffic.

Answer

The tunnel interface is not assigned an IP address.

Question 16

What is the primary function of a Virtual Router?

Accepted Answer

Maintain the routing table. A Virtual Router maintains the routing table and processes packets based on destination IP, performing route lookups for traffic.

Answer

Provide security inspection

Answer

Manage VPN tunnel encryption

Answer

Store firewall logs

Question 17

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name

Question 18

Which TWO settings are configured in a Virtual Router?

Accepted Answer

Static Routes. Virtual routers handle static routes and dynamic routing protocols (like OSPF/BGP).

Answer

Management Profile

Answer

Tunnel Interface IPs

Answer

Security Zones

Question 19

Which THREE settings are configured in a Layer 3 interface?

Accepted Answer

Virtual Router. L3 interfaces require an IP address, a zone assignment, and an association with a virtual router.

Answer

Aggregate setting

Answer

Management Profile

Question 20

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Accepted Answer

HA synchronization. High Availability (HA) synchronization ensures that configuration changes made on the primary firewall are mirrored to the secondary firewall.

Answer

Manual import/export

Answer

Panorama device groups

Answer

Schedule a daily push from the CLI