NGFW-Engineer Practice Test 2 — 30 Questions

Question 1

An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?

Accepted Answer

GET /restapi/v10.0/Policies/SecurityRules?location=shared. The PAN-OS REST API uses the 'location' query parameter to specify the scope for policy retrieval. For shared policies, the value is 'shared'. The correct HTTP method is GET, as it is used to retrieve data without modifying it. Other methods or parameters would not correctly return the desired list of security rules.

Answer

GET /restapi/v10.0/Policies/SecurityRules?type=shared

Answer

POST /restapi/v10.0/Policies/SecurityRules with a JSON body specifying 'location': 'shared'

Answer

GET /restapi/v10.0/Policies/SecurityRules/Shared

Question 2

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Accepted Answer

Create a log forwarding profile and apply it to the security policy that matches the desired traffic.. To forward logs from a specific security policy, you create a log forwarding profile and attach it to that security policy. This ensures only logs from that policy are sent. Other methods like assigning to management interface or zones are incorrect because log forwarding is policy-specific.

Answer

Configure a syslog server profile and assign it to the management interface.

Answer

Use a log filter in the syslog server profile to exclude logs from other policies.

Answer

Create a log forwarding profile and apply it to the security zone where the traffic originates.

Question 3

A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?

Accepted Answer

init-cfg.txt. For VM-Series firewalls, the init-cfg.txt file is the correct bootstrap configuration file. It includes parameters like panorama-server and auth-key that enable automatic registration with Panorama. Other filenames are not recognized by the bootstrap process, so they would not achieve the desired automatic connection.

Answer

bootstrap.xml

Answer

auth-key.txt

Answer

panorama-config.txt

Question 4

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

Accepted Answer

Source NAT with dynamic IP and port (PAT) using the interface address.. The branch requires that all outbound traffic from the internal subnet appears to come from a single public IP. Source NAT with dynamic IP and port, using the interface address, translates both source IP and port, enabling many-to-one translation. This is the standard method for sharing one public IP among many internal hosts while preserving return path routing via the firewall's session table.

Answer

Source NAT with static IP mapping to a one-to-one public address.

Answer

Destination NAT with dynamic IP and port using the interface address for inbound traffic.

Answer

Destination NAT with a static IP mapping to the internal server.

Question 5

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Accepted Answer

Policies > Security. Security policy rules are created under Policies > Security. This tab allows you to specify match criteria such as zones, addresses, and applications, and to set actions like allow or deny. It is also where you attach security profiles for inspection. The other tabs serve different purposes: NAT for address translation, Zones for zone definition, and Applications for custom app signatures.

Answer

Network > Zones

Answer

Policies > NAT

Answer

Objects > Applications

Question 6

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

Accepted Answer

Configure a Path Monitoring profile on the primary default route.. Path Monitoring on a static route allows the firewall to periodically ping a specified IP address through that route. If the pings fail, the route is withdrawn, and the backup route takes over. This provides automatic failover for static routes, which is necessary when not using dynamic routing protocols.

Answer

Enable OSPF on both ISP interfaces and configure equal-cost multipath.

Answer

Set the backup default route with a higher administrative distance than the primary.

Answer

Configure a static route with a lower metric on the backup ISP and enable BFD.

Question 7

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Accepted Answer

Configure a Path Monitoring profile on the default route for the primary ISP.. Path Monitoring on a static default route enables the firewall to track reachability of a target IP. If the target is unreachable through the primary ISP, the route is withdrawn, and the secondary route becomes active. This provides automatic failover. The other options either require dynamic routing, manual intervention, or do not address link failure detection.

Answer

Enable OSPF on the ISP-facing interfaces to dynamically learn routes.

Answer

Set the secondary ISP interface to a lower administrative distance than the primary.

Answer

Configure a Policy-Based Forwarding (PBF) rule to redirect traffic to the secondary ISP.

Question 8

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

Accepted Answer

MTU mismatch on the interfaces. The EXSTART state in OSPF is part of the database exchange process where routers negotiate master/slave roles. If the Maximum Transmission Unit (MTU) on the interfaces does not match, the routers cannot successfully exchange database description packets, and the adjacency remains stuck in EXSTART. Checking MTU settings is a key troubleshooting step for this issue. Area mismatches, hello interval mismatches, and duplicate router IDs would cause different neighbor states.

Answer

Mismatched OSPF area IDs

Answer

Duplicate router IDs

Answer

Incorrect OSPF hello interval

Question 9

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

Accepted Answer

Some websites are excluded from decryption by a no-decrypt policy or are in a predefined category that is not decrypted.. Decryption exclusions, whether by predefined categories or custom no-decrypt policies, prevent the firewall from decrypting certain traffic. This results in some websites not being decrypted. Certificate errors on other sites may be due to certificate pinning. The correct answer identifies the selective exclusion as the cause for non-decryption.

Answer

The decryption policy is not matching because the SSL traffic is using a non-standard port.

Answer

The forward trust certificate is not installed on the firewall.

Answer

The decryption profile is set to block sessions with untrusted issuers, causing the firewall to bypass decryption.

Question 10

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name

Question 11

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

Accepted Answer

Configure a static route to 0.0.0.0/0 and ensure it is active in the virtual router.. To advertise a static default route into OSPF on a Palo Alto Networks firewall, you must first ensure the static default route exists and is active in the virtual router. Then, you need to create a redistribution profile that matches the default route and apply it as an export rule in the OSPF configuration. This two-step process ensures that the default route is injected into OSPF and propagated to neighbors. Without both steps, the default route will not be advertised.

Answer

Enable 'Default Information Originate' in the OSPF global settings.

Answer

Enable 'Advertise Default Route' in the OSPF area configuration.

Answer

Set the OSPF router priority to a non-zero value to allow default route propagation.

Question 12

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

Accepted Answer

Destination NAT with port translation (PAT). Destination NAT with port translation enables the firewall to use the destination port to distinguish between multiple internal servers that share a single public IP address. This is the standard method for conserving public addresses while hosting several services. The other NAT types either do not consider the destination port or are meant for outbound or internal hairpin traffic, not inbound service publishing.

Answer

Source NAT with dynamic IP and port

Answer

Destination NAT with a static IP mapping

Answer

U-Turn NAT with a static route

Question 13

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

Accepted Answer

Management interface. The dedicated management interface is designed for out-of-band management, providing isolation from data traffic. It has its own IP address and is in a separate zone, ensuring that management access is not mixed with data plane traffic. This meets the requirement for isolation and secure management.

Answer

Layer 2 interface

Answer

Layer 3 interface

Answer

Virtual wire interface

Question 14

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

Accepted Answer

Assign all three interfaces (GigabitEthernet1/1, GigabitEthernet1/2, and the tunnel interface) to a single virtual router, and place each interface in its own zone.. A single virtual router in PAN-OS can contain multiple Layer 3 interfaces, including physical and tunnel interfaces, and will route traffic between them based on its routing table. Assigning each interface to its own zone allows granular security policies. This design efficiently routes between internal, guest, and tunnel networks without the complexity of multiple virtual routers.

Answer

Configure all interfaces as Layer 2 and use VLANs to segment the networks, then route between VLANs using a Layer 3 subinterface.

Answer

Create three separate virtual routers, one for each network, and configure static routes between them.

Answer

Use policy-based forwarding to direct traffic between the networks, and assign each interface to a different virtual router.

Question 15

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

Accepted Answer

Configure the subinterface with the appropriate VLAN tag and assign it to a Layer 3 security zone.. A Layer 3 subinterface must be associated with a VLAN tag to correctly identify and process the tagged guest traffic on the physical interface. It also must be placed in a Layer 3 security zone so that security policy and routing can be applied to that traffic. Without both the tag and zone assignment, the firewall cannot enforce policy or route the guest network.

Answer

Set the parent interface to Layer 2 mode and create a VLAN interface for the guest network.

Answer

Enable jumbo frames on the parent interface to accommodate the additional VLAN header.

Answer

Create a VLAN object under Network > VLANs and assign it to the subinterface.

Question 16

A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?

Accepted Answer

On the tunnel interface itself under Network > Interfaces > Tunnel > IPv4.. The correct answer is to configure the tunnel interface IP address on the tunnel interface under Network > Interfaces > Tunnel > IPv4. In PAN-OS, a tunnel interface is a logical interface that must be assigned an IP address to route traffic through the VPN. This address is separate from the IKE and IPsec configurations, which handle authentication and encryption.

Answer

In the IKE Gateway configuration under Network > Interfaces > Tunnel.

Answer

In the IPsec Crypto Profile under Network > Interfaces > Tunnel.

Answer

In the VPN tunnel configuration under Network > IPSec Tunnels > Proxy IDs.

Question 17

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

Accepted Answer

Enable DHCP server on the Layer 3 interface and configure an IP pool with the desired range.. To configure the firewall as a DHCP server, you must enable DHCP server on the Layer 3 interface and define an IP pool with the desired range. Additionally, you must set lease time and DNS server settings within the DHCP server configuration to meet the specific requirements. These two steps are essential for the firewall to provide IP addresses and network parameters to clients.

Answer

Configure a DHCP relay agent to forward requests to an external DHCP server.

Answer

Create a security policy allowing DHCP traffic from the guest zone to the firewall's management interface.

Answer

Assign a static IP address to the guest client devices manually.

Question 18

An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?

Accepted Answer

Set the OSPF priority on ethernet1/1 to a value higher than other routers on that network.. In OSPF, the DR is elected based on the highest priority. To make the firewall the DR on a specific network, you must set its OSPF priority on that interface to a value higher than any other router on the same network. The default priority is 1, so setting it to a higher number (e.g., 2 or more) ensures the firewall wins the election, assuming other routers have lower priorities.

Answer

Set the OSPF network type to point-to-point on ethernet1/1.

Answer

Enable OSPF on ethernet1/2 only and set it as passive.

Answer

Configure a higher router ID on the firewall than other routers.

Question 19

An administrator needs to quickly identify if an API call was successful from the firewall side. Which log should be reviewed?

Accepted Answer

System logs. The 'System' logs contain entries for web interface and API interactions.

Answer

Traffic logs

Answer

Threat logs

Answer

URL logs

Question 20

Which object type should be used to group multiple IP addresses to simplify security policy management?

Accepted Answer

Address Group. Address Groups allow the grouping of multiple address objects, simplifying policy rules.

Answer

Service Group

Answer

Address Object

Answer

Tag