NGFW-Engineer Practice Test 3 — 30 Questions

Question 1

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Accepted Answer

Source IP address. When configuring a Service Route, the firewall needs to know which source IP address to use for the traffic, so option B (Source IP address) is correct because it defines the source address that will be used for the service's outbound traffic. Option C (Source Interface) is also correct because the Service Route must specify the interface through which the service traffic will egress, ensuring the firewall uses that specific interface for external traffic. Option A (Destination MAC address) is not required because Service Routes operate at Layer 3 and do not need a destination MAC address. Option D (Default Gateway) is not a Service Route setting; routing is handled separately by the virtual router's default route. Option E (VLAN Tag) is not part of Service Route configuration; VLAN tagging is configured on the interface or subinterface, not in the Service Route itself.

Answer

Destination MAC address

Answer

Default Gateway

Answer

VLAN Tag

Question 2

What is the purpose of an 'Aggregate Ethernet' interface?

Accepted Answer

Combine interfaces for throughput/redundancy. Aggregate Ethernet (AE) allows you to combine multiple physical interfaces into one logical interface for higher throughput and link redundancy.

Answer

Route traffic to different zones

Answer

Apply security policies to specific VLANs

Answer

Manage HA links

Question 3

In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?

Accepted Answer

/config/bootstrap/. The VM-Series looks for a specific directory structure on the attached storage device, starting with '/config/bootstrap/'.

Answer

/var/bootstrap/

Answer

/etc/bootstrap/

Answer

/opt/paloalto/

Question 4

An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?

Accepted Answer

The 'commit()' method was not called.. The script modifies the candidate configuration; a 'commit' must be performed to push those changes to the running configuration.

Answer

The object is hidden in the GUI.

Answer

The API key has insufficient scope.

Answer

The object was not defined as a constant.

Question 5

You need to automate the retrieval of URL filtering logs from the firewall. Which API endpoint type is used to execute a 'show' command?

Accepted Answer

type=op. The 'op' type is used to execute operational commands, including 'show' commands to retrieve logs or status.

Answer

type=show

Answer

type=log

Answer

type=config

Question 6

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

Accepted Answer

Action. The 'Action' column in the security policy rule dictates whether traffic matching the rule is allowed, dropped, or reset.

Answer

Service

Answer

Source

Answer

Application

Question 7

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

Accepted Answer

The firewall interface address for VPN. The Local IP is the interface IP address on the firewall that will initiate or receive the VPN connection.

Answer

The virtual router IP

Answer

The internal network IP address

Answer

The client machine's IP

Question 8

You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?

Accepted Answer

Plain text. EDLs must be text files containing entries separated by newlines, with specific formatting depending on the type (IP, Domain, or URL).

Answer

JSON

Answer

XML

Answer

CSV

Question 9

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

Accepted Answer

Verify that the User-ID agent is configured to monitor the correct Domain Controller and that the firewall's User-ID agent settings include the correct source IP for the agent.. When User-ID agent connectivity is established but user mappings are missing, the most likely causes are incorrect Domain Controller monitoring or incorrect agent source IP configuration on the firewall. Verifying that the agent monitors the right Domain Controller and that the firewall recognizes the agent's IP ensures that user mapping data is correctly received and processed.

Answer

Verify that the security policy includes a rule allowing traffic from the User-ID agent to the firewall's management interface.

Answer

Ensure that the LDAP server profile uses port 389 for LDAP over SSL.

Answer

Check that the firewall's management interface has a default gateway configured.

Question 10

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Accepted Answer

In the management interface settings, set Permitted IP Addresses to 10.10.10.0/24 and disable all management services except HTTPS.. To restrict management access to a specific subnet and enable only HTTPS, the engineer must configure the management interface's Permitted IP Addresses to the desired subnet and disable all other management services except HTTPS. This ensures that only hosts from the allowed subnet can reach the management interface using the secure protocol. This is a standard device setting configuration on Palo Alto Networks firewalls.

Answer

Configure a security policy from the trust zone to the management zone allowing only 10.10.10.0/24 to the management IP on port 443, and set the management interface to use only HTTPS.

Answer

Create a Management Interface Profile that permits only 10.10.10.0/24 and enable only HTTPS, then apply it to the management interface.

Answer

Create a NAT policy that translates the management IP to a public IP and restrict access using a security policy from the untrust zone.

Question 11

Which TWO actions are required to successfully integrate a new External Dynamic List (EDL)?

Accepted Answer

Configure the refresh interval.. You must define the source URL and set the update frequency in the EDL object.

Answer

Install an SSL certificate for the list source.

Answer

Enable threat prevention logs.

Answer

Restart the firewall.

Question 12

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

Accepted Answer

To define the scope of security policies. Zones are logical groupings of interfaces that allow for the application of security policies to traffic moving between them.

Answer

To segment the network for routing

Answer

To increase bandwidth

Answer

To manage user identities

Question 13

When configuring HA, what is 'Preemption'?

Accepted Answer

Automatically switches active role to the preferred device. Preemption allows the preferred (usually higher-priority) device to automatically take over as the active firewall when it recovers from a failure.

Answer

Resets the sessions during failover

Answer

Forces the passive node to sync faster

Answer

Blocks traffic during failover

Question 14

When utilizing the Panorama plugin for AWS, what is the primary benefit of the 'S3 bucket' integration for log ingestion?

Accepted Answer

It provides a scalable destination for log archival and external analysis.. The S3 integration allows the firewall to offload logs to cloud storage, providing long-term retention and cost-effective storage for compliance without requiring local disk expansion.

Answer

It enables real-time packet inspection of S3 traffic.

Answer

It automatically updates the device's software version.

Answer

It acts as a primary firewall policy source.

Question 15

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

Accepted Answer

Assign the sub-interface to a security zone. Interfaces must be assigned to a security zone before they can be referenced in a security policy.

Answer

Add the sub-interface to the default zone

Answer

Configure the sub-interface as a loopback

Answer

Enable DHCP server on the sub-interface

Question 16

What is the default port for the Panorama XML API?

Accepted Answer

443. The XML API operates over the standard HTTPS port, 443.

Answer

80

Answer

22

Answer

8080

Question 17

A network engineer is configuring a site-to-site VPN between two PA-5220 firewalls. The engineer wants to ensure that if the primary ISP link fails, the VPN tunnel automatically re-establishes over a backup ISP link without manual intervention. Both firewalls have two ISP connections and the VPN is configured with a tunnel interface. Which PAN-OS feature should the engineer configure to achieve this?

Accepted Answer

Dead Peer Detection (DPD) with a short interval and a secondary peer IP address in the IKE Gateway configuration.. The correct answer is DPD with a secondary peer IP. DPD monitors the peer's availability; when the primary link fails, DPD detects the dead peer and initiates renegotiation. By specifying a secondary peer IP (the backup ISP address of the remote firewall) in the IKE Gateway, the local firewall can attempt to establish the tunnel over the backup link automatically. This combination provides seamless failover without manual intervention.

Answer

Policy-Based Forwarding (PBF) with a rule that redirects VPN traffic to the backup ISP.

Answer

Virtual Router Redundancy Protocol (VRRP) between the two ISP links to provide a virtual IP that the VPN uses.

Answer

Quality of Service (QoS) profiles to prioritize VPN traffic on the primary link.

Question 18

Which file type is required for an External Dynamic List (EDL) to function correctly?

Accepted Answer

Plain text (.txt). EDLs expect raw text files formatted appropriately for the list type, accessible via HTTP/HTTPS.

Answer

Binary (.bin)

Answer

Executable (.exe)

Answer

Encrypted (.zip)

Question 19

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Accepted Answer

Heartbeat link synchronization. The heartbeat interfaces and HA control links synchronize configuration and session state, ensuring the passive unit is ready for a seamless transition.

Answer

BGP peer failover

Answer

ARP cache clearing

Answer

GlobalProtect gateway synchronization

Question 20

Which THREE configuration items are required in the 'init-cfg.txt' file for a VM-Series firewall to join a Panorama server?

Accepted Answer

panorama-server. The Panorama IP, the serial number (or auth code), and the device group are standard parameters.

Answer

proxy-server

Answer

dhcp-client