NGFW-Engineer Practice Test 4 — 10 Questions

Question 1

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Accepted Answer

Configure Agentless User-ID via Server Monitoring. The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Answer

Use IP-to-User static mapping

Answer

Enable GlobalProtect for internal users

Answer

Use the User-ID Agent on a Windows Server

Question 2

Which object type should be used to group multiple IP addresses to simplify security policy management?

Accepted Answer

Address Group. Address Groups allow the grouping of multiple address objects, simplifying policy rules.

Answer

Service Group

Answer

Address Object

Answer

Tag

Question 3

Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?

Accepted Answer

Pan-python. Pan-python is the standard library provided by Palo Alto Networks for interacting with the XML API using Python.

Answer

GlobalProtect API

Answer

ACC (Application Command Center)

Answer

Panorama XML CLI

Question 4

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Accepted Answer

Packet Capture (PCAP). Packet capture and session flow logging are the most granular tools available in PAN-OS.

Answer

System Logs

Answer

URL Filtering Logs

Answer

Threat Logs

Question 5

Which tab in the web interface is used to create and manage security policies?

Accepted Answer

Policies. The 'Policies' tab is where all firewall rule sets are managed.

Answer

Device

Answer

Objects

Answer

Network

Question 6

Which THREE data sources can an NGFW use to dynamically populate address objects?

Accepted Answer

External Dynamic Lists.. EDLs, User-ID mapping, and API-based injection are primary methods.

Answer

Static IP addresses only.

Answer

Manual packet captures.

Question 7

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Accepted Answer

Application. App-ID is enforced when you specify an Application and a Service (or leave it as application-default).

Answer

Profile Group

Answer

Zone

Answer

Action

Question 8

Which tab is used to configure logging settings for a specific security policy?

Accepted Answer

Actions. The 'Actions' tab within the security policy edit window is where logging options are configured.

Answer

General

Answer

Source

Answer

Objects

Question 9

Which feature must be enabled to inspect traffic for threats?

Accepted Answer

Security Profile Group. Security profiles (Vulnerability Protection, Antivirus, etc.) must be attached to security policies to perform threat inspection.

Answer

NAT policy

Answer

Log Forwarding

Answer

App-ID

Question 10

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Accepted Answer

URL Filtering Profile. URL Filtering profiles control access to specific categories of websites.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile