NGFW-Engineer Practice Test 4 — 10 Questions

Question 1

An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?

Accepted Answer

GET /restapi/v10.0/Policies/SecurityRules?location=shared. The PAN-OS REST API uses the 'location' query parameter to specify the scope for policy retrieval. For shared policies, the value is 'shared'. The correct HTTP method is GET, as it is used to retrieve data without modifying it. Other methods or parameters would not correctly return the desired list of security rules.

Answer

GET /restapi/v10.0/Policies/SecurityRules?type=shared

Answer

POST /restapi/v10.0/Policies/SecurityRules with a JSON body specifying 'location': 'shared'

Answer

GET /restapi/v10.0/Policies/SecurityRules/Shared

Question 2

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Accepted Answer

Create a log forwarding profile and apply it to the security policy that matches the desired traffic.. To forward logs from a specific security policy, you create a log forwarding profile and attach it to that security policy. This ensures only logs from that policy are sent. Other methods like assigning to management interface or zones are incorrect because log forwarding is policy-specific.

Answer

Configure a syslog server profile and assign it to the management interface.

Answer

Use a log filter in the syslog server profile to exclude logs from other policies.

Answer

Create a log forwarding profile and apply it to the security zone where the traffic originates.

Question 3

A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?

Accepted Answer

init-cfg.txt. For VM-Series firewalls, the init-cfg.txt file is the correct bootstrap configuration file. It includes parameters like panorama-server and auth-key that enable automatic registration with Panorama. Other filenames are not recognized by the bootstrap process, so they would not achieve the desired automatic connection.

Answer

bootstrap.xml

Answer

auth-key.txt

Answer

panorama-config.txt

Question 4

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

Accepted Answer

Source NAT with dynamic IP and port (PAT) using the interface address.. The branch requires that all outbound traffic from the internal subnet appears to come from a single public IP. Source NAT with dynamic IP and port, using the interface address, translates both source IP and port, enabling many-to-one translation. This is the standard method for sharing one public IP among many internal hosts while preserving return path routing via the firewall's session table.

Answer

Source NAT with static IP mapping to a one-to-one public address.

Answer

Destination NAT with dynamic IP and port using the interface address for inbound traffic.

Answer

Destination NAT with a static IP mapping to the internal server.

Question 5

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Accepted Answer

Policies > Security. Security policy rules are created under Policies > Security. This tab allows you to specify match criteria such as zones, addresses, and applications, and to set actions like allow or deny. It is also where you attach security profiles for inspection. The other tabs serve different purposes: NAT for address translation, Zones for zone definition, and Applications for custom app signatures.

Answer

Network > Zones

Answer

Policies > NAT

Answer

Objects > Applications

Question 6

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

Accepted Answer

Configure a Path Monitoring profile on the primary default route.. Path Monitoring on a static route allows the firewall to periodically ping a specified IP address through that route. If the pings fail, the route is withdrawn, and the backup route takes over. This provides automatic failover for static routes, which is necessary when not using dynamic routing protocols.

Answer

Enable OSPF on both ISP interfaces and configure equal-cost multipath.

Answer

Set the backup default route with a higher administrative distance than the primary.

Answer

Configure a static route with a lower metric on the backup ISP and enable BFD.

Question 7

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Accepted Answer

Configure a Path Monitoring profile on the default route for the primary ISP.. Path Monitoring on a static default route enables the firewall to track reachability of a target IP. If the target is unreachable through the primary ISP, the route is withdrawn, and the secondary route becomes active. This provides automatic failover. The other options either require dynamic routing, manual intervention, or do not address link failure detection.

Answer

Enable OSPF on the ISP-facing interfaces to dynamically learn routes.

Answer

Set the secondary ISP interface to a lower administrative distance than the primary.

Answer

Configure a Policy-Based Forwarding (PBF) rule to redirect traffic to the secondary ISP.

Question 8

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

Accepted Answer

MTU mismatch on the interfaces. The EXSTART state in OSPF is part of the database exchange process where routers negotiate master/slave roles. If the Maximum Transmission Unit (MTU) on the interfaces does not match, the routers cannot successfully exchange database description packets, and the adjacency remains stuck in EXSTART. Checking MTU settings is a key troubleshooting step for this issue. Area mismatches, hello interval mismatches, and duplicate router IDs would cause different neighbor states.

Answer

Mismatched OSPF area IDs

Answer

Duplicate router IDs

Answer

Incorrect OSPF hello interval

Question 9

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

Accepted Answer

Some websites are excluded from decryption by a no-decrypt policy or are in a predefined category that is not decrypted.. Decryption exclusions, whether by predefined categories or custom no-decrypt policies, prevent the firewall from decrypting certain traffic. This results in some websites not being decrypted. Certificate errors on other sites may be due to certificate pinning. The correct answer identifies the selective exclusion as the cause for non-decryption.

Answer

The decryption policy is not matching because the SSL traffic is using a non-standard port.

Answer

The forward trust certificate is not installed on the firewall.

Answer

The decryption profile is set to block sessions with untrusted issuers, causing the firewall to bypass decryption.

Question 10

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name