NGFW-Engineer Practice Test 5 — 10 Questions

Question 1

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Accepted Answer

Check if the tunnel interface is in the correct Security Zone. Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.

Answer

Reboot the firewall

Answer

Disable the security policy

Answer

Update the GlobalProtect client version

Question 2

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Accepted Answer

Destination NAT. Destination NAT maps a public IP to an internal private IP, enabling access to internal servers.

Answer

Source NAT

Answer

Static Route

Answer

Security Policy

Question 3

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. PAN-OS supports forwarding almost all log types (Traffic, Threat, System, etc.) to external log collectors.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 4

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. Common actions include 'Allow', 'Deny', 'Drop', 'Reset', and log forwarding configuration.

Answer

DNS Server

Answer

NAT Policy

Question 5

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Accepted Answer

The IKE Gateway configuration has a mismatched Local/Peer ID.. An 'init-passive' state indicates that the firewall is waiting for the peer to initiate the connection, suggesting a mismatch in initiator/responder settings or phase 1 proposal parameters.

Answer

The physical interface is not in the correct zone.

Answer

The security policy is missing a rule for IPsec traffic.

Answer

The tunnel interface is not assigned an IP address.

Question 6

What is the primary function of a Virtual Router?

Accepted Answer

Maintain the routing table. A Virtual Router maintains the routing table and processes packets based on destination IP, performing route lookups for traffic.

Answer

Provide security inspection

Answer

Manage VPN tunnel encryption

Answer

Store firewall logs

Question 7

Which of these is a valid way to define a source IP in a policy?

Accepted Answer

Address Object. You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

Answer

Interface Name

Answer

Zone Name

Answer

Virtual Router Name

Question 8

Which TWO settings are configured in a Virtual Router?

Accepted Answer

Static Routes. Virtual routers handle static routes and dynamic routing protocols (like OSPF/BGP).

Answer

Management Profile

Answer

Tunnel Interface IPs

Answer

Security Zones

Question 9

Which THREE settings are configured in a Layer 3 interface?

Accepted Answer

Virtual Router. L3 interfaces require an IP address, a zone assignment, and an association with a virtual router.

Answer

Aggregate setting

Answer

Management Profile

Question 10

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Accepted Answer

HA synchronization. High Availability (HA) synchronization ensures that configuration changes made on the primary firewall are mirrored to the secondary firewall.

Answer

Manual import/export

Answer

Panorama device groups

Answer

Schedule a daily push from the CLI