NGFW-Engineer Practice Questions 1 — 50 Questions

Question 1

A security engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the PAN-OS XML API. The script must authenticate using an API key. Which HTTP header should be used to pass the API key in the request?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

key=<API_KEY> as a query parameter. The PAN-OS XML API authenticates requests using an API key passed as a query parameter named 'key'. This is the documented and supported method. Other headers like Authorization or X-API-Key are not used. The API key must be included in every request, and it is recommended to use HTTPS to protect the key during transmission.

Answer

Authorization: Bearer <API_KEY>

Answer

X-API-Key: <API_KEY>

Answer

X-PAN-KEY

Question 2

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

Accepted Answer

Configure an authorization profile that maps the LDAP group 'NGFW-Admins' to a read-write admin role and 'NGFW-Auditors' to a read-only role.. To authenticate administrators against LDAP and assign different privileges, the firewall needs an authentication profile to contact the directory and validate credentials, plus an authorization profile to map directory groups to admin roles. Together these provide both authentication and role-based authorization. Other options relate to data-plane features, certificate handling, or User-ID, none of which grant differentiated admin access based on LDAP group membership.

Answer

Configure a certificate profile that validates the LDAP server's certificate for administrator logins.

Answer

Enable User-ID on the management interface to discover the LDAP groups.

Answer

Create a security policy rule that allows LDAP traffic from the management interface to the LDAP server.

Question 3

An administrator wants to use a script to back up firewall configurations daily. Which management interface service must be enabled to allow the script to download the config file?

Accepted Answer

XML API. The XML API is the standard method for scripts to programmatically export configurations (running-config).

Answer

SNMP

Answer

Telnet

Answer

SSH

Question 4

Which TWO features require a valid subscription license?

Accepted Answer

URL Filtering. URL Filtering (B) requires a valid subscription license because it depends on Palo Alto Networks' cloud-hosted URL categorization database (BrightCloud/PAN-DB) that is continuously updated and licensed per firewall. Threat Prevention (C) also requires a valid subscription license since it relies on licensed signature and vulnerability content updates delivered through Dynamic Updates (Applications and Threats content) to detect exploits, malware, and C2 traffic. In contrast, Static Routing (A), Interface creation (D), and NAT (E) are core networking features built into PAN-OS and are available without any subscription, so they do not require a valid license.

Answer

Static Routing

Answer

Interface creation

Answer

NAT

Question 5

Which tab in the web interface is used to create and manage security policies?

Accepted Answer

Policies. The 'Policies' tab is where all firewall rule sets are managed.

Answer

Device

Answer

Objects

Answer

Network

Question 6

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

Accepted Answer

Enable HA session synchronization and select 'Session State' synchronization.. To preserve existing sessions during HA failover, session state synchronization must be enabled. This replicates the session table from the active firewall to the passive firewall, so the passive can take over without dropping established flows. Other HA settings like link aggregation, heartbeat encryption, or preempt mode do not provide session continuity.

Answer

Set the passive firewall to preempt mode to automatically become active after a failure.

Answer

Enable HA heartbeat encryption to secure communication between the firewalls.

Answer

Configure HA link aggregation to increase bandwidth between the firewalls.

Question 7

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

Accepted Answer

Layer 3 interface. A Layer 3 interface in PAN-OS is a routed interface that can be assigned an IP address and used as a gateway for a subnet. It operates at the network layer and can be assigned to a security zone, enabling routing between zones. This is the standard interface type for connecting to internal networks, DMZs, or the internet when the firewall is acting as a router. Layer 2, Virtual Wire, and Tunnel interfaces do not provide the same routing capabilities and are used for different purposes.

Answer

Virtual Wire interface

Answer

Tunnel interface

Answer

Layer 2 interface

Question 8

Which feature allows an NGFW to dynamically update security objects based on an external feed such as an IP list or URL list?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDL) allow the firewall to consume lists from external web servers and use them in policies automatically.

Answer

User-ID Mapping

Answer

Log Forwarding Profiles

Answer

Dynamic Address Objects

Question 9

You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?

Accepted Answer

init-cfg.txt. The 'init-cfg.txt' file is required for bootstrapping and contains the Panorama IP and authorization key to register the VM.

Answer

license.txt

Answer

bootstrap.xml

Answer

config.cfg

Question 10

Which THREE things must be configured to allow HA between two firewalls?

Accepted Answer

HA data link. HA requires configuration of HA links (control/data), enabling HA in the device settings, and ensuring identical hardware/version.

Answer

Same virtual router configuration

Answer

Different management IP addresses

Question 11

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

Accepted Answer

Assign a management IP address, configure a default gateway, and restrict management access to specific IP addresses via the management interface settings.. The management interface should be configured with a static IP address and default gateway for reliable remote access. To secure management, restrict access to specific trusted IP addresses using the permitted IP list in the management interface settings. This prevents unauthorized hosts from attempting to connect to the management interface.

Answer

Assign a management IP address and enable DHCP client on the management interface.

Answer

Assign a management IP address and configure a security policy to allow management traffic from any zone.

Answer

Assign a management IP address and enable HTTP for management access.

Question 12

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Accepted Answer

Assign an IP address to the tunnel interface.. To route traffic into a site-to-site VPN tunnel, the tunnel interface must have an IP address to serve as a next-hop, and a static route must direct traffic for the remote network to that tunnel interface. These two steps ensure the firewall can forward packets into the tunnel. Dynamic routing and security policies are separate concerns that may be needed for full connectivity but are not the routing configuration itself.

Answer

Create a security policy allowing traffic from the local zone to the VPN zone.

Answer

Configure a NAT policy to translate traffic entering the tunnel.

Answer

Enable OSPF on the tunnel interface.

Question 13

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Accepted Answer

LDAP. LDAP (A) is correct because the firewall can be configured to query an external LDAP directory (e.g., Active Directory or OpenLDAP) to validate administrator credentials, making it a legitimate authentication method. Local Database (B) is also correct because the firewall maintains its own internal user database where administrator accounts and password hashes are stored and checked locally when external authentication is unavailable or not desired. Syslog (C) is not an authentication method; it is a logging protocol used to send event and traffic logs to a remote server. NTP (D) is a time-synchronization protocol that keeps device clocks accurate and plays no role in verifying administrator identity. DHCP (E) is used to dynamically assign IP addresses and network parameters to clients, not to authenticate administrators.

Answer

Syslog

Answer

NTP

Answer

DHCP

Question 14

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

Accepted Answer

Create an OSPF area and assign the Layer 3 interface to that area.. The two required steps are enabling OSPF on the virtual router with a router ID, and creating an OSPF area with the interface assigned to it. These steps ensure OSPF is active and the interface participates in the OSPF domain. Without a router ID, OSPF cannot start; without area assignment, the interface will not send or receive OSPF hellos. Other options like virtual links, network type changes, and graceful restart are optional and not needed for basic adjacency and route advertisement.

Answer

Set the interface's OSPF network type to point-to-point.

Answer

Configure a virtual link to the neighboring router's router ID.

Answer

Enable OSPF graceful restart on the virtual router.

Question 15

Which TWO protocols are commonly used for log forwarding to SIEMs?

Accepted Answer

HTTPS. Syslog (E) is correct because it is the de facto standard protocol for forwarding log and event messages from network devices, servers, and appliances to a central SIEM collector, typically over UDP/TCP port 514 or TLS port 6514. HTTPS (B) is correct because many SIEM and log-ingestion APIs accept log data over HTTPS (TCP 443), providing encryption and authentication for agent- or API-based forwarding. DNS (A) is a name-resolution protocol, not a log transport, so it does not belong. ICMP (C) is used for diagnostics and error messaging (e.g., ping), not log delivery. Telnet (D) is a cleartext remote-terminal protocol and is not used for forwarding logs to SIEMs.

Answer

DNS

Answer

ICMP

Answer

Telnet

Question 16

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

Accepted Answer

Active/Active uses both firewalls for session processing. Active/Active mode allows both firewalls to process traffic simultaneously and requires link aggregation or specific load balancing, whereas Active/Passive only uses one firewall for traffic.

Answer

Active/Active is only for Layer 2 deployments

Answer

Active/Passive uses both firewalls for session processing

Answer

Active/Passive requires dedicated HA links

Question 17

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

Accepted Answer

Enable OSPF on the virtual router and assign the interface to an OSPF area.. To form an OSPF adjacency, the firewall must have OSPF enabled on the virtual router and the participating interface must be assigned to an OSPF area. This allows the firewall to send and receive Hello packets. Without these steps, the firewall will not participate in OSPF, regardless of other settings.

Answer

Create a static route to the ISP router and enable OSPF on the virtual router.

Answer

Configure a loopback interface and assign it to the same OSPF area as the ISP router.

Answer

Set the interface type to Layer 2 and enable OSPF on the Layer 2 interface.

Question 18

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Accepted Answer

URL Filtering Profile. URL Filtering profiles control access to specific categories of websites.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 19

You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?

Accepted Answer

The XPath in the API call does not correctly specify the Device Group or Vsys context.. The XML API requires precise XPath syntax. If the object exists in the GUI but the API fails, it is often due to the object being nested within a specific Device Group or Vsys that was not properly specified in the XPath.

Answer

The API key does not have the 'Superuser' role.

Answer

The XML document must be wrapped in a <request> tag.

Answer

The API service is disabled on the management interface.

Question 20

What is the primary function of a Security Profile Group?

Accepted Answer

To bundle multiple security profiles into one object. A Security Profile Group allows you to bundle multiple security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) into a single object for easy policy assignment.

Answer

To manage NAT rules

Answer

To apply profiles to specific users

Answer

To group multiple security policies