NGFW-Engineer Practice Questions 2 — 50 Questions

Question 1

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Accepted Answer

Destination NAT. Destination NAT maps a public IP to an internal private IP, enabling access to internal servers.

Answer

Source NAT

Answer

Static Route

Answer

Security Policy

Question 2

Which TWO settings are configured in a Virtual Router?

Accepted Answer

Static Routes. Virtual routers handle static routes and dynamic routing protocols (like OSPF/BGP).

Answer

Management Profile

Answer

Tunnel Interface IPs

Answer

Security Zones

Question 3

How do you ensure that a specific security policy rule is only active during business hours?

Accepted Answer

Create a Schedule object. The 'Schedule' object allows you to define time-based constraints for policy rules.

Answer

Use a Security Profile

Answer

Use a Dynamic Address Group

Answer

Manually disable it

Question 4

Which TWO settings are required to configure an Interface Management Profile?

Accepted Answer

Permitted IP Addresses. An Interface Management Profile in PAN-OS is defined by exactly two required components: the Permitted IP Addresses (option A), which specify the source subnets or hosts allowed to reach the management interface, and the Permitted Services (option B), which enable the specific management protocols such as HTTPS, SSH, Telnet, SNMP, HTTP, and Ping on that interface. These two settings together control who can access the firewall's management plane and through which services, making them the mandatory configuration elements. Default Gateway (option C) is a network-layer setting configured on the virtual router or interface, not within the Interface Management Profile. Zone Assignment (option D) is a separate interface configuration used for security policy enforcement, not part of the management profile. DNS Server (option E) is configured globally or per virtual router for name resolution and is unrelated to the Interface Management Profile.

Answer

Default Gateway

Answer

Zone Assignment

Answer

DNS Server

Question 5

In BGP, what is a 'Route Map' used for?

Accepted Answer

Manipulate BGP attributes. A Route Map is used to filter, modify, or manipulate BGP attributes during the import or export of routes, providing granular control over routing policy.

Answer

Monitor OSPF neighbors

Answer

Configure static route metrics

Answer

Limit the number of peers

Answer

Encrypt BGP sessions

Question 6

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

Accepted Answer

Virtual Router. Static routes for tunnel traffic are configured in the Virtual Router associated with the tunnel interface.

Answer

Tunnel Interface settings

Answer

Zone settings

Answer

Security Policy

Question 7

Where do you configure the 'Heartbeat' interval for HA?

Accepted Answer

Device > High Availability > General. The heartbeat interval is configured in the HA > General > Election Settings or Heartbeat settings depending on the specific PAN-OS version and HA mode.

Answer

Device > Setup > Management

Answer

Network > Virtual Routers

Answer

Network > Interfaces > HA

Question 8

Why might a static route not be visible in the routing table?

Accepted Answer

Next hop is unreachable. If the next hop is not reachable through an interface associated with the virtual router, the static route is considered invalid and will not be installed in the RIB.

Answer

The firewall is in HA passive mode

Answer

The destination is a public IP

Answer

The route has a high metric

Answer

The interface is in a different zone

Question 9

An administrator is configuring a Palo Alto Networks firewall to route traffic between two internal networks. The firewall has two Layer 3 interfaces, Ethernet1/1 and Ethernet1/2, each assigned to different security zones and different virtual routers. The administrator wants traffic from the trust zone to reach the untrust zone, but the firewall is not routing the traffic. What is the most likely cause?

Accepted Answer

The two interfaces are in different virtual routers, so the firewall cannot route between them.. Interfaces in different virtual routers cannot route traffic between each other by default. To allow routing between the trust and untrust zones, the interfaces must be in the same virtual router, or inter-virtual-router routing must be configured. The most likely cause is the virtual router separation, which prevents the firewall from forwarding packets between the two networks.

Answer

A security policy is missing to allow traffic between the trust and untrust zones.

Answer

The interfaces are not configured with IP addresses.

Answer

The firewall requires a virtual wire to route between different zones.

Question 10

What is the function of a 'Tap' mode interface?

Accepted Answer

Monitor traffic without being inline. Tap mode interfaces allow the firewall to monitor traffic by receiving a copy of the traffic (via a SPAN port), without being inline.

Answer

Route traffic between subnets

Answer

Provide high availability

Answer

Encrypt VPN tunnels

Question 11

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Accepted Answer

Source IP address. When configuring a Service Route, the firewall needs to know which source IP address to use for the traffic, so option B (Source IP address) is correct because it defines the source address that will be used for the service's outbound traffic. Option C (Source Interface) is also correct because the Service Route must specify the interface through which the service traffic will egress, ensuring the firewall uses that specific interface for external traffic. Option A (Destination MAC address) is not required because Service Routes operate at Layer 3 and do not need a destination MAC address. Option D (Default Gateway) is not a Service Route setting; routing is handled separately by the virtual router's default route. Option E (VLAN Tag) is not part of Service Route configuration; VLAN tagging is configured on the interface or subinterface, not in the Service Route itself.

Answer

Destination MAC address

Answer

Default Gateway

Answer

VLAN Tag

Question 12

What is the purpose of an 'Aggregate Ethernet' interface?

Accepted Answer

Combine interfaces for throughput/redundancy. Aggregate Ethernet (AE) allows you to combine multiple physical interfaces into one logical interface for higher throughput and link redundancy.

Answer

Route traffic to different zones

Answer

Apply security policies to specific VLANs

Answer

Manage HA links

Question 13

In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?

Accepted Answer

/config/bootstrap/. The VM-Series looks for a specific directory structure on the attached storage device, starting with '/config/bootstrap/'.

Answer

/var/bootstrap/

Answer

/etc/bootstrap/

Answer

/opt/paloalto/

Question 14

An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?

Accepted Answer

The 'commit()' method was not called.. The script modifies the candidate configuration; a 'commit' must be performed to push those changes to the running configuration.

Answer

The object is hidden in the GUI.

Answer

The API key has insufficient scope.

Answer

The object was not defined as a constant.

Question 15

You need to automate the retrieval of URL filtering logs from the firewall. Which API endpoint type is used to execute a 'show' command?

Accepted Answer

type=op. The 'op' type is used to execute operational commands, including 'show' commands to retrieve logs or status.

Answer

type=show

Answer

type=log

Answer

type=config

Question 16

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

Accepted Answer

Action. The 'Action' column in the security policy rule dictates whether traffic matching the rule is allowed, dropped, or reset.

Answer

Service

Answer

Source

Answer

Application

Question 17

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

Accepted Answer

The firewall interface address for VPN. The Local IP is the interface IP address on the firewall that will initiate or receive the VPN connection.

Answer

The virtual router IP

Answer

The internal network IP address

Answer

The client machine's IP

Question 18

You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?

Accepted Answer

Plain text. EDLs must be text files containing entries separated by newlines, with specific formatting depending on the type (IP, Domain, or URL).

Answer

JSON

Answer

XML

Answer

CSV

Question 19

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

Accepted Answer

Verify that the User-ID agent is configured to monitor the correct Domain Controller and that the firewall's User-ID agent settings include the correct source IP for the agent.. When User-ID agent connectivity is established but user mappings are missing, the most likely causes are incorrect Domain Controller monitoring or incorrect agent source IP configuration on the firewall. Verifying that the agent monitors the right Domain Controller and that the firewall recognizes the agent's IP ensures that user mapping data is correctly received and processed.

Answer

Verify that the security policy includes a rule allowing traffic from the User-ID agent to the firewall's management interface.

Answer

Ensure that the LDAP server profile uses port 389 for LDAP over SSL.

Answer

Check that the firewall's management interface has a default gateway configured.

Question 20

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Accepted Answer

In the management interface settings, set Permitted IP Addresses to 10.10.10.0/24 and disable all management services except HTTPS.. To restrict management access to a specific subnet and enable only HTTPS, the engineer must configure the management interface's Permitted IP Addresses to the desired subnet and disable all other management services except HTTPS. This ensures that only hosts from the allowed subnet can reach the management interface using the secure protocol. This is a standard device setting configuration on Palo Alto Networks firewalls.

Answer

Configure a security policy from the trust zone to the management zone allowing only 10.10.10.0/24 to the management IP on port 443, and set the management interface to use only HTTPS.

Answer

Create a Management Interface Profile that permits only 10.10.10.0/24 and enable only HTTPS, then apply it to the management interface.

Answer

Create a NAT policy that translates the management IP to a public IP and restrict access using a security policy from the untrust zone.