NGFW-Engineer Practice Test 7 — 10 Questions

Question 1

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Accepted Answer

Source IP address. When configuring a Service Route, the firewall needs to know which source IP address to use for the traffic, so option B (Source IP address) is correct because it defines the source address that will be used for the service's outbound traffic. Option C (Source Interface) is also correct because the Service Route must specify the interface through which the service traffic will egress, ensuring the firewall uses that specific interface for external traffic. Option A (Destination MAC address) is not required because Service Routes operate at Layer 3 and do not need a destination MAC address. Option D (Default Gateway) is not a Service Route setting; routing is handled separately by the virtual router's default route. Option E (VLAN Tag) is not part of Service Route configuration; VLAN tagging is configured on the interface or subinterface, not in the Service Route itself.

Answer

Destination MAC address

Answer

Default Gateway

Answer

VLAN Tag

Question 2

What is the purpose of an 'Aggregate Ethernet' interface?

Accepted Answer

Combine interfaces for throughput/redundancy. Aggregate Ethernet (AE) allows you to combine multiple physical interfaces into one logical interface for higher throughput and link redundancy.

Answer

Route traffic to different zones

Answer

Apply security policies to specific VLANs

Answer

Manage HA links

Question 3

In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?

Accepted Answer

/config/bootstrap/. The VM-Series looks for a specific directory structure on the attached storage device, starting with '/config/bootstrap/'.

Answer

/var/bootstrap/

Answer

/etc/bootstrap/

Answer

/opt/paloalto/

Question 4

An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?

Accepted Answer

The 'commit()' method was not called.. The script modifies the candidate configuration; a 'commit' must be performed to push those changes to the running configuration.

Answer

The object is hidden in the GUI.

Answer

The API key has insufficient scope.

Answer

The object was not defined as a constant.

Question 5

You need to automate the retrieval of URL filtering logs from the firewall. Which API endpoint type is used to execute a 'show' command?

Accepted Answer

type=op. The 'op' type is used to execute operational commands, including 'show' commands to retrieve logs or status.

Answer

type=show

Answer

type=log

Answer

type=config

Question 6

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

Accepted Answer

Action. The 'Action' column in the security policy rule dictates whether traffic matching the rule is allowed, dropped, or reset.

Answer

Service

Answer

Source

Answer

Application

Question 7

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

Accepted Answer

The firewall interface address for VPN. The Local IP is the interface IP address on the firewall that will initiate or receive the VPN connection.

Answer

The virtual router IP

Answer

The internal network IP address

Answer

The client machine's IP

Question 8

You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?

Accepted Answer

Plain text. EDLs must be text files containing entries separated by newlines, with specific formatting depending on the type (IP, Domain, or URL).

Answer

JSON

Answer

XML

Answer

CSV

Question 9

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

Accepted Answer

Verify that the User-ID agent is configured to monitor the correct Domain Controller and that the firewall's User-ID agent settings include the correct source IP for the agent.. When User-ID agent connectivity is established but user mappings are missing, the most likely causes are incorrect Domain Controller monitoring or incorrect agent source IP configuration on the firewall. Verifying that the agent monitors the right Domain Controller and that the firewall recognizes the agent's IP ensures that user mapping data is correctly received and processed.

Answer

Verify that the security policy includes a rule allowing traffic from the User-ID agent to the firewall's management interface.

Answer

Ensure that the LDAP server profile uses port 389 for LDAP over SSL.

Answer

Check that the firewall's management interface has a default gateway configured.

Question 10

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Accepted Answer

In the management interface settings, set Permitted IP Addresses to 10.10.10.0/24 and disable all management services except HTTPS.. To restrict management access to a specific subnet and enable only HTTPS, the engineer must configure the management interface's Permitted IP Addresses to the desired subnet and disable all other management services except HTTPS. This ensures that only hosts from the allowed subnet can reach the management interface using the secure protocol. This is a standard device setting configuration on Palo Alto Networks firewalls.

Answer

Configure a security policy from the trust zone to the management zone allowing only 10.10.10.0/24 to the management IP on port 443, and set the management interface to use only HTTPS.

Answer

Create a Management Interface Profile that permits only 10.10.10.0/24 and enable only HTTPS, then apply it to the management interface.

Answer

Create a NAT policy that translates the management IP to a public IP and restrict access using a security policy from the untrust zone.