NGFW-Engineer Multiple Select — 40 Questions

Question 1

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an authorization profile that maps the LDAP group 'NGFW-Admins' to a read-write admin role and 'NGFW-Auditors' to a read-only role.. To authenticate administrators against LDAP and assign different privileges, the firewall needs an authentication profile to contact the directory and validate credentials, plus an authorization profile to map directory groups to admin roles. Together these provide both authentication and role-based authorization. Other options relate to data-plane features, certificate handling, or User-ID, none of which grant differentiated admin access based on LDAP group membership.

Answer

Configure a certificate profile that validates the LDAP server's certificate for administrator logins.

Answer

Enable User-ID on the management interface to discover the LDAP groups.

Answer

Create a security policy rule that allows LDAP traffic from the management interface to the LDAP server.

Question 2

Which TWO features require a valid subscription license?

Accepted Answer

URL Filtering. URL Filtering (B) requires a valid subscription license because it depends on Palo Alto Networks' cloud-hosted URL categorization database (BrightCloud/PAN-DB) that is continuously updated and licensed per firewall. Threat Prevention (C) also requires a valid subscription license since it relies on licensed signature and vulnerability content updates delivered through Dynamic Updates (Applications and Threats content) to detect exploits, malware, and C2 traffic. In contrast, Static Routing (A), Interface creation (D), and NAT (E) are core networking features built into PAN-OS and are available without any subscription, so they do not require a valid license.

Answer

Static Routing

Answer

Interface creation

Answer

NAT

Question 3

Which THREE things must be configured to allow HA between two firewalls?

Accepted Answer

HA data link. HA requires configuration of HA links (control/data), enabling HA in the device settings, and ensuring identical hardware/version.

Answer

Same virtual router configuration

Answer

Different management IP addresses

Question 4

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Accepted Answer

Assign an IP address to the tunnel interface.. To route traffic into a site-to-site VPN tunnel, the tunnel interface must have an IP address to serve as a next-hop, and a static route must direct traffic for the remote network to that tunnel interface. These two steps ensure the firewall can forward packets into the tunnel. Dynamic routing and security policies are separate concerns that may be needed for full connectivity but are not the routing configuration itself.

Answer

Create a security policy allowing traffic from the local zone to the VPN zone.

Answer

Configure a NAT policy to translate traffic entering the tunnel.

Answer

Enable OSPF on the tunnel interface.

Question 5

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Accepted Answer

LDAP. LDAP (A) is correct because the firewall can be configured to query an external LDAP directory (e.g., Active Directory or OpenLDAP) to validate administrator credentials, making it a legitimate authentication method. Local Database (B) is also correct because the firewall maintains its own internal user database where administrator accounts and password hashes are stored and checked locally when external authentication is unavailable or not desired. Syslog (C) is not an authentication method; it is a logging protocol used to send event and traffic logs to a remote server. NTP (D) is a time-synchronization protocol that keeps device clocks accurate and plays no role in verifying administrator identity. DHCP (E) is used to dynamically assign IP addresses and network parameters to clients, not to authenticate administrators.

Answer

Syslog

Answer

NTP

Answer

DHCP

Question 6

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

Accepted Answer

Create an OSPF area and assign the Layer 3 interface to that area.. The two required steps are enabling OSPF on the virtual router with a router ID, and creating an OSPF area with the interface assigned to it. These steps ensure OSPF is active and the interface participates in the OSPF domain. Without a router ID, OSPF cannot start; without area assignment, the interface will not send or receive OSPF hellos. Other options like virtual links, network type changes, and graceful restart are optional and not needed for basic adjacency and route advertisement.

Answer

Set the interface's OSPF network type to point-to-point.

Answer

Configure a virtual link to the neighboring router's router ID.

Answer

Enable OSPF graceful restart on the virtual router.

Question 7

Which TWO protocols are commonly used for log forwarding to SIEMs?

Accepted Answer

HTTPS. Syslog (E) is correct because it is the de facto standard protocol for forwarding log and event messages from network devices, servers, and appliances to a central SIEM collector, typically over UDP/TCP port 514 or TLS port 6514. HTTPS (B) is correct because many SIEM and log-ingestion APIs accept log data over HTTPS (TCP 443), providing encryption and authentication for agent- or API-based forwarding. DNS (A) is a name-resolution protocol, not a log transport, so it does not belong. ICMP (C) is used for diagnostics and error messaging (e.g., ping), not log delivery. Telnet (D) is a cleartext remote-terminal protocol and is not used for forwarding logs to SIEMs.

Answer

DNS

Answer

ICMP

Answer

Telnet

Question 8

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

Accepted Answer

Apply the profile to the zone under Network > Zones.. Option D is correct because a zone protection profile must first be created as an object under Network > Network Profiles > Zone Protection before it can be referenced anywhere; this defines the flood, reconnaissance, and packet-based attack protections. Option B is correct because after the profile exists, it must be attached to the target security zone under Network > Zones (in the Zone Protection Profile field) for the protections to take effect on that zone's ingress traffic. Option A is incorrect because security policy rules control permitted traffic and are not required to bind a zone protection profile to a zone. Option C is incorrect because assigning a zone to a virtual router is part of basic Layer 3 zone configuration, not zone protection profile configuration. Option E is incorrect because 'Strict' mode is not a valid interface setting for enabling zone protection; there is no such required toggle.

Answer

Create a security policy rule.

Answer

Assign the zone to a virtual router.

Answer

Enable the 'Strict' mode on the interface.

Question 9

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

Accepted Answer

Generate an API key on Panorama using an admin account with sufficient privileges.. To automate policy deployment with Panorama, first generate an API key for authentication. Then, after modifying the candidate configuration on Panorama, use the 'commit-all' action to push the changes to the managed firewalls. This ensures the policies are applied to the devices.

Answer

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Answer

Use the 'validate' action to ensure the configuration is valid before committing.

Answer

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Question 10

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Accepted Answer

Include the config and set elements in the API request.. To activate a new security rule created via the XML API, the script must first ensure the rule is added to the candidate configuration by including 'type=config' and 'action=set' in the request. Then, a separate commit request with 'action=commit' is required to push the candidate configuration to the running configuration. Without both steps, the rule will not take effect.

Answer

Use the <key> element to provide the API key for authentication.

Answer

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Answer

Include the <vsys> element to specify the virtual system for the rule.

Question 11

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

Accepted Answer

Configure a static route to 0.0.0.0/0 and ensure it is active in the virtual router.. To advertise a static default route into OSPF on a Palo Alto Networks firewall, you must first ensure the static default route exists and is active in the virtual router. Then, you need to create a redistribution profile that matches the default route and apply it as an export rule in the OSPF configuration. This two-step process ensures that the default route is injected into OSPF and propagated to neighbors. Without both steps, the default route will not be advertised.

Answer

Enable 'Default Information Originate' in the OSPF global settings.

Answer

Enable 'Advertise Default Route' in the OSPF area configuration.

Answer

Set the OSPF router priority to a non-zero value to allow default route propagation.

Question 12

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

Accepted Answer

Enable DHCP server on the Layer 3 interface and configure an IP pool with the desired range.. To configure the firewall as a DHCP server, you must enable DHCP server on the Layer 3 interface and define an IP pool with the desired range. Additionally, you must set lease time and DNS server settings within the DHCP server configuration to meet the specific requirements. These two steps are essential for the firewall to provide IP addresses and network parameters to clients.

Answer

Configure a DHCP relay agent to forward requests to an external DHCP server.

Answer

Create a security policy allowing DHCP traffic from the guest zone to the firewall's management interface.

Answer

Assign a static IP address to the guest client devices manually.

Question 13

Which TWO settings are configured in a Virtual Router?

Accepted Answer

Static Routes. Virtual routers handle static routes and dynamic routing protocols (like OSPF/BGP).

Answer

Management Profile

Answer

Tunnel Interface IPs

Answer

Security Zones

Question 14

Which TWO settings are required to configure an Interface Management Profile?

Accepted Answer

Permitted IP Addresses. An Interface Management Profile in PAN-OS is defined by exactly two required components: the Permitted IP Addresses (option A), which specify the source subnets or hosts allowed to reach the management interface, and the Permitted Services (option B), which enable the specific management protocols such as HTTPS, SSH, Telnet, SNMP, HTTP, and Ping on that interface. These two settings together control who can access the firewall's management plane and through which services, making them the mandatory configuration elements. Default Gateway (option C) is a network-layer setting configured on the virtual router or interface, not within the Interface Management Profile. Zone Assignment (option D) is a separate interface configuration used for security policy enforcement, not part of the management profile. DNS Server (option E) is configured globally or per virtual router for name resolution and is unrelated to the Interface Management Profile.

Answer

Default Gateway

Answer

Zone Assignment

Answer

DNS Server

Question 15

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Accepted Answer

Source IP address. When configuring a Service Route, the firewall needs to know which source IP address to use for the traffic, so option B (Source IP address) is correct because it defines the source address that will be used for the service's outbound traffic. Option C (Source Interface) is also correct because the Service Route must specify the interface through which the service traffic will egress, ensuring the firewall uses that specific interface for external traffic. Option A (Destination MAC address) is not required because Service Routes operate at Layer 3 and do not need a destination MAC address. Option D (Default Gateway) is not a Service Route setting; routing is handled separately by the virtual router's default route. Option E (VLAN Tag) is not part of Service Route configuration; VLAN tagging is configured on the interface or subinterface, not in the Service Route itself.

Answer

Destination MAC address

Answer

Default Gateway

Answer

VLAN Tag

Question 16

Which TWO actions are required to successfully integrate a new External Dynamic List (EDL)?

Accepted Answer

Configure the refresh interval.. You must define the source URL and set the update frequency in the EDL object.

Answer

Install an SSL certificate for the list source.

Answer

Enable threat prevention logs.

Answer

Restart the firewall.

Question 17

Which THREE configuration items are required in the 'init-cfg.txt' file for a VM-Series firewall to join a Panorama server?

Accepted Answer

panorama-server. The Panorama IP, the serial number (or auth code), and the device group are standard parameters.

Answer

proxy-server

Answer

dhcp-client

Question 18

Which THREE items can be assigned to a Security Zone?

Accepted Answer

Physical interfaces. Physical interfaces, sub-interfaces, and tunnel interfaces can all be assigned to security zones.

Answer

Virtual routers

Answer

Management interfaces

Question 19

Which THREE items can be used as a 'Source' in a security policy?

Accepted Answer

User. Policies can use addresses, address groups, or users as the source of traffic.

Answer

Virtual Router name

Answer

Interface speed

Question 20

Which THREE settings can be modified in a custom Antivirus Profile?

Accepted Answer

Protocol settings. In a custom Antivirus Profile on Palo Alto Networks firewalls, option B (Protocol settings) is correct because the profile lets you enable/disable scanning per protocol (HTTP, FTP, SMTP, IMAP, POP3, SMB) and configure decode settings such as maximum file size and decode depth for each. Option C (File type exceptions) is correct because the profile includes a File Blocking/exception list where you specify file types (by extension or MIME type) that should be exempted from antivirus scanning. Option D (Action for detected malware) is correct because each antivirus signature is assigned an action such as alert, drop, reset-both, or block, which is configurable within the profile. Option A (GlobalProtect version) is not part of an Antivirus Profile; it is configured in the GlobalProtect portal/agent settings. Option E (System hostname) is a device-level setting configured under Device > Setup, not within an Antivirus Profile.

Answer

GlobalProtect version

Answer

System hostname