NGFW-Engineer PAN OS Device Setting Configuration — 10 Questions

Question 1

Which THREE items must be configured to successfully implement User-ID mapping via an agent?

Accepted Answer

Server Monitor. The agent requires a server monitor, an agent connection, and a group mapping object.

Answer

Captive Portal

Answer

Authentication Policy

Question 2

An administrator needs to ensure that the firewall uses a specific internal server for DNS resolution of external traffic. Where must this be configured?

Accepted Answer

Device > Setup > Service Route Configuration. Service routes are used to define which interface the firewall uses to reach services like DNS, NTP, and updates.

Answer

Network > Interfaces

Answer

Network > Virtual Routers

Answer

Device > Setup > Services

Question 3

You are deploying an HA pair. You need to ensure that the session state is synchronized immediately to prevent drops during a failover. Which setting ensures this?

Accepted Answer

Device > High Availability > HA1/HA2 configuration. Session synchronization settings within the HA configuration are required to ensure session tables are mirrored across peers.

Answer

Device > High Availability > Election Settings

Answer

Device > High Availability > Link and Path Monitoring

Answer

Device > High Availability > General

Question 4

You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?

Accepted Answer

Interface Management Profile. Management Interface Settings under Device > Setup > Interfaces allow the restriction of management access via Service Routes and Interface Management Profiles.

Answer

Access Control List (ACL)

Answer

Security Policy

Answer

Service Routes

Question 5

An administrator needs to ensure that App-ID is accurately identifying traffic on non-standard ports. What is the recommended approach?

Accepted Answer

Ensure App-ID is enabled in the Security Policy. App-ID uses signatures to identify applications regardless of the port, but application-override policies can be used for custom traffic if App-ID fails.

Answer

Enable 'Scan for Application' in the Security Policy

Answer

Configure an Application Override policy

Answer

Increase the timeout values for the application

Question 6

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Accepted Answer

Application. Option B (Application) is required because App-ID enforcement is defined by specifying the application(s) the rule must match; without an Application value the firewall cannot perform App-ID identification and enforcement. Option C (Service) is required because the Service field must be set to application-default (or a specific service) so the firewall knows which ports/protocols to inspect for the application; App-ID enforcement depends on this service definition. Options A (Profile Group), D (Zone), and E (Action) are not required to enable App-ID enforcement: a Profile Group applies security profiles, Zones define source/destination interfaces, and Action determines allow/deny, but none of these are the settings that enable App-ID matching itself.

Answer

Profile Group

Answer

Zone

Answer

Action

Question 7

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Accepted Answer

Configure Agentless User-ID via Server Monitoring. The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Answer

Use IP-to-User static mapping

Answer

Enable GlobalProtect for internal users

Answer

Use the User-ID Agent on a Windows Server

Question 8

A company is experiencing high latency for SSL-encrypted traffic. What is the most effective device-level setting to optimize throughput?

Accepted Answer

Implement SSL Forward Proxy exclusion for high-bandwidth sites. SSL decryption is resource-intensive. Hardware offloading (if supported) or session-based optimization is necessary.

Answer

Disable Threat Prevention for decrypted traffic

Answer

Increase the maximum session count in Device > Setup

Answer

Change the decryption algorithm to DES

Question 9

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Accepted Answer

Check if the tunnel interface is in the correct Security Zone. Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.

Answer

Reboot the firewall

Answer

Disable the security policy

Answer

Update the GlobalProtect client version

Question 10

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Accepted Answer

Packet Capture (PCAP). Packet capture and session flow logging are the most granular tools available in PAN-OS.

Answer

System Logs

Answer

URL Filtering Logs

Answer

Threat Logs