NGFW-Engineer PAN OS Device Setting Configuration — 15 Questions

Question 1

Which THREE items must be configured to successfully implement User-ID mapping via an agent?

Accepted Answer

Server Monitor. The agent requires a server monitor, an agent connection, and a group mapping object.

Answer

Captive Portal

Answer

Authentication Policy

Question 2

An administrator needs to ensure that App-ID is accurately identifying traffic on non-standard ports. What is the recommended approach?

Accepted Answer

Ensure App-ID is enabled in the Security Policy. App-ID uses signatures to identify applications regardless of the port, but application-override policies can be used for custom traffic if App-ID fails.

Answer

Enable 'Scan for Application' in the Security Policy

Answer

Configure an Application Override policy

Answer

Increase the timeout values for the application

Question 3

A company is experiencing high latency for SSL-encrypted traffic. What is the most effective device-level setting to optimize throughput?

Accepted Answer

Implement SSL Forward Proxy exclusion for high-bandwidth sites. SSL decryption is resource-intensive. Hardware offloading (if supported) or session-based optimization is necessary.

Answer

Disable Threat Prevention for decrypted traffic

Answer

Increase the maximum session count in Device > Setup

Answer

Change the decryption algorithm to DES

Question 4

When configuring redundant power supplies, how do you verify their status?

Accepted Answer

Check the Device > General Information tab. The 'Dashboard' or 'Device > General Information' provides the operational status of power supplies.

Answer

Use the CLI command 'show system hardware'

Answer

Check the Network > Interfaces tab

Answer

View the system log for power events

Question 5

Which configuration component allows you to map a custom port to a standard App-ID application?

Accepted Answer

Service Object. Custom App-ID or Application Override can be used, but generally, Palo Alto recommends defining custom services if the application is not standard.

Answer

Security Profile

Answer

Tag Object

Answer

Address Object

Question 6

Which feature allows you to identify users without an agent by using existing network logs?

Accepted Answer

Syslog-based User-ID. Syslog-based User-ID mapping allows the firewall to parse log messages from other servers to map IP to user.

Answer

...

Answer

Captive Portal

Answer

GlobalProtect

Answer

Active Directory Agent

Question 7

Which THREE actions can be performed by an Antivirus Security Profile?

Accepted Answer

Block. Antivirus profiles can block, alert, or quarantine malicious files.

Answer

Reset

Answer

Drop

Question 8

When configuring a NAT rule, you need to translate the internal IP of a server to a public IP. Which NAT type should you select for this requirement?

Accepted Answer

Destination NAT. Destination NAT is the correct type for mapping a public-facing IP address to an internal server IP.

Answer

Bidirectional NAT

Answer

Dynamic IP and Port

Answer

NPTv6

Answer

Static NAT

Question 9

Which THREE of the following are required components to successfully implement a Clientless VPN (SSL VPN) on a Palo Alto Networks firewall?

Accepted Answer

SSL VPN Portal. Clientless VPN requires a portal, gateway, and specific application configuration to function.

Answer

GlobalProtect Agent

Answer

IPsec Tunnel Interface

Question 10

An administrator needs to ensure that the firewall uses a specific internal server for DNS resolution of external traffic. Where must this be configured?

Accepted Answer

Device > Setup > Service Route Configuration. Service routes are used to define which interface the firewall uses to reach services like DNS, NTP, and updates.

Answer

Network > Interfaces

Answer

Network > Virtual Routers

Answer

Device > Setup > Services

Question 11

You are deploying an HA pair. You need to ensure that the session state is synchronized immediately to prevent drops during a failover. Which setting ensures this?

Accepted Answer

Device > High Availability > HA1/HA2 configuration. Session synchronization settings within the HA configuration are required to ensure session tables are mirrored across peers.

Answer

Device > High Availability > Election Settings

Answer

Device > High Availability > Link and Path Monitoring

Answer

Device > High Availability > General

Question 12

You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?

Accepted Answer

Interface Management Profile. Management Interface Settings under Device > Setup > Interfaces allow the restriction of management access via Service Routes and Interface Management Profiles.

Answer

Access Control List (ACL)

Answer

Security Policy

Answer

Service Routes

Question 13

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Accepted Answer

Application. App-ID is enforced when you specify an Application and a Service (or leave it as application-default).

Answer

Profile Group

Answer

Zone

Answer

Action

Question 14

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Accepted Answer

Management Interface Settings. The Management Interface Settings allow you to define an allowed IP address list to restrict access to the management plane.

Answer

Service Route Configuration

Answer

Device > Setup > Session

Answer

Network Profile - Interface Management

Question 15

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Accepted Answer

Configure Agentless User-ID via Server Monitoring. The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Answer

Use IP-to-User static mapping

Answer

Enable GlobalProtect for internal users

Answer

Use the User-ID Agent on a Windows Server