NGFW-Engineer PAN OS Device Setting Configuration — 20 Questions

Question 1

Which THREE items must be configured to successfully implement User-ID mapping via an agent?

Accepted Answer

Server Monitor. The agent requires a server monitor, an agent connection, and a group mapping object.

Answer

Captive Portal

Answer

Authentication Policy

Question 2

An administrator needs to ensure that App-ID is accurately identifying traffic on non-standard ports. What is the recommended approach?

Accepted Answer

Ensure App-ID is enabled in the Security Policy. App-ID uses signatures to identify applications regardless of the port, but application-override policies can be used for custom traffic if App-ID fails.

Answer

Enable 'Scan for Application' in the Security Policy

Answer

Configure an Application Override policy

Answer

Increase the timeout values for the application

Question 3

A company is experiencing high latency for SSL-encrypted traffic. What is the most effective device-level setting to optimize throughput?

Accepted Answer

Implement SSL Forward Proxy exclusion for high-bandwidth sites. SSL decryption is resource-intensive. Hardware offloading (if supported) or session-based optimization is necessary.

Answer

Disable Threat Prevention for decrypted traffic

Answer

Increase the maximum session count in Device > Setup

Answer

Change the decryption algorithm to DES

Question 4

When configuring redundant power supplies, how do you verify their status?

Accepted Answer

Check the Device > General Information tab. The 'Dashboard' or 'Device > General Information' provides the operational status of power supplies.

Answer

Use the CLI command 'show system hardware'

Answer

Check the Network > Interfaces tab

Answer

View the system log for power events

Question 5

Which configuration component allows you to map a custom port to a standard App-ID application?

Accepted Answer

Service Object. Custom App-ID or Application Override can be used, but generally, Palo Alto recommends defining custom services if the application is not standard.

Answer

Security Profile

Answer

Tag Object

Answer

Address Object

Question 6

Which feature allows you to identify users without an agent by using existing network logs?

Accepted Answer

Syslog-based User-ID. Syslog-based User-ID mapping allows the firewall to parse log messages from other servers to map IP to user.

Answer

...

Answer

Captive Portal

Answer

GlobalProtect

Answer

Active Directory Agent

Question 7

Which THREE actions can be performed by an Antivirus Security Profile?

Accepted Answer

Block. Antivirus profiles can block, alert, or quarantine malicious files.

Answer

Reset

Answer

Drop

Question 8

When configuring a NAT rule, you need to translate the internal IP of a server to a public IP. Which NAT type should you select for this requirement?

Accepted Answer

Destination NAT. Destination NAT is the correct type for mapping a public-facing IP address to an internal server IP.

Answer

Bidirectional NAT

Answer

Dynamic IP and Port

Answer

NPTv6

Answer

Static NAT

Question 9

Which THREE of the following are required components to successfully implement a Clientless VPN (SSL VPN) on a Palo Alto Networks firewall?

Accepted Answer

SSL VPN Portal. Clientless VPN requires a portal, gateway, and specific application configuration to function.

Answer

GlobalProtect Agent

Answer

IPsec Tunnel Interface

Question 10

An administrator needs to ensure that the firewall uses a specific internal server for DNS resolution of external traffic. Where must this be configured?

Accepted Answer

Device > Setup > Service Route Configuration. Service routes are used to define which interface the firewall uses to reach services like DNS, NTP, and updates.

Answer

Network > Interfaces

Answer

Network > Virtual Routers

Answer

Device > Setup > Services

Question 11

You are deploying an HA pair. You need to ensure that the session state is synchronized immediately to prevent drops during a failover. Which setting ensures this?

Accepted Answer

Device > High Availability > HA1/HA2 configuration. Session synchronization settings within the HA configuration are required to ensure session tables are mirrored across peers.

Answer

Device > High Availability > Election Settings

Answer

Device > High Availability > Link and Path Monitoring

Answer

Device > High Availability > General

Question 12

You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?

Accepted Answer

Interface Management Profile. Management Interface Settings under Device > Setup > Interfaces allow the restriction of management access via Service Routes and Interface Management Profiles.

Answer

Access Control List (ACL)

Answer

Security Policy

Answer

Service Routes

Question 13

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Accepted Answer

Application. App-ID is enforced when you specify an Application and a Service (or leave it as application-default).

Answer

Profile Group

Answer

Zone

Answer

Action

Question 14

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Accepted Answer

Management Interface Settings. The Management Interface Settings allow you to define an allowed IP address list to restrict access to the management plane.

Answer

Service Route Configuration

Answer

Device > Setup > Session

Answer

Network Profile - Interface Management

Question 15

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Accepted Answer

Configure Agentless User-ID via Server Monitoring. The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Answer

Use IP-to-User static mapping

Answer

Enable GlobalProtect for internal users

Answer

Use the User-ID Agent on a Windows Server

Question 16

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

Accepted Answer

Device > Setup > Services. DNS settings for the firewall management plane are found under Device > Setup > Services.

Answer

Network > Virtual Routers

Answer

Network > Interfaces

Answer

Objects > Services

Question 17

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Accepted Answer

Check if the tunnel interface is in the correct Security Zone. Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.

Answer

Reboot the firewall

Answer

Disable the security policy

Answer

Update the GlobalProtect client version

Question 18

Which object type should be used to group multiple IP addresses to simplify security policy management?

Accepted Answer

Address Group. Address Groups allow the grouping of multiple address objects, simplifying policy rules.

Answer

Service Group

Answer

Address Object

Answer

Tag

Question 19

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Accepted Answer

Configure an External Dynamic List (EDL). External Dynamic Lists (EDL) allow the firewall to ingest and act upon lists of IPs or URLs from a remote source.

Answer

Create a static address group

Answer

Manually update the blocklist every hour

Answer

Use a Dynamic Address Group based on a registration API

Question 20

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Accepted Answer

Packet Capture (PCAP). Packet capture and session flow logging are the most granular tools available in PAN-OS.

Answer

System Logs

Answer

URL Filtering Logs

Answer

Threat Logs