NGFW-Engineer PAN OS Device Setting Configuration — All Questions With Answers

Read the full PAN OS Device Setting Configuration explanation →

An administrator needs to ensure that the firewall uses a specific internal server for DNS resolution of external traffic. Where must this be configured?

Question 3hardmultiple choice

You are deploying an HA pair. You need to ensure that the session state is synchronized immediately to prevent drops during a failover. Which setting ensures this?

Question 4mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?

Question 5mediummultiple choice

An administrator needs to ensure that App-ID is accurately identifying traffic on non-standard ports. What is the recommended approach?

Question 6mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Question 7mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Question 8hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A company is experiencing high latency for SSL-encrypted traffic. What is the most effective device-level setting to optimize throughput?

Question 9mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Question 10hardmultiple choice

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Question 11mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When configuring NAT, which option allows the firewall to preserve the original source IP of the traffic?

Question 12easymultiple choice

Which feature must be enabled to inspect traffic for threats?

Question 13mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which configuration object allows you to restrict traffic based on geographic location?

Question 14mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you verify if a security policy is actually matching the traffic you expect?

Question 15hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When configuring redundant power supplies, how do you verify their status?

Question 16mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What happens if a packet matches no security policies?

Question 17mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the purpose of the 'Pre-Rulebase' and 'Post-Rulebase' in Panorama?

Question 18hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When troubleshooting routing, which command allows you to test the path of a packet?

Question 19mediummultiple choice

Which configuration component allows you to map a custom port to a standard App-ID application?

Question 20mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which feature allows you to identify users without an agent by using existing network logs?

Question 21hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE actions can be performed by an Antivirus Security Profile?

Question 22mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO objects can be used to identify traffic in an Application Override policy?

Question 23mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall to support User-ID. You have successfully installed the User-ID agent on a Windows Server and connected it to the firewall. However, the firewall is not mapping IP addresses to usernames. What is the most likely cause?

Question 24hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network administrator needs to ensure that internal users can access a public-facing web server located in the DMZ using its public IP address (Hairpin NAT). The policy exists, but traffic is being dropped. Which configuration step is critical to enable this?

Question 25hardmultiple choice

A firewall is experiencing high CPU usage during traffic spikes. You suspect that App-ID is performing too much scanning on internal traffic. Which action should you take to optimize performance while maintaining security?

Question 26mediummultiple choice

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Question 27easymultiple choice

When configuring a NAT rule, you need to translate the internal IP of a server to a public IP. Which NAT type should you select for this requirement?

Question 28hardmulti select

Which THREE of the following are required components to successfully implement a Clientless VPN (SSL VPN) on a Palo Alto Networks firewall?

Question 29mediummultiple choice

You are configuring a Palo Alto Networks next-generation firewall and need to ensure that the management interface is only reachable from the internal network. You want to restrict administrative access to the web UI and SSH to a specific subnet. Which configuration step should you perform?

Question 30hardmultiple choice

A network engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall is in a high-availability (HA) active-passive pair. The engineer wants to ensure that only the active firewall sends logs to the syslog server to avoid duplicate log entries. What should the engineer configure?

Question 31easymultiple choice

A firewall administrator needs to ensure that the management interface can reach an external syslog server at 203.0.113.50 for logging. The management interface is in the 10.0.0.0/24 subnet with default gateway 10.0.0.1. Which configuration should the administrator use to allow the firewall to send logs to the external server?

Question 32mediummulti select

A network administrator is configuring a Palo Alto Networks firewall to authenticate administrators using RADIUS. Which two steps are required to complete this configuration? (Choose two.)

Question 33hardmultiple choice

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You need to ensure that logs are sent in a format that includes the firewall's hostname and the log type. Which configuration step is required?

Question 34hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. The security team requires that all traffic logs include the source user information. You have already configured User-ID and verified that user mappings are present. However, the syslog server is not receiving user information in the logs. What could be the cause?

Question 35easymultiple choice

An administrator needs to configure a Palo Alto Networks firewall to authenticate administrators using an external LDAP server for management access. The administrator wants to ensure that only users in the 'NetworkAdmins' group can log in with read-write privileges. Which configuration is required?

Question 36mediummultiple choice

You are deploying a new Palo Alto Networks firewall with two ISP connections for redundancy. You want the firewall to automatically fail over to the secondary ISP if the primary path fails, using a single default route. Which interface configuration should you use?

Question 37mediummultiple choice

A security engineer needs to configure a Palo Alto Networks firewall to resolve domain names for security policy rules using an external DNS server. The firewall's management interface is in a separate management network. Which action should the engineer take to ensure that the firewall can resolve FQDNs in policy?

Question 38mediummultiple choice

You are configuring a firewall to send logs to an external syslog server. You want to ensure that only logs from the 'Traffic' log type are sent. Which configuration step is required?

Question 39hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You need to ensure that logs are sent in a structured format that includes parsed fields for easy analysis. Which syslog format should you select?

Question 40mediummultiple choice

A security administrator needs to allow outbound access to a specific set of web servers hosted on multiple IP addresses that change frequently. The administrator wants to minimize policy updates. Which Palo Alto Networks NGFW object should be used to group these IP addresses?

Question 41mediummulti select

You are configuring a Palo Alto Networks firewall to integrate with a RADIUS server for administrator authentication. You want to ensure that only users in a specific RADIUS group can log in with read-only privileges. Which two configurations are required to achieve this? (Choose two.)

Question 42mediummultiple choice

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You have created a syslog server profile and applied it to the log forwarding settings. However, the syslog server is not receiving any logs. You have verified that the firewall can ping the syslog server. What is the most likely reason for the logs not being sent?

Question 43mediummultiple choice

A security engineer is configuring a Palo Alto Networks NGFW to resolve DNS queries for data plane traffic. The engineer wants the firewall to use internal DNS servers at 10.1.1.10 and 10.1.1.11 for all DNS lookups, while the management interface should continue using external DNS servers. Where should the engineer configure the internal DNS servers?

Question 44mediummultiple choice

A security engineer is tuning a Palo Alto Networks NGFW that sits between a branch office and the internet. The branch has a single dual-stack ISP link, and management wants the firewall to automatically prefer IPv6 for outbound sessions when the destination is reachable over both protocols. The engineer must configure the firewall so that this preference applies to all virtual routers without needing per-rule changes. Which setting should be configured?

Question 45hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring an Interface Management Profile on a Palo Alto Networks NGFW to allow specific management services on a data interface. The engineer needs to enable HTTPS and SSH access for administrators from the subnet 192.168.1.0/24, and also allow Ping for troubleshooting from the same subnet. Which two settings must be configured in the Interface Management Profile to meet these requirements? (Choose two.)

Question 46hardmultiple choice

An engineer manages a Palo Alto Networks NGFW that must send its configuration backups to an external SCP server nightly. The SCP server requires key-based authentication, and the engineer has generated an SSH key pair on the firewall. The server's host key must also be validated to prevent man-in-the-middle attacks. Which sequence of steps correctly configures automated, secure configuration export to the SCP server?

Question 47easymultiple choice

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Question 48easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

Question 49mediummultiple choice

Which object type should be used to group multiple IP addresses to simplify security policy management?

Question 50mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Question 51easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which tab in the web interface is used to create and manage security policies?

Question 52hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Question 53mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Question 54mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator wants to use a specific user's group membership for policy enforcement. What is the requirement?

Question 55mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which action in a security policy should be used to drop traffic silently without sending a notification to the client?

Question 56hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You notice that the firewall is not identifying traffic as 'web-browsing' even though it is on port 80. What is the most likely cause?

Question 57easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which tab is used to configure logging settings for a specific security policy?

Question 58mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the primary function of a Security Profile Group?

Question 59easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which feature is used to ensure the firewall clock is accurate?

Question 60mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are experiencing issues with traffic passing through the firewall. What command is used to see the session table in the CLI?

Question 61easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which tab allows you to configure the firewall's hostname and domain?

Question 62mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Question 63mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the recommended way to manage certificates on a Palo Alto Networks firewall?

Question 64easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which type of interface is used for connecting to a Layer 3 network?

Question 65mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you back up the firewall's configuration?

Question 66mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

Question 67hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You need to perform a packet capture on a specific firewall interface. Which tool is used?

Question 68hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the consequence of having overlapping IP subnets on different interfaces?

Question 69mediummultiple choice

Which tab is used to view real-time log activity?

Question 70mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the recommended method to update the firewall's threat signatures?

Question 71hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you ensure that only the most secure TLS versions are used for management access?

Question 72easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What must you do after making any change in the web interface to make it active?

Question 73mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

Question 74hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the purpose of the 'Policy Optimizer' feature?

Question 75easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Where do you view the system logs to troubleshoot hardware issues?

Question 76hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you ensure that a specific security policy rule is only active during business hours?

Question 77mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the best way to monitor the firewall's CPU and memory usage?

Question 78mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When configuring an interface, what is the role of a 'Security Zone'?

Question 79easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the default action for the 'interzone-default' security policy?

Question 80mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which object type should you use to handle large lists of URLs that you want to block or allow?

Question 81mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO settings are required to configure an Interface Management Profile?

Question 82mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO objects can be used as a source in a Security Policy?

Question 83mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO items are required to configure a site-to-site IPsec VPN?

Question 84hardmulti select

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Question 85mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Question 86mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO types of logs can be forwarded to an external server?

Question 87mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO features require a valid subscription license?

Question 88hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE options are available under the 'Actions' tab of a Security Policy?

Question 89mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO types of NAT are supported in PAN-OS?

Question 90hardmulti select

Which THREE items are found under the 'Network' tab?

Question 91hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE settings can be modified in a custom Antivirus Profile?

Question 92mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO items can be configured in a Virtual Router?

Question 93hardmulti select

Which THREE steps are involved in the standard User-ID agentless configuration?

Question 94hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE items are part of the 'Device > Setup' configuration?

Question 95mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Question 96hardmulti select

Which THREE features are associated with Threat Prevention?

Question 97easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?

Question 98mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Security Profile to detect and prevent malware. Which profile is most appropriate for identifying malicious files being downloaded?

Question 99mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

Question 100mediummulti select

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Question 101hardmultiple choice

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Question 102mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Question 103mediummulti select

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

Question 104easymultiple choice

An engineer is setting up a new Palo Alto Networks firewall and needs to configure the device to send logs to an external syslog server. Which configuration step is required to ensure that logs are forwarded to the syslog server?

Question 105mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are deploying a new Palo Alto Networks NGFW at a branch office. The branch has a single ISP link that provides both IPv4 and IPv6 connectivity. You need to configure the firewall's external interface to obtain both an IPv4 and an IPv6 address dynamically from the ISP. What should you do?

Question 106mediummultiple choice

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Question 107mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

Question 108hardmultiple choice

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

Question 109mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

Question 110easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network administrator needs to configure a Palo Alto Networks firewall to send syslog messages to an external server for auditing. Which configuration path should the administrator use to add a syslog server?

Question 111easymultiple choice

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

Question 112easymultiple choice

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

Question 113mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You need to configure a Palo Alto Networks firewall to resolve domain names for its management traffic. Which DNS configuration should you set?

Question 114mediummultiple choice

You are configuring a Palo Alto Networks firewall to authenticate administrators using an external LDAP server. You want to ensure that only members of the 'IT-Admins' group can log in with read-write privileges, while other authenticated users have read-only access. What should you configure?

Question 115hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring a Palo Alto Networks firewall to use a custom certificate for the management interface (Web UI). The certificate is issued by an internal CA and has a CN of 'firewall.example.com'. After importing the certificate and private key, the engineer configures the management interface to use this certificate. However, when accessing the Web UI via https://firewall.example.com, the browser still shows a certificate warning. What is the most likely cause?

Question 116mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

Question 117easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator wants to change the firewall's hostname and configure the timezone to UTC. Which configuration path should the administrator use?

Question 118mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Question 119hardmultiple choice

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

Question 120easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are setting up a new Palo Alto Networks NGFW and need to configure the management interface. Which parameter must be configured to allow administrative access from a remote subnet?

Question 121easymultiple choice

You are setting up a new Palo Alto Networks firewall in a branch office. The management interface needs to be reachable from the internal network for administrators to manage the device. You have configured the management interface with an IP address and default gateway. Which additional configuration is required to allow management access from the internal network?

Question 122mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network security engineer is deploying a Palo Alto Networks NGFW in a data center that uses a single public IP address block. The engineer must allow several internal web servers to be reached from the internet using different public IP addresses, but only has one egress interface. Which configuration should be used to meet this requirement?

Question 123easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A firewall administrator is configuring a Palo Alto Networks NGFW and needs to ensure that management access to the firewall's web interface is only allowed from the internal network 10.0.0.0/24. The management interface is on a dedicated out-of-band network. Which configuration should the administrator use?

Question 124hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring a Palo Alto Networks NGFW to authenticate administrators using an external LDAP server. The LDAP server uses a self-signed certificate. The engineer needs to ensure that the firewall can validate the LDAP server's certificate during authentication. What should the engineer do?

Question 125mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network security administrator is deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration at a data center. The two firewalls are connected by a dedicated HA link, and each has its own management interface. The administrator needs to ensure that after a failover, the new active device automatically takes over the management IP address that administrators use to reach the Web UI, without requiring DNS changes. Which setting must be configured?

Question 126easymultiple choice

A junior administrator is setting up a new Palo Alto Networks NGFW and wants to change the idle timeout for administrators logged into the Web UI so that sessions expire after 30 minutes of inactivity. Where should this change be made?

Question 1hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE items must be configured to successfully implement User-ID mapping via an agent?

Question 2mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator needs to ensure that the firewall uses a specific internal server for DNS resolution of external traffic. Where must this be configured?

Question 3hardmultiple choice

You are deploying an HA pair. You need to ensure that the session state is synchronized immediately to prevent drops during a failover. Which setting ensures this?

Question 4mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?

Question 5mediummultiple choice

An administrator needs to ensure that App-ID is accurately identifying traffic on non-standard ports. What is the recommended approach?

Question 6mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?

Question 7mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You want to implement User-ID without installing agents on every server. What is the most efficient method to map IP addresses to usernames?

Question 8hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A company is experiencing high latency for SSL-encrypted traffic. What is the most effective device-level setting to optimize throughput?

Question 9mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?

Question 10hardmultiple choice

An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?

Question 11mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When configuring NAT, which option allows the firewall to preserve the original source IP of the traffic?

Question 12easymultiple choice

Which feature must be enabled to inspect traffic for threats?

Question 13mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which configuration object allows you to restrict traffic based on geographic location?

Question 14mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you verify if a security policy is actually matching the traffic you expect?

Question 15hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When configuring redundant power supplies, how do you verify their status?

Question 16mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What happens if a packet matches no security policies?

Question 17mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the purpose of the 'Pre-Rulebase' and 'Post-Rulebase' in Panorama?

Question 18hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When troubleshooting routing, which command allows you to test the path of a packet?

Question 19mediummultiple choice

Which configuration component allows you to map a custom port to a standard App-ID application?

Question 20mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which feature allows you to identify users without an agent by using existing network logs?

Question 21hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE actions can be performed by an Antivirus Security Profile?

Question 22mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO objects can be used to identify traffic in an Application Override policy?

Question 23mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall to support User-ID. You have successfully installed the User-ID agent on a Windows Server and connected it to the firewall. However, the firewall is not mapping IP addresses to usernames. What is the most likely cause?

Question 24hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network administrator needs to ensure that internal users can access a public-facing web server located in the DMZ using its public IP address (Hairpin NAT). The policy exists, but traffic is being dropped. Which configuration step is critical to enable this?

Question 25hardmultiple choice

A firewall is experiencing high CPU usage during traffic spikes. You suspect that App-ID is performing too much scanning on internal traffic. Which action should you take to optimize performance while maintaining security?

Question 26mediummultiple choice

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Question 27easymultiple choice

When configuring a NAT rule, you need to translate the internal IP of a server to a public IP. Which NAT type should you select for this requirement?

Question 28hardmulti select

Which THREE of the following are required components to successfully implement a Clientless VPN (SSL VPN) on a Palo Alto Networks firewall?

Question 29mediummultiple choice

You are configuring a Palo Alto Networks next-generation firewall and need to ensure that the management interface is only reachable from the internal network. You want to restrict administrative access to the web UI and SSH to a specific subnet. Which configuration step should you perform?

Question 30hardmultiple choice

A network engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall is in a high-availability (HA) active-passive pair. The engineer wants to ensure that only the active firewall sends logs to the syslog server to avoid duplicate log entries. What should the engineer configure?

Question 31easymultiple choice

A firewall administrator needs to ensure that the management interface can reach an external syslog server at 203.0.113.50 for logging. The management interface is in the 10.0.0.0/24 subnet with default gateway 10.0.0.1. Which configuration should the administrator use to allow the firewall to send logs to the external server?

Question 32mediummulti select

A network administrator is configuring a Palo Alto Networks firewall to authenticate administrators using RADIUS. Which two steps are required to complete this configuration? (Choose two.)

Question 33hardmultiple choice

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You need to ensure that logs are sent in a format that includes the firewall's hostname and the log type. Which configuration step is required?

Question 34hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. The security team requires that all traffic logs include the source user information. You have already configured User-ID and verified that user mappings are present. However, the syslog server is not receiving user information in the logs. What could be the cause?

Question 35easymultiple choice

An administrator needs to configure a Palo Alto Networks firewall to authenticate administrators using an external LDAP server for management access. The administrator wants to ensure that only users in the 'NetworkAdmins' group can log in with read-write privileges. Which configuration is required?

Question 36mediummultiple choice

You are deploying a new Palo Alto Networks firewall with two ISP connections for redundancy. You want the firewall to automatically fail over to the secondary ISP if the primary path fails, using a single default route. Which interface configuration should you use?

Question 37mediummultiple choice

A security engineer needs to configure a Palo Alto Networks firewall to resolve domain names for security policy rules using an external DNS server. The firewall's management interface is in a separate management network. Which action should the engineer take to ensure that the firewall can resolve FQDNs in policy?

Question 38mediummultiple choice

You are configuring a firewall to send logs to an external syslog server. You want to ensure that only logs from the 'Traffic' log type are sent. Which configuration step is required?

Question 39hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You need to ensure that logs are sent in a structured format that includes parsed fields for easy analysis. Which syslog format should you select?

Question 40mediummultiple choice

A security administrator needs to allow outbound access to a specific set of web servers hosted on multiple IP addresses that change frequently. The administrator wants to minimize policy updates. Which Palo Alto Networks NGFW object should be used to group these IP addresses?

Question 41mediummulti select

You are configuring a Palo Alto Networks firewall to integrate with a RADIUS server for administrator authentication. You want to ensure that only users in a specific RADIUS group can log in with read-only privileges. Which two configurations are required to achieve this? (Choose two.)

Question 42mediummultiple choice

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You have created a syslog server profile and applied it to the log forwarding settings. However, the syslog server is not receiving any logs. You have verified that the firewall can ping the syslog server. What is the most likely reason for the logs not being sent?

Question 43mediummultiple choice

A security engineer is configuring a Palo Alto Networks NGFW to resolve DNS queries for data plane traffic. The engineer wants the firewall to use internal DNS servers at 10.1.1.10 and 10.1.1.11 for all DNS lookups, while the management interface should continue using external DNS servers. Where should the engineer configure the internal DNS servers?

Question 44mediummultiple choice

A security engineer is tuning a Palo Alto Networks NGFW that sits between a branch office and the internet. The branch has a single dual-stack ISP link, and management wants the firewall to automatically prefer IPv6 for outbound sessions when the destination is reachable over both protocols. The engineer must configure the firewall so that this preference applies to all virtual routers without needing per-rule changes. Which setting should be configured?

Question 45hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring an Interface Management Profile on a Palo Alto Networks NGFW to allow specific management services on a data interface. The engineer needs to enable HTTPS and SSH access for administrators from the subnet 192.168.1.0/24, and also allow Ping for troubleshooting from the same subnet. Which two settings must be configured in the Interface Management Profile to meet these requirements? (Choose two.)

Question 46hardmultiple choice

An engineer manages a Palo Alto Networks NGFW that must send its configuration backups to an external SCP server nightly. The SCP server requires key-based authentication, and the engineer has generated an SSH key pair on the firewall. The server's host key must also be validated to prevent man-in-the-middle attacks. Which sequence of steps correctly configures automated, secure configuration export to the SCP server?

Question 47easymultiple choice

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Question 48easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

Question 49mediummultiple choice

Which object type should be used to group multiple IP addresses to simplify security policy management?

Question 50mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Question 51easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which tab in the web interface is used to create and manage security policies?

Question 52hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Question 53mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Question 54mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator wants to use a specific user's group membership for policy enforcement. What is the requirement?

Question 55mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which action in a security policy should be used to drop traffic silently without sending a notification to the client?

Question 56hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You notice that the firewall is not identifying traffic as 'web-browsing' even though it is on port 80. What is the most likely cause?

Question 57easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which tab is used to configure logging settings for a specific security policy?

Question 58mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the primary function of a Security Profile Group?

Question 59easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which feature is used to ensure the firewall clock is accurate?

Question 60mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are experiencing issues with traffic passing through the firewall. What command is used to see the session table in the CLI?

Question 61easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which tab allows you to configure the firewall's hostname and domain?

Question 62mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

Question 63mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the recommended way to manage certificates on a Palo Alto Networks firewall?

Question 64easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which type of interface is used for connecting to a Layer 3 network?

Question 65mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you back up the firewall's configuration?

Question 66mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

Question 67hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You need to perform a packet capture on a specific firewall interface. Which tool is used?

Question 68hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the consequence of having overlapping IP subnets on different interfaces?

Question 69mediummultiple choice

Which tab is used to view real-time log activity?

Question 70mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the recommended method to update the firewall's threat signatures?

Question 71hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you ensure that only the most secure TLS versions are used for management access?

Question 72easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What must you do after making any change in the web interface to make it active?

Question 73mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

Question 74hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the purpose of the 'Policy Optimizer' feature?

Question 75easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Where do you view the system logs to troubleshoot hardware issues?

Question 76hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

How do you ensure that a specific security policy rule is only active during business hours?

Question 77mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the best way to monitor the firewall's CPU and memory usage?

Question 78mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

When configuring an interface, what is the role of a 'Security Zone'?

Question 79easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

What is the default action for the 'interzone-default' security policy?

Question 80mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

Which object type should you use to handle large lists of URLs that you want to block or allow?

Question 81mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO settings are required to configure an Interface Management Profile?

Question 82mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO objects can be used as a source in a Security Policy?

Question 83mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO items are required to configure a site-to-site IPsec VPN?

Question 84hardmulti select

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Question 85mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Question 86mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO types of logs can be forwarded to an external server?

Question 87mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO features require a valid subscription license?

Question 88hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE options are available under the 'Actions' tab of a Security Policy?

Question 89mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO types of NAT are supported in PAN-OS?

Question 90hardmulti select

Which THREE items are found under the 'Network' tab?

Question 91hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE settings can be modified in a custom Antivirus Profile?

Question 92mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO items can be configured in a Virtual Router?

Question 93hardmulti select

Which THREE steps are involved in the standard User-ID agentless configuration?

Question 94hardmulti select

Read the full PAN OS Device Setting Configuration explanation →

Which THREE items are part of the 'Device > Setup' configuration?

Question 95mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Question 96hardmulti select

Which THREE features are associated with Threat Prevention?

Question 97easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?

Question 98mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Security Profile to detect and prevent malware. Which profile is most appropriate for identifying malicious files being downloaded?

Question 99mediummulti select

Read the full PAN OS Device Setting Configuration explanation →

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

Question 100mediummulti select

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Question 101hardmultiple choice

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Question 102mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Question 103mediummulti select

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

Question 104easymultiple choice

An engineer is setting up a new Palo Alto Networks firewall and needs to configure the device to send logs to an external syslog server. Which configuration step is required to ensure that logs are forwarded to the syslog server?

Question 105mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are deploying a new Palo Alto Networks NGFW at a branch office. The branch has a single ISP link that provides both IPv4 and IPv6 connectivity. You need to configure the firewall's external interface to obtain both an IPv4 and an IPv6 address dynamically from the ISP. What should you do?

Question 106mediummultiple choice

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Question 107mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

Question 108hardmultiple choice

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

Question 109mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

Question 110easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network administrator needs to configure a Palo Alto Networks firewall to send syslog messages to an external server for auditing. Which configuration path should the administrator use to add a syslog server?

Question 111easymultiple choice

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

Question 112easymultiple choice

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

Question 113mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You need to configure a Palo Alto Networks firewall to resolve domain names for its management traffic. Which DNS configuration should you set?

Question 114mediummultiple choice

You are configuring a Palo Alto Networks firewall to authenticate administrators using an external LDAP server. You want to ensure that only members of the 'IT-Admins' group can log in with read-write privileges, while other authenticated users have read-only access. What should you configure?

Question 115hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring a Palo Alto Networks firewall to use a custom certificate for the management interface (Web UI). The certificate is issued by an internal CA and has a CN of 'firewall.example.com'. After importing the certificate and private key, the engineer configures the management interface to use this certificate. However, when accessing the Web UI via https://firewall.example.com, the browser still shows a certificate warning. What is the most likely cause?

Question 116mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

Question 117easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An administrator wants to change the firewall's hostname and configure the timezone to UTC. Which configuration path should the administrator use?

Question 118mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Question 119hardmultiple choice

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

Question 120easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

You are setting up a new Palo Alto Networks NGFW and need to configure the management interface. Which parameter must be configured to allow administrative access from a remote subnet?

Question 121easymultiple choice

You are setting up a new Palo Alto Networks firewall in a branch office. The management interface needs to be reachable from the internal network for administrators to manage the device. You have configured the management interface with an IP address and default gateway. Which additional configuration is required to allow management access from the internal network?

Question 122mediummultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A network security engineer is deploying a Palo Alto Networks NGFW in a data center that uses a single public IP address block. The engineer must allow several internal web servers to be reached from the internet using different public IP addresses, but only has one egress interface. Which configuration should be used to meet this requirement?

Question 123easymultiple choice

Read the full PAN OS Device Setting Configuration explanation →

A firewall administrator is configuring a Palo Alto Networks NGFW and needs to ensure that management access to the firewall's web interface is only allowed from the internal network 10.0.0.0/24. The management interface is on a dedicated out-of-band network. Which configuration should the administrator use?

Question 124hardmultiple choice

Read the full PAN OS Device Setting Configuration explanation →

An engineer is configuring a Palo Alto Networks NGFW to authenticate administrators using an external LDAP server. The LDAP server uses a self-signed certificate. The engineer needs to ensure that the firewall can validate the LDAP server's certificate during authentication. What should the engineer do?

Question 125mediummultiple choice