NGFW-Engineer PAN OS Device Setting Configuration Practice Test 2 — 15 Questions

Question 1

What happens if a packet matches no security policies?

Accepted Answer

It is dropped by default. The 'intrazone-default' and 'interzone-default' rules define the implicit behavior for unmatched traffic, which is to drop.

Answer

It is sent to the management plane

Answer

It is allowed by default

Answer

It is logged as a threat

Question 2

What is the purpose of the 'Pre-Rulebase' and 'Post-Rulebase' in Panorama?

Accepted Answer

To enforce global policies that cannot be overridden. These allow administrators to enforce global security policies that cannot be modified by local device administrators.

Answer

To group devices by region

Answer

To increase policy processing speed

Answer

To manage NAT rules specifically

Question 3

When troubleshooting routing, which command allows you to test the path of a packet?

Accepted Answer

test routing fib-lookup. The 'test routing fib-lookup' command is the primary tool for verifying how the firewall will route a packet.

Answer

traceroute

Answer

show routing route

Answer

ping

Question 4

Which configuration component allows you to map a custom port to a standard App-ID application?

Accepted Answer

Service Object. Custom App-ID or Application Override can be used, but generally, Palo Alto recommends defining custom services if the application is not standard.

Answer

Security Profile

Answer

Tag Object

Answer

Address Object

Question 5

Which feature allows you to identify users without an agent by using existing network logs?

Accepted Answer

Syslog-based User-ID. Syslog-based User-ID mapping allows the firewall to parse log messages from other servers to map IP to user.

Answer

...

Answer

Captive Portal

Answer

GlobalProtect

Answer

Active Directory Agent

Question 6

Which THREE actions can be performed by an Antivirus Security Profile?

Accepted Answer

Block. Antivirus profiles can block, alert, or quarantine malicious files.

Answer

Reset

Answer

Drop

Question 7

Which TWO objects can be used to identify traffic in an Application Override policy?

Accepted Answer

Source Address. In a Palo Alto Networks Application Override policy, traffic is matched using the same match criteria as a normal security policy, which includes Source Address (A) and Service (E). The Source Address identifies the origin of the traffic by IP address or address object, and the Service identifies the destination port/protocol (e.g., tcp/8080) so the firewall knows which sessions to force through the specified custom App-ID signature. Security Profile (B) is not a match criterion but an action applied to permitted traffic, User Group (C) is a source-user/group match used in security policy but not part of the Application Override match set, and URL Category (D) is a web-filtering match that is not used to identify traffic for an Application Override policy.

Answer

Security Profile

Answer

User Group

Answer

URL Category

Question 8

You are configuring a Palo Alto Networks firewall to support User-ID. You have successfully installed the User-ID agent on a Windows Server and connected it to the firewall. However, the firewall is not mapping IP addresses to usernames. What is the most likely cause?

Accepted Answer

The firewall is not configured with a Server Monitoring entry under Device > User Identification > User-ID Agents.. The firewall requires a server monitoring configuration to be defined for the specific domain controller or server being monitored by the agent.

Answer

The App-ID database has not been updated to support Windows Server 2022.

Answer

The User-ID agent needs to be configured with a static XML API key.

Answer

The Zone Protection profile is blocking the User-ID protocol.

Question 9

A network administrator needs to ensure that internal users can access a public-facing web server located in the DMZ using its public IP address (Hairpin NAT). The policy exists, but traffic is being dropped. Which configuration step is critical to enable this?

Accepted Answer

The NAT rule must have the destination zone set to the DMZ and the source interface as the internal interface.. Hairpin NAT requires the security policy to allow the traffic into the zone where the server resides and for the NAT rule to be correctly configured with the source zone set to the internal zone.

Answer

Enable 'Disable Server Response Inspection' on the NAT policy.

Answer

Set the security policy action to 'Allow' and enable 'Source Translation'.

Answer

Configure an external Proxy ARP entry for the public IP address.

Question 10

A firewall is experiencing high CPU usage during traffic spikes. You suspect that App-ID is performing too much scanning on internal traffic. Which action should you take to optimize performance while maintaining security?

Accepted Answer

Create an Application Override policy for known trusted internal traffic.. Creating an App-ID override or adjusting security policies to use more specific signatures can reduce unnecessary processing, but creating an Application Filter/Group is the standard method for management; however, using 'Application Override' is the direct way to bypass App-ID for known, trusted traffic.

Answer

Increase the packet buffer size in Device > Setup.

Answer

Disable the Content-ID engine globally.

Answer

Enable 'Strict' mode in the App-ID engine.

Question 11

You have configured an IPsec VPN tunnel between two sites, but the tunnel status shows 'init-passive' and never transitions to 'up'. What is the most likely configuration error?

Accepted Answer

The IKE Gateway configuration has a mismatched Local/Peer ID.. An 'init-passive' state indicates that the firewall is waiting for the peer to initiate the connection, suggesting a mismatch in initiator/responder settings or phase 1 proposal parameters.

Answer

The physical interface is not in the correct zone.

Answer

The security policy is missing a rule for IPsec traffic.

Answer

The tunnel interface is not assigned an IP address.

Question 12

When configuring a NAT rule, you need to translate the internal IP of a server to a public IP. Which NAT type should you select for this requirement?

Accepted Answer

Destination NAT. Destination NAT is the correct type for mapping a public-facing IP address to an internal server IP.

Answer

Bidirectional NAT

Answer

Dynamic IP and Port

Answer

NPTv6

Answer

Static NAT

Question 13

Which THREE of the following are required components to successfully implement a Clientless VPN (SSL VPN) on a Palo Alto Networks firewall?

Accepted Answer

SSL VPN Portal. Clientless VPN requires a portal, gateway, and specific application configuration to function.

Answer

GlobalProtect Agent

Answer

IPsec Tunnel Interface

Question 14

You are configuring a Palo Alto Networks next-generation firewall and need to ensure that the management interface is only reachable from the internal network. You want to restrict administrative access to the web UI and SSH to a specific subnet. Which configuration step should you perform?

Accepted Answer

Create a management profile with permitted IP addresses and apply it to the management interface.. The management interface on a Palo Alto Networks firewall is configured with a management profile that defines which IP addresses can access specific services. By creating a profile that permits only the internal subnet and applying it to the management interface, you restrict administrative access to that subnet. This is the standard method for securing management access.

Answer

Set up an administrative role that only allows access from the internal subnet.

Answer

Enable the 'Permitted IP Addresses' setting under Device > Setup > Management.

Answer

Configure a security policy rule from the internal zone to the management zone allowing only the desired subnet.

Question 15

A network engineer is configuring a Palo Alto Networks firewall to send logs to an external syslog server. The firewall is in a high-availability (HA) active-passive pair. The engineer wants to ensure that only the active firewall sends logs to the syslog server to avoid duplicate log entries. What should the engineer configure?

Accepted Answer

In the log forwarding profile, select the option to send logs only from the active HA peer.. In an active-passive HA configuration, both firewalls may generate logs, but to avoid duplicate entries on the syslog server, the log forwarding profile should be configured to send logs only from the active HA peer. This ensures that only the firewall currently handling traffic forwards logs, while the passive firewall does not, thus preventing duplicates. This setting is available in the log forwarding profile configuration.

Answer

Configure a syslog server profile on the active firewall only and synchronize the configuration to the passive firewall.

Answer

Use a dynamic routing protocol to advertise the syslog server only from the active firewall.

Answer

Enable HA logging on both firewalls and set the syslog server to only accept logs from the active firewall's IP.