NGFW-Engineer PAN OS Device Setting Configuration Practice Test 3 — 15 Questions

Question 1

A firewall administrator needs to ensure that the management interface can reach an external syslog server at 203.0.113.50 for logging. The management interface is in the 10.0.0.0/24 subnet with default gateway 10.0.0.1. Which configuration should the administrator use to allow the firewall to send logs to the external server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a static route on the management interface for 203.0.113.50/32 with next hop 10.0.0.1.. The management interface has a separate routing table from the data plane. To reach an external syslog server, a static route must be added to the management routing table via the management default gateway. Service routes only select the source interface for services but do not provide routing. Security and NAT policies apply to data-plane traffic and do not affect management-plane logging.

Answer

Configure a service route for syslog to use the management interface.

Answer

Create a security policy rule allowing syslog traffic from the management interface to the syslog server.

Answer

Configure a NAT policy to translate the management interface IP to a public IP for syslog traffic.

Question 2

A network administrator is configuring a Palo Alto Networks firewall to authenticate administrators using RADIUS. Which two steps are required to complete this configuration? (Choose two.)

Accepted Answer

Create a RADIUS server profile under Device > Server Profiles > RADIUS.. To configure RADIUS authentication for administrators, you must first create a RADIUS server profile that specifies the server details. Then you create an authentication profile that references that server profile and defines the user or group mapping. Finally, you assign the authentication profile to the administrator accounts or to an authentication sequence. The other options are either non-existent global settings or optional steps.

Answer

Add the RADIUS server to the allowed IP list on the management interface.

Answer

Configure a RADIUS authentication sequence under Device > Authentication Sequence.

Answer

Enable RADIUS authentication under Device > Setup > Management > Authentication Settings.

Question 3

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You need to ensure that logs are sent in a format that includes the firewall's hostname and the log type. Which configuration step is required?

Accepted Answer

Create a syslog server profile and set the format to 'Default' which includes the hostname and log type.. The default syslog format on Palo Alto Networks firewalls includes the firewall hostname and the log type. When you create a syslog server profile and use the default format, these fields are automatically included. Therefore, no additional configuration is required beyond setting up the syslog server profile with the default format.

Answer

Configure a log forwarding profile to send logs to the syslog server, and the firewall automatically includes the hostname and log type.

Answer

Create a syslog server profile and enable the 'Include Hostname' and 'Include Log Type' checkboxes.

Answer

Create a syslog server profile and select the 'Custom Log Format' option, then define a format that includes the hostname and log type.

Question 4

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. The security team requires that all traffic logs include the source user information. You have already configured User-ID and verified that user mappings are present. However, the syslog server is not receiving user information in the logs. What could be the cause?

Accepted Answer

The syslog server profile is not configured to include user information in the log format.. The syslog server profile on PAN-OS includes an option to include user information in the log format. By default, this may be disabled. Enabling it ensures that the user field is populated in traffic logs sent to the syslog server. Other options are either already satisfied or unrelated to the log content.

Answer

User-ID is not enabled on the zone where the traffic originates.

Answer

The syslog server is not configured to parse the user field from the logs.

Answer

The firewall's management interface is not configured to allow syslog traffic.

Question 5

An administrator needs to configure a Palo Alto Networks firewall to authenticate administrators using an external LDAP server for management access. The administrator wants to ensure that only users in the 'NetworkAdmins' group can log in with read-write privileges. Which configuration is required?

Accepted Answer

Create an LDAP server profile, an authentication profile, and an authorization profile, then configure the administrator account to use the authentication profile.. To enable LDAP authentication for administrators, you must create an LDAP server profile to define the server connection, an authentication profile to specify the authentication method, and an authorization profile to map the LDAP group 'NetworkAdmins' to a read-write role. Then, you configure the administrator account to use the authentication profile. This allows LDAP users in that group to log in with the appropriate privileges.

Answer

Create a local user account for each administrator and add them to the 'NetworkAdmins' group on the firewall.

Answer

Create an LDAP server profile, an authentication profile, and an authorization profile, then assign the authentication profile to the management interface.

Answer

Create a RADIUS server profile, an authentication profile, and a authorization profile, then assign the authentication profile to the management interface.

Question 6

You are deploying a new Palo Alto Networks firewall with two ISP connections for redundancy. You want the firewall to automatically fail over to the secondary ISP if the primary path fails, using a single default route. Which interface configuration should you use?

Accepted Answer

Configure a policy-based forwarding (PBF) rule to redirect traffic to the secondary ISP when the primary fails.. Policy-based forwarding (PBF) with path monitoring enables automatic failover between two ISPs by overriding the default route when the primary path fails. A single default route can point to the primary next hop, while a PBF rule with path monitoring redirects traffic to the secondary ISP upon failure. This design is simpler than dynamic routing and meets the requirement for automatic failover.

Answer

Configure a loopback interface and assign both ISP IPs to it.

Answer

Configure a redundant interface group with both ISP links as members.

Answer

Configure a tunnel interface and route all traffic through a VPN.

Question 7

A security engineer needs to configure a Palo Alto Networks firewall to resolve domain names for security policy rules using an external DNS server. The firewall's management interface is in a separate management network. Which action should the engineer take to ensure that the firewall can resolve FQDNs in policy?

Accepted Answer

Configure the DNS server IP address under Device > Setup > Services > DNS, and ensure the management interface can reach the DNS server.. The firewall resolves FQDNs for policy using the DNS servers configured under Device > Setup > Services > DNS. You must enter the DNS server IP address and ensure the management interface can reach it. This enables the firewall to perform DNS lookups for FQDN objects, which are then used in security policies. The other options refer to non-existent settings or features that do not enable the firewall's own DNS resolution.

Answer

Add the DNS server to the allowed IP list on the management interface and enable DNS resolution under Device > Setup > Management > DNS.

Answer

Configure a DNS proxy under Device > Setup > Services > DNS Proxy and assign it to the management interface.

Answer

Create a DNS server profile under Device > Server Profiles > DNS and assign it to a security policy rule.

Question 8

You are configuring a firewall to send logs to an external syslog server. You want to ensure that only logs from the 'Traffic' log type are sent. Which configuration step is required?

Accepted Answer

Create a syslog server profile and select the 'Traffic' log type.. The syslog server profile is where you define the server address and select which log types (Traffic, Threat, System, etc.) to send. By selecting only 'Traffic', you ensure that only those logs are forwarded. Log forwarding profiles are used for forwarding but do not filter by log type; they rely on the syslog server profile's settings.

Answer

Configure a log forwarding profile with a filter for 'Traffic' logs.

Answer

Set the log severity level to 'informational' to capture Traffic logs.

Answer

Enable 'Traffic' logs in the Device > Log Settings page.

Question 9

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You need to ensure that logs are sent in a structured format that includes parsed fields for easy analysis. Which syslog format should you select?

Accepted Answer

CSV. PAN-OS supports syslog formats: BSD, IETF, and CSV. CSV (Comma Separated Values) provides a structured, delimited format where each field corresponds to a log attribute, making it ideal for parsing and analysis by external systems. BSD and IETF are unstructured text formats that require additional parsing. Therefore, CSV is the correct choice for structured logs with parsed fields.

Answer

BSD

Answer

LEEF

Answer

IETF

Question 10

A security administrator needs to allow outbound access to a specific set of web servers hosted on multiple IP addresses that change frequently. The administrator wants to minimize policy updates. Which Palo Alto Networks NGFW object should be used to group these IP addresses?

Accepted Answer

Address Group. An Address Group is the appropriate object to group multiple IP addresses, allowing security policies to reference the group. This simplifies management when IP addresses change, as only the group membership needs updating. Other group types like Service Group or Application Group do not group IP addresses, and Dynamic Address Group is overkill for a static list.

Answer

Service Group

Answer

Dynamic Address Group

Answer

Application Group

Question 11

You are configuring a Palo Alto Networks firewall to integrate with a RADIUS server for administrator authentication. You want to ensure that only users in a specific RADIUS group can log in with read-only privileges. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create an authentication profile that points to the RADIUS server and includes the user group.. To integrate RADIUS for administrator authentication with group-based privileges, you need an authentication profile to define the RADIUS server and allowed group, and an authorization role to map that group to a read-only role. These two configurations are essential for the desired outcome.

Answer

Create a security policy rule allowing RADIUS traffic from the firewall to the RADIUS server.

Answer

Enable LDAP integration to synchronize user groups.

Answer

Set up a local user account with the same username as the RADIUS user.

Question 12

You are configuring a Palo Alto Networks firewall to send logs to an external syslog server. You have created a syslog server profile and applied it to the log forwarding settings. However, the syslog server is not receiving any logs. You have verified that the firewall can ping the syslog server. What is the most likely reason for the logs not being sent?

Accepted Answer

The syslog server is configured to use TCP, but the firewall is sending logs over UDP.. A protocol mismatch between the firewall's syslog server profile and the actual server configuration is a frequent cause of logs not being received. Since connectivity is verified, the next step is to check that both sides use the same transport protocol and port.

Answer

The log forwarding profile is not applied to the correct log type.

Answer

The firewall's management interface is not configured with a default gateway.

Answer

The syslog server is not configured to accept logs from the firewall's IP address.

Question 13

A security engineer is configuring a Palo Alto Networks NGFW to resolve DNS queries for data plane traffic. The engineer wants the firewall to use internal DNS servers at 10.1.1.10 and 10.1.1.11 for all DNS lookups, while the management interface should continue using external DNS servers. Where should the engineer configure the internal DNS servers?

Accepted Answer

Device > Setup > Services > DNS settings for the data plane, or via a DNS server profile applied to the virtual router.. The firewall's data plane DNS resolution can be configured separately from management DNS. By setting internal DNS servers under Device > Setup > Services > DNS settings for the data plane, or by applying a DNS server profile to the virtual router, the engineer ensures that data plane traffic uses internal DNS while management retains external DNS. Static entries or DNS Proxy do not achieve this separation.

Answer

Device > Setup > Services > DNS settings for the management interface.

Answer

Configure a static DNS entry in the hosts file for each domain the firewall needs to resolve.

Answer

Network > Virtual Routers > DNS Proxy settings.

Question 14

A security engineer is tuning a Palo Alto Networks NGFW that sits between a branch office and the internet. The branch has a single dual-stack ISP link, and management wants the firewall to automatically prefer IPv6 for outbound sessions when the destination is reachable over both protocols. The engineer must configure the firewall so that this preference applies to all virtual routers without needing per-rule changes. Which setting should be configured?

Accepted Answer

Set the virtual router's IPv6 preference to Prefer IPv6 in the Device > Virtual Router > Advanced settings.. The IPv6 preference option under the virtual router's advanced settings is the only mechanism that makes the forwarding table prefer an IPv6 next hop when both an IPv4 and an IPv6 route cover the same destination. Because it is configured once per virtual router, it satisfies the requirement that no per-rule changes be needed and that the behavior apply universally to traffic handled by that router.

Answer

Create a static default route with an IPv6 next hop and a metric lower than the IPv4 default route.

Answer

Configure a Policy Based Forwarding (PBF) rule that matches all traffic and specifies the IPv6 next hop.

Answer

Enable IPv6 on the outside zone and rely on the default longest-prefix-match behavior of the virtual router forwarding table.

Question 15

An engineer is configuring an Interface Management Profile on a Palo Alto Networks NGFW to allow specific management services on a data interface. The engineer needs to enable HTTPS and SSH access for administrators from the subnet 192.168.1.0/24, and also allow Ping for troubleshooting from the same subnet. Which two settings must be configured in the Interface Management Profile to meet these requirements? (Choose two.)

Accepted Answer

Enable SSH and specify 192.168.1.0/24 as the permitted IP address.. To allow HTTPS and SSH access from a specific subnet on an interface, the Interface Management Profile must have HTTPS and SSH enabled, each with the permitted IP address 192.168.1.0/24. Ping, HTTP, and SNMP are not required for the stated access needs. Therefore, the two correct settings are enabling HTTPS and enabling SSH with the specified subnet.

Answer

Enable SNMP and specify 192.168.1.0/24 as the permitted IP address.

Answer

Enable Ping and specify 192.168.1.0/24 as the permitted IP address.

Answer

Enable HTTP and specify 192.168.1.0/24 as the permitted IP address.