NGFW-Engineer PAN OS Device Setting Configuration Practice Test 4 — 15 Questions

Question 1

Which tab is used to view real-time log activity?

Accepted Answer

Monitor. The 'Monitor' tab provides real-time access to traffic, threat, and system logs.

Answer

Objects

Answer

Policies

Answer

Dashboard

Question 2

What is the recommended method to update the firewall's threat signatures?

Accepted Answer

Dynamic Updates. Dynamic Updates under Device > Dynamic Updates allows for downloading and installing the latest signature packages.

Answer

Manual firmware upgrade

Answer

App-ID update

Answer

Policy import

Question 3

How do you ensure that only the most secure TLS versions are used for management access?

Accepted Answer

Via SSL/TLS Service Profile. SSL/TLS service settings under Device > Setup > Management > SSL/TLS Service Profile allow you to restrict minimum TLS versions.

Answer

Through an Interface Management Profile

Answer

By disabling HTTPS

Answer

Using a Security Policy

Question 4

What must you do after making any change in the web interface to make it active?

Accepted Answer

Commit the configuration. Changes on a Palo Alto firewall are 'staged' and only active once the 'Commit' button is pressed.

Answer

Log out

Answer

Refresh the browser

Answer

Save the configuration

Question 5

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

Accepted Answer

Threat Prevention Profiles. Threat Prevention profiles (specifically Anti-Spyware/Vulnerability Protection) detect command-and-control activity and suspicious traffic patterns.

Answer

GlobalProtect

Answer

NAT

Answer

URL Filtering

Question 6

What is the purpose of the 'Policy Optimizer' feature?

Accepted Answer

To identify and clean up unused rules. Policy Optimizer helps identify unused rules and improve policy efficiency by suggesting changes to security rules.

Answer

To increase throughput

Answer

To update threat signatures

Answer

To automatically create NAT rules

Question 7

Where do you view the system logs to troubleshoot hardware issues?

Accepted Answer

Monitor > Logs > System. The 'Monitor' tab > 'Logs' > 'System' is the central place to see all system-level events.

Answer

Dashboard

Answer

Device > Setup

Answer

Network > Interfaces

Question 8

How do you ensure that a specific security policy rule is only active during business hours?

Accepted Answer

Create a Schedule object. The 'Schedule' object allows you to define time-based constraints for policy rules.

Answer

Use a Security Profile

Answer

Use a Dynamic Address Group

Answer

Manually disable it

Question 9

What is the best way to monitor the firewall's CPU and memory usage?

Accepted Answer

Dashboard system resources. The Dashboard tab contains system resources widgets that show real-time CPU and memory load.

Answer

The CLI 'show version'

Answer

System logs

Answer

The traffic logs

Question 10

When configuring an interface, what is the role of a 'Security Zone'?

Accepted Answer

To associate the interface with policy rules. Assigning an interface to a security zone makes it eligible for participation in security policies.

Answer

To assign an IP address

Answer

To enable management

Answer

To handle routing

Question 11

What is the default action for the 'interzone-default' security policy?

Accepted Answer

Drop. The default security policy for traffic moving between different zones is to drop it.

Answer

Alert

Answer

Allow

Answer

Reset

Question 12

Which object type should you use to handle large lists of URLs that you want to block or allow?

Accepted Answer

External Dynamic List. External Dynamic Lists (EDL) are specifically designed to ingest and manage large lists of URLs, IPs, or domains.

Answer

Address Group

Answer

URL Category

Answer

Service Group

Question 13

Which TWO settings are required to configure an Interface Management Profile?

Accepted Answer

Permitted IP Addresses. Management profiles specifically enable services (like HTTP, SSH) and define permitted IP addresses.

Answer

Default Gateway

Answer

Zone Assignment

Answer

DNS Server

Question 14

Which TWO objects can be used as a source in a Security Policy?

Accepted Answer

Address Object. Policies can match traffic based on IP addresses, address groups, regions, or User-ID user groups.

Answer

Service Object

Answer

Interface

Answer

Application

Question 15

Which TWO items are required to configure a site-to-site IPsec VPN?

Accepted Answer

Tunnel Interface. VPN configuration requires a tunnel interface, a crypto profile (IKE/IPsec), and a static/dynamic route.

Answer

DHCP Server

Answer

Management Profile

Answer

URL Filtering