NGFW-Engineer PAN OS Device Setting Configuration Practice Test 4 — 15 Questions

Question 1

An engineer manages a Palo Alto Networks NGFW that must send its configuration backups to an external SCP server nightly. The SCP server requires key-based authentication, and the engineer has generated an SSH key pair on the firewall. The server's host key must also be validated to prevent man-in-the-middle attacks. Which sequence of steps correctly configures automated, secure configuration export to the SCP server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export the firewall's public key, import the server's host key into the firewall's trusted host keys, create an SCP export schedule under Device > Setup > Operations, and reference the server profile.. Secure automated SCP export requires mutual validation: the firewall's public key must be authorized on the server, and the server's host key must be trusted by the firewall. The scheduled export then references a server profile containing the connection details. This combination ensures authentication and protects against man-in-the-middle attacks during nightly backups.

Answer

Generate a self-signed certificate on the firewall, import it into the SCP server's trust store, and configure a scheduled export using the certificate for authentication.

Answer

Enable the SCP server's SSH version 1 compatibility mode, upload the firewall's private key to the server, and create an export schedule.

Answer

Configure the SCP server profile with the server's public key, then schedule the export without importing any host keys, relying on the server profile to validate identity.

Question 2

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Accepted Answer

Management Interface Settings. The Management Interface Settings allow you to define an allowed IP address list to restrict access to the management plane.

Answer

Service Route Configuration

Answer

Device > Setup > Session

Answer

Network Profile - Interface Management

Question 3

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

Accepted Answer

Device > Setup > Services. DNS settings for the firewall management plane are found under Device > Setup > Services.

Answer

Network > Virtual Routers

Answer

Network > Interfaces

Answer

Objects > Services

Question 4

Which object type should be used to group multiple IP addresses to simplify security policy management?

Accepted Answer

Address Group. Address Groups allow the grouping of multiple address objects, simplifying policy rules.

Answer

Service Group

Answer

Address Object

Answer

Tag

Question 5

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Accepted Answer

Configure an External Dynamic List (EDL). External Dynamic Lists (EDL) allow the firewall to ingest and act upon lists of IPs or URLs from a remote source.

Answer

Create a static address group

Answer

Manually update the blocklist every hour

Answer

Use a Dynamic Address Group based on a registration API

Question 6

Which tab in the web interface is used to create and manage security policies?

Accepted Answer

Policies. The 'Policies' tab is where all firewall rule sets are managed.

Answer

Device

Answer

Objects

Answer

Network

Question 7

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

Accepted Answer

HA synchronization. High Availability (HA) synchronization ensures that configuration changes made on the primary firewall are mirrored to the secondary firewall.

Answer

Manual import/export

Answer

Panorama device groups

Answer

Schedule a daily push from the CLI

Question 8

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

Accepted Answer

URL Filtering Profile. URL Filtering profiles control access to specific categories of websites.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

Vulnerability Protection Profile

Question 9

An administrator wants to use a specific user's group membership for policy enforcement. What is the requirement?

Accepted Answer

Enable User-ID on the zone. User-ID must be configured to map users to groups for group-based policy enforcement.

Answer

Create a local user database

Answer

Increase the policy limit

Answer

Enable SSL decryption

Question 10

Which action in a security policy should be used to drop traffic silently without sending a notification to the client?

Accepted Answer

Drop. The 'Drop' action silently discards the packet, whereas 'Reset' sends a TCP RST or ICMP unreachable.

Answer

Reset

Answer

Reject

Answer

Deny

Question 11

You notice that the firewall is not identifying traffic as 'web-browsing' even though it is on port 80. What is the most likely cause?

Accepted Answer

The traffic is non-compliant with the standard protocol. App-ID relies on application signatures. If the traffic is not using standard HTTP, it will not be identified as web-browsing.

Answer

App-ID is disabled on the interface

Answer

Port 80 is not defined in the service object

Answer

The security policy is set to 'any' service

Question 12

Which tab is used to configure logging settings for a specific security policy?

Accepted Answer

Actions. The 'Actions' tab within the security policy edit window is where logging options are configured.

Answer

General

Answer

Source

Answer

Objects

Question 13

What is the primary function of a Security Profile Group?

Accepted Answer

To bundle multiple security profiles into one object. A Security Profile Group allows you to bundle multiple security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) into a single object for easy policy assignment.

Answer

To manage NAT rules

Answer

To apply profiles to specific users

Answer

To group multiple security policies

Question 14

Which feature is used to ensure the firewall clock is accurate?

Accepted Answer

NTP. NTP (Network Time Protocol) settings under Device > Setup > Services are used to synchronize time.

Answer

DHCP

Answer

DNS

Answer

SNMP

Question 15

You are experiencing issues with traffic passing through the firewall. What command is used to see the session table in the CLI?

Accepted Answer

show session all. The 'show session all' command is the standard way to view active sessions on the firewall.

Answer

debug dataplane show sessions

Answer

show system info

Answer

test policy match