NGFW-Engineer PAN OS Device Setting Configuration Practice Test 5 — 15 Questions

Question 1

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Accepted Answer

Root CA Certificate. SSL decryption requires a root CA certificate, a profile, and the activation of decryption on the policy.

Answer

App-ID

Answer

User-ID

Question 2

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Accepted Answer

LDAP. PAN-OS supports various authentication methods including local database, LDAP, RADIUS, and TACACS+.

Answer

Syslog

Answer

NTP

Answer

DHCP

Question 3

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. PAN-OS supports forwarding almost all log types (Traffic, Threat, System, etc.) to external log collectors.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 4

Which TWO features require a valid subscription license?

Accepted Answer

URL Filtering. Advanced threat features like URL filtering and Threat Prevention (Antivirus/Vulnerability) require active subscriptions.

Answer

Static Routing

Answer

Interface creation

Answer

NAT

Question 5

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. Common actions include 'Allow', 'Deny', 'Drop', 'Reset', and log forwarding configuration.

Answer

DNS Server

Answer

NAT Policy

Question 6

Which TWO objects can be used to identify traffic in an Application Override policy?

Accepted Answer

Source Address. Application override matches traffic based on source, destination, and service (port/protocol).

Answer

Security Profile

Answer

User Group

Answer

URL Category

Question 7

Which TWO types of NAT are supported in PAN-OS?

Accepted Answer

Source NAT. Source NAT and Destination NAT are the two primary NAT types.

Answer

Global NAT

Answer

Layer 2 NAT

Answer

Application NAT

Question 8

Which THREE items are found under the 'Network' tab?

Accepted Answer

Zones. The Network tab covers interfaces, virtual routers, and zones.

Answer

Security Profiles

Answer

Certificate Management

Question 9

Which THREE settings can be modified in a custom Antivirus Profile?

Accepted Answer

Protocol settings. Antivirus profiles allow you to select which protocols to scan, the action for each file type, and file blocking options.

Answer

GlobalProtect version

Answer

System hostname

Question 10

Which TWO items can be configured in a Virtual Router?

Accepted Answer

Dynamic Routing Protocols (BGP/OSPF). Virtual routers handle routing table lookups, static routes, and dynamic routing protocols (OSPF/BGP).

Answer

SSL Decryption

Answer

URL Filtering

Answer

DHCP Server

Question 11

Which THREE steps are involved in the standard User-ID agentless configuration?

Accepted Answer

Configure a Service Account. Agentless User-ID requires defining a service account, enabling WMI/WinRM, and adding the domain controller as a server to monitor.

Answer

Configure an IPsec tunnel

Answer

Install software on every user PC

Question 12

Which THREE items are part of the 'Device > Setup' configuration?

Accepted Answer

Services (DNS/NTP). Device > Setup covers global configuration like management interfaces, services, and operations.

Answer

Address objects

Answer

Security Policy rules

Question 13

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Accepted Answer

RADIUS. RADIUS and LDAP are standard industry protocols used for VPN authentication.

Answer

SNMP

Answer

DHCP

Answer

NTP

Question 14

Which THREE features are associated with Threat Prevention?

Accepted Answer

Anti-Spyware. Threat prevention includes Antivirus, Anti-Spyware, and Vulnerability Protection profiles.

Answer

Data Filtering

Answer

URL Filtering

Question 15

You are configuring a Palo Alto Networks firewall to support User-ID. You have successfully installed the User-ID agent on a Windows Server and connected it to the firewall. However, the firewall is not mapping IP addresses to usernames. What is the most likely cause?

Accepted Answer

The firewall is not configured with a Server Monitoring entry under Device > User Identification > User-ID Agents.. The firewall requires a server monitoring configuration to be defined for the specific domain controller or server being monitored by the agent.

Answer

The App-ID database has not been updated to support Windows Server 2022.

Answer

The User-ID agent needs to be configured with a static XML API key.

Answer

The Zone Protection profile is blocking the User-ID protocol.