NGFW-Engineer PAN OS Device Setting Configuration Practice Test 6 — 15 Questions

Question 1

How do you ensure that a specific security policy rule is only active during business hours?

Accepted Answer

Create a Schedule object. The 'Schedule' object allows you to define time-based constraints for policy rules.

Answer

Use a Security Profile

Answer

Use a Dynamic Address Group

Answer

Manually disable it

Question 2

What is the best way to monitor the firewall's CPU and memory usage?

Accepted Answer

Dashboard system resources. The Dashboard tab contains system resources widgets that show real-time CPU and memory load.

Answer

The CLI 'show version'

Answer

System logs

Answer

The traffic logs

Question 3

When configuring an interface, what is the role of a 'Security Zone'?

Accepted Answer

To associate the interface with policy rules. Assigning an interface to a security zone makes it eligible for participation in security policies.

Answer

To assign an IP address

Answer

To enable management

Answer

To handle routing

Question 4

What is the default action for the 'interzone-default' security policy?

Accepted Answer

Drop. The default security policy for traffic moving between different zones is to drop it.

Answer

Alert

Answer

Allow

Answer

Reset

Question 5

Which object type should you use to handle large lists of URLs that you want to block or allow?

Accepted Answer

External Dynamic List. External Dynamic Lists (EDL) are specifically designed to ingest and manage large lists of URLs, IPs, or domains.

Answer

Address Group

Answer

URL Category

Answer

Service Group

Question 6

Which TWO settings are required to configure an Interface Management Profile?

Accepted Answer

Permitted IP Addresses. An Interface Management Profile in PAN-OS is defined by exactly two required components: the Permitted IP Addresses (option A), which specify the source subnets or hosts allowed to reach the management interface, and the Permitted Services (option B), which enable the specific management protocols such as HTTPS, SSH, Telnet, SNMP, HTTP, and Ping on that interface. These two settings together control who can access the firewall's management plane and through which services, making them the mandatory configuration elements. Default Gateway (option C) is a network-layer setting configured on the virtual router or interface, not within the Interface Management Profile. Zone Assignment (option D) is a separate interface configuration used for security policy enforcement, not part of the management profile. DNS Server (option E) is configured globally or per virtual router for name resolution and is unrelated to the Interface Management Profile.

Answer

Default Gateway

Answer

Zone Assignment

Answer

DNS Server

Question 7

Which TWO objects can be used as a source in a Security Policy?

Accepted Answer

Address Object. In a Security Policy, the source field identifies the origin of traffic, and an Address Object (B) is a valid source because it represents IP addresses, subnets, or ranges that traffic originates from. A User Group (D) is also a valid source because policies can match traffic based on the authenticated user or group identity of the session's originator. Service Objects (A) define Layer 4 port/protocol information and belong in the Service/Application field, not the source. An Interface (C) is a zone or ingress point used in the source zone field, not a source object itself. An Application (E) identifies the application being used and is placed in the Application field, not the source.

Answer

Service Object

Answer

Interface

Answer

Application

Question 8

Which TWO items are required to configure a site-to-site IPsec VPN?

Accepted Answer

Tunnel Interface. A tunnel interface (Option A) is required because it is the logical interface that carries the encrypted traffic for the site-to-site IPsec VPN, and the IPsec tunnel is bound to it so that routes and security policies can direct traffic into the VPN. An IKE Gateway (Option E) is required because it defines the IKE Phase 1 parameters — peer IP address, pre-shared key or certificate, and IKE crypto profile — that establish the secure negotiation channel before IPsec Phase 2 is built. The DHCP Server (Option B) is not required, since a site-to-site VPN uses static peer addresses and does not depend on DHCP for tunnel establishment. A Management Profile (Option C) only controls which services (such as HTTPS, SSH, or ping) are permitted on an interface and is unrelated to VPN configuration. URL Filtering (Option D) is a security subscription feature for inspecting web traffic and plays no role in establishing a site-to-site IPsec VPN.

Answer

DHCP Server

Answer

Management Profile

Answer

URL Filtering

Question 9

Which THREE components are necessary to successfully implement SSL Forward Proxy?

Accepted Answer

Root CA Certificate. SSL Forward Proxy requires a Root CA Certificate (A) because the firewall must present a certificate signed by a CA it controls to the internal client, impersonating the external server's certificate for each SSL session it intercepts. A Decryption Profile (B) is necessary because it defines the SSL protocol settings and security checks applied to the decrypted traffic, such as blocking expired certificates, untrusted issuers, and unsupported cipher suites. A Decryption Policy (D) is required to define which traffic is decrypted, specifying source/destination zones, addresses, users, and URL categories, and to attach the decryption profile that governs the session. App-ID (C) is not a required component for implementing SSL Forward Proxy; it is used in security policy for application identification and can be leveraged after decryption but is not a prerequisite for the decryption mechanism itself. User-ID (E) is likewise not required to implement SSL Forward Proxy; it is an optional identity feature used in policy matching and does not enable the decryption function.

Answer

App-ID

Answer

User-ID

Question 10

Which TWO of the following are valid methods to authenticate administrators to the firewall?

Accepted Answer

LDAP. LDAP (A) is correct because the firewall can be configured to query an external LDAP directory (e.g., Active Directory or OpenLDAP) to validate administrator credentials, making it a legitimate authentication method. Local Database (B) is also correct because the firewall maintains its own internal user database where administrator accounts and password hashes are stored and checked locally when external authentication is unavailable or not desired. Syslog (C) is not an authentication method; it is a logging protocol used to send event and traffic logs to a remote server. NTP (D) is a time-synchronization protocol that keeps device clocks accurate and plays no role in verifying administrator identity. DHCP (E) is used to dynamically assign IP addresses and network parameters to clients, not to authenticate administrators.

Answer

Syslog

Answer

NTP

Answer

DHCP

Question 11

Which TWO types of logs can be forwarded to an external server?

Accepted Answer

Traffic Logs. Traffic Logs (A) are correct because they record session-level details such as source/destination, application, and action, and can be exported to external syslog or log-collection servers for retention and analysis. Threat Logs (C) are also correct because they capture security events like IPS, antivirus, and URL-filtering hits, and are designed to be forwarded off-box to external logging infrastructure. Firmware Logs (B) are not a forwardable log type; firmware updates are administrative events, not a log category sent to external servers. Hardware Logs (D) are not a standard forwardable log type; hardware health is monitored via system/health alerts rather than a dedicated external log stream. Interface Stats (E) are performance counters shown in monitoring dashboards, not logs forwarded to an external server.

Answer

Firmware Logs

Answer

Hardware Logs

Answer

Interface Stats

Question 12

Which TWO features require a valid subscription license?

Accepted Answer

URL Filtering. URL Filtering (B) requires a valid subscription license because it depends on Palo Alto Networks' cloud-hosted URL categorization database (BrightCloud/PAN-DB) that is continuously updated and licensed per firewall. Threat Prevention (C) also requires a valid subscription license since it relies on licensed signature and vulnerability content updates delivered through Dynamic Updates (Applications and Threats content) to detect exploits, malware, and C2 traffic. In contrast, Static Routing (A), Interface creation (D), and NAT (E) are core networking features built into PAN-OS and are available without any subscription, so they do not require a valid license.

Answer

Static Routing

Answer

Interface creation

Answer

NAT

Question 13

Which THREE options are available under the 'Actions' tab of a Security Policy?

Accepted Answer

Log at Session Start. In a Palo Alto Networks Security Policy rule, the Actions tab contains the settings that determine how the firewall handles matching traffic, including the logging options 'Log at Session Start' (A) and 'Log at Session End' (D), which control whether a log entry is generated when the session begins and/or ends. The Actions tab also includes the 'Security Profiles' setting (C), which allows you to attach a Security Profile Group or individual profiles (such as Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, and File Blocking) to the rule for threat inspection and content control. 'DNS Server' (B) is not part of a Security Policy rule; DNS server configuration is handled elsewhere, such as in the DNS Proxy or interface/global settings. 'NAT Policy' (E) is a separate policy type configured under the Policies > NAT tab, not an option within the Actions tab of a Security Policy rule.

Answer

DNS Server

Answer

NAT Policy

Question 14

Which TWO types of NAT are supported in PAN-OS?

Accepted Answer

Source NAT. PAN-OS supports Source NAT (option A), which translates the source IP address of packets—typically implemented via NAT policies that rewrite the source address as traffic egresses a zone, commonly used for hide NAT (many-to-one) or dynamic IP/port translation so internal hosts can reach external networks. PAN-OS also supports Destination NAT (option B), which translates the destination IP address (and optionally port) of incoming packets—typically used for inbound port forwarding or publishing internal servers to external clients. These two are the fundamental NAT types configurable in PAN-OS NAT policies, and both can be combined in a single policy. The other options are not PAN-OS NAT types: Global NAT (C) is not a PAN-OS NAT category, Layer 2 NAT (D) is not a supported NAT type in PAN-OS (NAT operates at Layer 3), and Application NAT (E) is not a PAN-OS NAT type—application identification is handled by App-ID, not NAT.

Answer

Global NAT

Answer

Layer 2 NAT

Answer

Application NAT

Question 15

Which THREE items are found under the 'Network' tab?

Accepted Answer

Zones. Under the 'Network' tab in PAN-OS (Palo Alto Networks firewall web interface), the correct items are Zones (A), Interfaces (B), and Virtual Routers (E). Zones (A) are logical segmentation constructs configured under Network > Zones, used to group interfaces and define trust boundaries for security policy enforcement. Interfaces (B) are configured under Network > Interfaces, where you set up Layer 2, Layer 3, virtual wire, tunnel, or loopback interfaces and assign them to zones. Virtual Routers (E) are found under Network > Virtual Routers, where routing instances, static routes, and dynamic routing protocols (OSPF, BGP, RIP) are configured. Security Profiles (C) are not under the Network tab; they reside under the Objects tab (Objects > Security Profiles) since they define threat inspection settings like antivirus, anti-spyware, and vulnerability protection. Certificate Management (D) is also not under Network; it is located under the Device tab (Device > Certificate Management) for managing device and trusted certificates.

Answer

Security Profiles

Answer

Certificate Management