NGFW-Engineer PAN OS Device Setting Configuration Practice Test 7 — 15 Questions

Question 1

Which THREE settings can be modified in a custom Antivirus Profile?

Accepted Answer

Protocol settings. In a custom Antivirus Profile on Palo Alto Networks firewalls, option B (Protocol settings) is correct because the profile lets you enable/disable scanning per protocol (HTTP, FTP, SMTP, IMAP, POP3, SMB) and configure decode settings such as maximum file size and decode depth for each. Option C (File type exceptions) is correct because the profile includes a File Blocking/exception list where you specify file types (by extension or MIME type) that should be exempted from antivirus scanning. Option D (Action for detected malware) is correct because each antivirus signature is assigned an action such as alert, drop, reset-both, or block, which is configurable within the profile. Option A (GlobalProtect version) is not part of an Antivirus Profile; it is configured in the GlobalProtect portal/agent settings. Option E (System hostname) is a device-level setting configured under Device > Setup, not within an Antivirus Profile.

Answer

GlobalProtect version

Answer

System hostname

Question 2

Which TWO items can be configured in a Virtual Router?

Accepted Answer

Dynamic Routing Protocols (BGP/OSPF). In a Palo Alto Networks virtual router, you can configure Dynamic Routing Protocols such as BGP and OSPF (Option A), because the virtual router is the Layer 3 routing instance that runs routing protocol processes and exchanges routes with peers. You can also configure Static Routes (Option E), since static routes are defined within the virtual router's routing table to direct traffic to specific next hops or interfaces. SSL Decryption (Option B) is a security profile/decryption policy function, not a virtual router setting. URL Filtering (Option C) is a security profile applied in security policy, not configured on the virtual router. DHCP Server (Option D) is configured on an interface or as a separate service, not as a virtual router routing feature.

Answer

SSL Decryption

Answer

URL Filtering

Answer

DHCP Server

Question 3

Which THREE steps are involved in the standard User-ID agentless configuration?

Accepted Answer

Configure a Service Account. In the standard User-ID agentless configuration, you must first configure a Service Account (option A) — a dedicated domain account with the required privileges (e.g., Event Log Readers, Distributed COM Users) that the firewall uses to query the Domain Controllers for security event logs. You must also enable WMI or WinRM (option C) on the Domain Controllers, since the firewall relies on these protocols (WMI/DCOM or WinRM) to remotely read the logon events that map users to IP addresses. Finally, you add the Domain Controller to Server Monitoring (option E) on the firewall, which registers the DC as a monitored source for User-ID so the firewall can pull the logon/logoff events. Option B (IPsec tunnel) is not part of User-ID agentless setup — it is a VPN/IPsec configuration unrelated to user mapping. Option D (install software on every user PC) describes the User-ID agent or GlobalProtect-based approach, not the agentless method, which requires no endpoint software.

Answer

Configure an IPsec tunnel

Answer

Install software on every user PC

Question 4

Which THREE items are part of the 'Device > Setup' configuration?

Accepted Answer

Services (DNS/NTP). The 'Device > Setup' section in PAN-OS contains the Services tab, where DNS servers, NTP servers, and other global services are configured, so option C is correct. It also includes the Management tab, which holds Management Interface settings such as IP address, default gateway, and permitted IP addresses, making option D correct. The Operations tab within Device > Setup provides configuration backup and restore, as well as other operational tasks, so option E is correct. Address objects (A) are configured under the Objects tab, and Security Policy rules (B) are configured under the Policies tab, so neither belongs to Device > Setup.

Answer

Address objects

Answer

Security Policy rules

Question 5

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Accepted Answer

RADIUS. RADIUS (C) is correct because PAN-OS natively supports RADIUS as an external authentication server for VPN user authentication, allowing the firewall to forward user credentials to a RADIUS server for validation via the Authentication profile. LDAP (E) is also correct because PAN-OS supports LDAP servers (including Active Directory) for VPN user authentication, querying the directory to authenticate users and optionally retrieve group memberships for policy enforcement. SNMP (A) is incorrect because it is a network management protocol used for monitoring and collecting device statistics, not for authenticating VPN users. DHCP (B) is incorrect because it is used for dynamic IP address assignment, not user authentication. NTP (D) is incorrect because it synchronizes system clocks across devices and plays no role in authenticating VPN users.

Answer

SNMP

Answer

DHCP

Answer

NTP

Question 6

Which THREE features are associated with Threat Prevention?

Accepted Answer

Anti-Spyware. Threat Prevention is the Palo Alto Networks security subscription that bundles Anti-Spyware (A), Antivirus (B), and Vulnerability Protection (E) into a single license, so all three are correctly associated with it. Anti-Spyware (A) detects and blocks command-and-control traffic, spyware downloads, and DNS-based callbacks via signatures and DNS sinkholing. Antivirus (B) inspects traffic and file transfers for malware, viruses, and worms using stream-based and file-based signatures. Vulnerability Protection (E) blocks exploits targeting known software vulnerabilities (e.g., buffer overflows, code execution) with IPS-style signatures. Data Filtering (C) belongs to the Data Loss Prevention subscription, which identifies and controls sensitive data patterns, and URL Filtering (D) is a separate subscription that categorizes and controls web access, so neither is part of Threat Prevention.

Answer

Data Filtering

Answer

URL Filtering

Question 7

You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?

Accepted Answer

Device > Dynamic Updates. Dynamic update scheduling is configured under the Device tab in the PAN-OS web interface.

Answer

Objects > Dynamic Updates

Answer

Policies > Security > Dynamic Updates

Answer

Network > Interfaces > Dynamic Updates

Question 8

You are configuring a Security Profile to detect and prevent malware. Which profile is most appropriate for identifying malicious files being downloaded?

Accepted Answer

WildFire Analysis. The WildFire Analysis profile is specifically designed to identify and sandbox suspicious files to detect malware.

Answer

Data Filtering

Answer

URL Filtering

Answer

Vulnerability Protection

Question 9

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

Accepted Answer

Local Database. Option A (Local Database) is correct because the Palo Alto Networks firewall maintains a built-in local user database where administrators can be created under Device > Administrators and authenticated directly against the firewall's management plane. Option C (RADIUS) is correct because the firewall supports external authentication profiles, including RADIUS, which can be assigned to administrator accounts for management-plane login. DNS (B) is a name-resolution service, DHCP (D) is for dynamic IP address assignment, and NTP (E) is for time synchronization — none of these authenticate administrators to the management plane.

Answer

DNS

Answer

DHCP

Answer

NTP

Question 10

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

Accepted Answer

Source IP address. When configuring a Service Route, the firewall needs to know which source IP address to use for the traffic, so option B (Source IP address) is correct because it defines the source address that will be used for the service's outbound traffic. Option C (Source Interface) is also correct because the Service Route must specify the interface through which the service traffic will egress, ensuring the firewall uses that specific interface for external traffic. Option A (Destination MAC address) is not required because Service Routes operate at Layer 3 and do not need a destination MAC address. Option D (Default Gateway) is not a Service Route setting; routing is handled separately by the virtual router's default route. Option E (VLAN Tag) is not part of Service Route configuration; VLAN tagging is configured on the interface or subinterface, not in the Service Route itself.

Answer

Destination MAC address

Answer

Default Gateway

Answer

VLAN Tag

Question 11

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Accepted Answer

Create a log forwarding profile and apply it to the security policy that matches the desired traffic.. To forward logs from a specific security policy, you create a log forwarding profile and attach it to that security policy. This ensures only logs from that policy are sent. Other methods like assigning to management interface or zones are incorrect because log forwarding is policy-specific.

Answer

Configure a syslog server profile and assign it to the management interface.

Answer

Use a log filter in the syslog server profile to exclude logs from other policies.

Answer

Create a log forwarding profile and apply it to the security zone where the traffic originates.

Question 12

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Accepted Answer

In the management interface settings, set Permitted IP Addresses to 10.10.10.0/24 and disable all management services except HTTPS.. To restrict management access to a specific subnet and enable only HTTPS, the engineer must configure the management interface's Permitted IP Addresses to the desired subnet and disable all other management services except HTTPS. This ensures that only hosts from the allowed subnet can reach the management interface using the secure protocol. This is a standard device setting configuration on Palo Alto Networks firewalls.

Answer

Configure a security policy from the trust zone to the management zone allowing only 10.10.10.0/24 to the management IP on port 443, and set the management interface to use only HTTPS.

Answer

Create a Management Interface Profile that permits only 10.10.10.0/24 and enable only HTTPS, then apply it to the management interface.

Answer

Create a NAT policy that translates the management IP to a public IP and restrict access using a security policy from the untrust zone.

Question 13

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

Accepted Answer

Configure an authorization profile that maps the LDAP group 'NGFW-Admins' to a read-write admin role and 'NGFW-Auditors' to a read-only role.. To authenticate administrators against LDAP and assign different privileges, the firewall needs an authentication profile to contact the directory and validate credentials, plus an authorization profile to map directory groups to admin roles. Together these provide both authentication and role-based authorization. Other options relate to data-plane features, certificate handling, or User-ID, none of which grant differentiated admin access based on LDAP group membership.

Answer

Configure a certificate profile that validates the LDAP server's certificate for administrator logins.

Answer

Enable User-ID on the management interface to discover the LDAP groups.

Answer

Create a security policy rule that allows LDAP traffic from the management interface to the LDAP server.

Question 14

An engineer is setting up a new Palo Alto Networks firewall and needs to configure the device to send logs to an external syslog server. Which configuration step is required to ensure that logs are forwarded to the syslog server?

Accepted Answer

Create a syslog server profile under Device > Server Profiles > Syslog and assign it to a log forwarding profile.. To forward logs to an external syslog server, you must create a syslog server profile that defines the server's IP address, port, facility, and log format. Then you create a log forwarding profile that references this server profile and attach it to the relevant security policies or log sources. This two-step process ensures that logs are both destined for the correct server and matched for forwarding. Without both components, logs remain local.

Answer

Add the syslog server IP address to the management interface allowed IP list.

Answer

Enable syslog forwarding globally under Device > Setup > Management > Logging.

Answer

Configure a syslog server under Device > Setup > Services > Syslog.

Question 15

You are deploying a new Palo Alto Networks NGFW at a branch office. The branch has a single ISP link that provides both IPv4 and IPv6 connectivity. You need to configure the firewall's external interface to obtain both an IPv4 and an IPv6 address dynamically from the ISP. What should you do?

Accepted Answer

Configure the interface as a Layer 3 interface, enable DHCP for IPv4, and enable DHCPv6 for IPv6.. A Layer 3 interface with both DHCP and DHCPv6 enabled allows the firewall to act as a client for both protocols, acquiring IPv4 and IPv6 addresses dynamically from the ISP. This is the standard method for dual-stack dynamic addressing on PAN-OS. Other options either do not support dynamic assignment or rely on protocols that may not be available.

Answer

Configure the interface as a Layer 3 interface and assign static IPv4 and IPv6 addresses provided by the ISP.

Answer

Configure the interface as a Layer 2 interface and enable PPPoE for both IPv4 and IPv6.

Answer

Configure the interface as a Layer 3 interface and enable DHCP for IPv4 only; IPv6 addresses are automatically assigned via SLAAC.