NGFW-Engineer PAN OS Device Setting Configuration Practice Test 8 — 15 Questions

Question 1

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policies > Security. Security policy rules are created under Policies > Security. This tab allows you to specify match criteria such as zones, addresses, and applications, and to set actions like allow or deny. It is also where you attach security profiles for inspection. The other tabs serve different purposes: NAT for address translation, Zones for zone definition, and Applications for custom app signatures.

Answer

Network > Zones

Answer

Policies > NAT

Answer

Objects > Applications

Question 2

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Source NAT with dynamic IP and port (PAT) using the interface address.. The branch requires that all outbound traffic from the internal subnet appears to come from a single public IP. Source NAT with dynamic IP and port, using the interface address, translates both source IP and port, enabling many-to-one translation. This is the standard method for sharing one public IP among many internal hosts while preserving return path routing via the firewall's session table.

Answer

Source NAT with static IP mapping to a one-to-one public address.

Answer

Destination NAT with dynamic IP and port using the interface address for inbound traffic.

Answer

Destination NAT with a static IP mapping to the internal server.

Question 3

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the User-ID agent is configured to monitor the correct Domain Controller and that the firewall's User-ID agent settings include the correct source IP for the agent.. When User-ID agent connectivity is established but user mappings are missing, the most likely causes are incorrect Domain Controller monitoring or incorrect agent source IP configuration on the firewall. Verifying that the agent monitors the right Domain Controller and that the firewall recognizes the agent's IP ensures that user mapping data is correctly received and processed.

Answer

Verify that the security policy includes a rule allowing traffic from the User-ID agent to the firewall's management interface.

Answer

Ensure that the LDAP server profile uses port 389 for LDAP over SSL.

Answer

Check that the firewall's management interface has a default gateway configured.

Question 4

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

Accepted Answer

Virtual Router with path monitoring. Path monitoring within a Virtual Router enables the firewall to detect when a monitored path becomes unreachable and to remove the associated route from the routing table. This allows a backup default route to take over, achieving automatic ISP failover. Link aggregation and HA address different redundancy needs, while PBF does not provide automatic failover.

Answer

Policy-Based Forwarding (PBF)

Answer

High Availability (HA) active/passive

Answer

Link Aggregation Group (LAG)

Question 5

A network administrator needs to configure a Palo Alto Networks firewall to send syslog messages to an external server for auditing. Which configuration path should the administrator use to add a syslog server?

Accepted Answer

Device > Server Profiles > Syslog. To send syslog messages to an external server, you must first create a syslog server profile under Device > Server Profiles > Syslog. This profile defines the server's details. Then, you can use this profile in log forwarding configurations to direct specific logs to that server. The other paths are for different purposes: log forwarding profiles, interface settings, and management settings.

Answer

Objects > Log Forwarding

Answer

Device > Setup > Management

Answer

Network > Interfaces

Question 6

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

Accepted Answer

Assign a management IP address, configure a default gateway, and restrict management access to specific IP addresses via the management interface settings.. The management interface should be configured with a static IP address and default gateway for reliable remote access. To secure management, restrict access to specific trusted IP addresses using the permitted IP list in the management interface settings. This prevents unauthorized hosts from attempting to connect to the management interface.

Answer

Assign a management IP address and enable DHCP client on the management interface.

Answer

Assign a management IP address and configure a security policy to allow management traffic from any zone.

Answer

Assign a management IP address and enable HTTP for management access.

Question 7

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

Accepted Answer

Management interface. The management interface is specifically designed for out-of-band management and allows you to restrict access via a management profile. You can specify permitted IP addresses and services. While other interfaces can be used for management in some designs, the dedicated management interface is the standard and most secure method for restricting management access.

Answer

Layer 3 interface

Answer

Layer 2 interface

Answer

Loopback interface

Question 8

You need to configure a Palo Alto Networks firewall to resolve domain names for its management traffic. Which DNS configuration should you set?

Accepted Answer

Device > Setup > Management > DNS Settings. DNS settings for the firewall's management plane are configured under Device > Setup > Management > DNS Settings. This is where you specify the DNS servers that the firewall uses for its own name resolution. The other options are either for different purposes (DNS Proxy for clients) or do not exist.

Answer

Objects > DNS Servers

Answer

Network > DNS Proxy

Answer

Device > Setup > Services > DNS

Question 9

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an authentication profile that points to the LDAP server, and assign an administrator role based on the LDAP group.. Authentication profiles in PAN-OS allow integration with LDAP servers. By creating an authentication profile and assigning it to administrator accounts, you can authenticate against LDAP. To assign roles based on group membership, you can use group mapping profiles that map LDAP groups to PAN-OS roles. This ensures IT-Admins get read-write access while others get read-only.

Answer

Configure a RADIUS server profile and use vendor-specific attributes to assign roles.

Answer

Create a local administrator account for each IT-Admins member and assign read-write role, and a generic read-only account for others.

Answer

Configure a SAML authentication profile and map SAML attributes to roles.

Question 10

An engineer is configuring a Palo Alto Networks firewall to use a custom certificate for the management interface (Web UI). The certificate is issued by an internal CA and has a CN of 'firewall.example.com'. After importing the certificate and private key, the engineer configures the management interface to use this certificate. However, when accessing the Web UI via https://firewall.example.com, the browser still shows a certificate warning. What is the most likely cause?

Accepted Answer

The certificate is not trusted by the browser because the internal CA is not in the browser's trust store.. The most likely cause is that the internal CA's root certificate is not trusted by the browser. Even with the correct certificate configured on the firewall, the browser will warn until the CA is trusted. The CN matches, the private key likely matches, and the custom certificate is presumably applied. Therefore, the missing trust chain is the issue.

Answer

The certificate's CN does not match the hostname used to access the firewall.

Answer

The management interface is not configured to use the custom certificate; it is still using the default certificate.

Answer

The private key does not match the certificate.

Question 11

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

Accepted Answer

Enable HA session synchronization and select 'Session State' synchronization.. To preserve existing sessions during HA failover, session state synchronization must be enabled. This replicates the session table from the active firewall to the passive firewall, so the passive can take over without dropping established flows. Other HA settings like link aggregation, heartbeat encryption, or preempt mode do not provide session continuity.

Answer

Set the passive firewall to preempt mode to automatically become active after a failure.

Answer

Enable HA heartbeat encryption to secure communication between the firewalls.

Answer

Configure HA link aggregation to increase bandwidth between the firewalls.

Question 12

An administrator wants to change the firewall's hostname and configure the timezone to UTC. Which configuration path should the administrator use?

Accepted Answer

Device > Setup > Management. The hostname and timezone are configured under Device > Setup > Management. This tab contains general system settings, including hostname, timezone, DNS, and login banner. Changing the timezone to UTC is common for standardizing log timestamps. The other paths are for different configuration areas.

Answer

Device > Administrators

Answer

Device > Setup > Services

Answer

Network > Interfaces > Management

Question 13

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

Accepted Answer

Configure a Path Monitoring profile on the default route for the primary ISP.. Path Monitoring on a static default route enables the firewall to track reachability of a target IP. If the target is unreachable through the primary ISP, the route is withdrawn, and the secondary route becomes active. This provides automatic failover. The other options either require dynamic routing, manual intervention, or do not address link failure detection.

Answer

Enable OSPF on the ISP-facing interfaces to dynamically learn routes.

Answer

Set the secondary ISP interface to a lower administrative distance than the primary.

Answer

Configure a Policy-Based Forwarding (PBF) rule to redirect traffic to the secondary ISP.

Question 14

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Some websites are excluded from decryption by a no-decrypt policy or are in a predefined category that is not decrypted.. Decryption exclusions, whether by predefined categories or custom no-decrypt policies, prevent the firewall from decrypting certain traffic. This results in some websites not being decrypted. Certificate errors on other sites may be due to certificate pinning. The correct answer identifies the selective exclusion as the cause for non-decryption.

Answer

The decryption policy is not matching because the SSL traffic is using a non-standard port.

Answer

The forward trust certificate is not installed on the firewall.

Answer

The decryption profile is set to block sessions with untrusted issuers, causing the firewall to bypass decryption.

Question 15

You are setting up a new Palo Alto Networks NGFW and need to configure the management interface. Which parameter must be configured to allow administrative access from a remote subnet?

Accepted Answer

Default gateway. To allow remote management from a different subnet, the management interface must have a default gateway configured. This enables the firewall to route responses back to the remote administrator's network. Other settings like DNS, NTP, or login banner are not required for basic connectivity, though they may be useful for other purposes.

Answer

DNS server

Answer

NTP server

Answer

Login banner