NGFW-Engineer PAN OS Networking Configuration — 20 Questions

Question 1

An administrator needs to implement redundant HA links. Which configuration ensures that the HA1 control link maintains connectivity if the primary physical link fails?

Accepted Answer

Configure a secondary HA2 interface.. HA1 backup links allow for control plane redundancy, ensuring synchronization continues if the primary link is disrupted.

Answer

Configure a virtual wire between HA1 and HA2 ports.

Answer

Assign the same IP to both HA1 interfaces.

Question 2

You are configuring a new Ethernet interface on a PA-5220. You must ensure the interface processes traffic for a specific VLAN ID tagged on an 802.1Q trunk. Which interface type should you select?

Accepted Answer

Layer3. A subinterface is required to handle tagged VLAN traffic on a physical Ethernet interface in PAN-OS.

Answer

Tap

Answer

Virtual Wire

Answer

Layer2

Question 3

Which TWO conditions are required for a firewall to become the 'Active' unit in HA?

Accepted Answer

Highest device priority. A firewall becomes active based on the device priority and whether it successfully wins the election process.

Answer

Being the passive unit first

Answer

Having the most interfaces

Answer

Having the latest firmware

Question 4

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

Accepted Answer

Apply the profile to the zone under Network > Zones.. Zone protection profiles require the profile to be defined and then explicitly applied to the security zone.

Answer

Create a security policy rule.

Answer

Assign the zone to a virtual router.

Answer

Enable the 'Strict' mode on the interface.

Question 5

You are configuring a virtual wire interface. Which setting is required to ensure that traffic is passed between the two interfaces?

Accepted Answer

Assign a security zone to each interface. Virtual wire requires a vwire object mapping two interfaces; once the object is assigned to the interfaces, traffic is passed based on the virtual wire security policy.

Answer

Configure an IP address on both interfaces

Answer

Create a loopback interface

Answer

Enable dynamic routing on the virtual wire

Question 6

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

Accepted Answer

Assign the sub-interface to a security zone. Interfaces must be assigned to a security zone before they can be referenced in a security policy.

Answer

Add the sub-interface to the default zone

Answer

Configure the sub-interface as a loopback

Answer

Enable DHCP server on the sub-interface

Question 7

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

Accepted Answer

Network > Interfaces > Tunnel. Tunnel interfaces act as logical points for VPN traffic and are assigned IP addresses in the Network > Interfaces > Tunnel tab.

Answer

Network > Zones

Answer

Network > GlobalProtect > Gateways

Answer

Network > Virtual Routers

Question 8

When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?

Accepted Answer

The adjacency will not form. OSPF requires the Hello interval and Dead interval to match exactly between neighbors; a mismatch prevents adjacency formation.

Answer

The firewall will use the lowest timer value

Answer

Only LSA type 1 updates are exchanged

Answer

The adjacency forms but drops packets

Question 9

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Accepted Answer

Heartbeat link synchronization. The heartbeat interfaces and HA control links synchronize configuration and session state, ensuring the passive unit is ready for a seamless transition.

Answer

BGP peer failover

Answer

ARP cache clearing

Answer

GlobalProtect gateway synchronization

Question 10

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

Accepted Answer

Configure interfaces in multiple OSPF areas. To be an ABR, the firewall must have interfaces in Area 0 and at least one other non-zero area, configured within the OSPF protocol settings in the virtual router.

Answer

Enable BGP on all interfaces

Answer

Configure multiple virtual routers

Answer

Create a tunnel interface for each area

Question 11

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

Accepted Answer

TCP port 179 is blocked or no route to peer. The 'Active' state in BGP usually indicates the firewall is trying to initiate a TCP connection to the neighbor, but is failing, often due to routing or firewall policy blocking port 179.

Answer

Keepalive timer mismatch

Answer

AS number mismatch

Answer

Router ID is the same

Question 12

When troubleshooting a BGP route that is not appearing in the routing table, which command provides the most insight?

Accepted Answer

show routing protocol bgp rib-in. The 'show routing protocol bgp rib-in' command shows the prefixes received from peers before they are filtered and installed in the RIB.

Answer

show interface all

Answer

show system state

Answer

show routing fib

Question 13

What is the purpose of an Aggregate Ethernet (AE) interface?

Accepted Answer

Combine physical links for higher bandwidth and redundancy. AE interfaces provide increased bandwidth and link redundancy by bundling multiple physical ports into a single logical interface.

Answer

Connect two virtual routers

Answer

Increase the number of available VLANs

Answer

Create a secure VPN tunnel

Question 14

You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?

Accepted Answer

Missing route in the virtual router to the internal network. If the virtual router handling the tunnel interface does not have a route to the internal network, the firewall cannot route the decrypted traffic to the destination.

Answer

Missing certificate on the gateway

Answer

Missing default route on the client machine

Answer

Incorrect zone on the tunnel interface

Question 15

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

Accepted Answer

Active/Active uses both firewalls for session processing. Active/Active mode allows both firewalls to process traffic simultaneously and requires link aggregation or specific load balancing, whereas Active/Passive only uses one firewall for traffic.

Answer

Active/Active is only for Layer 2 deployments

Answer

Active/Passive uses both firewalls for session processing

Answer

Active/Passive requires dedicated HA links

Question 16

How does the firewall determine which virtual router to use for a packet?

Accepted Answer

Based on the virtual router assigned to the ingress interface. The firewall uses the virtual router associated with the ingress interface to perform the routing lookup for the packet.

Answer

Based on the zone of the destination interface

Answer

Based on the destination port

Answer

Based on the source IP address

Question 17

Which object type is required to enable GlobalProtect access for remote users?

Accepted Answer

GlobalProtect Gateway. The GlobalProtect Gateway is the entity that terminates the VPN tunnel and applies security policies to remote users.

Answer

GlobalProtect Zone

Answer

GlobalProtect Router

Answer

GlobalProtect Interface

Question 18

Which interface type is used to manage the firewall over the network?

Accepted Answer

Management interface. The Management interface (MGT) is the dedicated port for out-of-band management of the PAN-OS firewall.

Answer

Aggregate Ethernet interface

Answer

Tunnel interface

Answer

Loopback interface

Question 19

An administrator wants to permit traffic between two sub-interfaces on the same physical port. What is required?

Accepted Answer

Security policy allowing traffic between the zones. If the sub-interfaces are in different zones, a security policy is required; if they are in the same zone, no policy is needed if intra-zone traffic is enabled.

Answer

Enable DHCP relay on both interfaces

Answer

A VPN tunnel between the sub-interfaces

Answer

A static route pointing to the physical port

Question 20

What is the effect of changing the HA heartbeat interval?

Accepted Answer

Changes the detection time for peer failures. Changing the heartbeat interval affects how quickly the firewall detects a peer failure; shorter intervals increase sensitivity but also increase the risk of false failovers.

Answer

Disables session preemption

Answer

Changes the synchronization time for configuration

Answer

Changes the speed of the control link