NGFW-Engineer PAN OS Networking Configuration — All Questions With Answers

You are configuring a new Ethernet interface on a PA-5220. You must ensure the interface processes traffic for a specific VLAN ID tagged on an 802.1Q trunk. Which interface type should you select?

Question 4hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

When troubleshooting a BGP route that is not appearing in the routing table, which command provides the most insight?

Question 5mediummultiple choice

An administrator wants to permit traffic between two sub-interfaces on the same physical port. What is required?

Question 6mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

Which object defines the encryption settings for a Site-to-Site VPN?

Question 7easymultiple choice

How do you delete a security policy rule?

Question 8hardmulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO factors contribute to a successful BGP peer establishment?

Question 9easymulti select

Which TWO interface modes are commonly used to segment traffic?

Question 10mediummulti select

Read the full PAN OS Networking Configuration explanation →

Which THREE settings are configured in a Layer 3 interface?

Question 11hardmulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO conditions are required for a firewall to become the 'Active' unit in HA?

Question 12mediummultiple choice

An engineer needs to configure a Layer 3 subinterface on a Palo Alto Networks firewall to support multiple VLANs on a single physical interface. The physical interface is already configured as a Layer 3 interface with an IP address. What must be done before creating the subinterface?

Question 13hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

An administrator is configuring a sub-interface on a Palo Alto Networks firewall to allow traffic between two zones. The physical interface is already configured as a Layer 3 interface with an IP address. The administrator creates a sub-interface with VLAN tag 100 and assigns it to a new zone. After committing, traffic is not passing. What is a mandatory configuration step that the administrator likely missed?

Question 14mediummultiple choice

An engineer configures a new Palo Alto Networks firewall with two interfaces in the same security zone. The firewall is running PAN-OS 11.1. Traffic entering one interface and exiting the other within the same zone is being blocked by an implicit rule. What is the default behavior for intra-zone traffic, and how can the engineer allow it?

Question 15mediummulti select

An engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to ensure that the tunnel interface is properly configured to route traffic over the VPN. Which two configurations are required on the tunnel interface? (Choose two.)

Question 16hardmultiple choice

A network architect is designing a Palo Alto Networks firewall deployment that requires policy-based forwarding (PBF) to route specific traffic out of a particular ISP link based on the source IP address. The firewall has two ISP connections on different interfaces. The architect wants to ensure that if the primary ISP link fails, traffic is automatically rerouted to the secondary ISP. Which PAN-OS feature should be used to monitor the primary ISP link and trigger the PBF rule to use the secondary link?

Question 17mediummultiple choice

An administrator is setting up a new Palo Alto Networks firewall and needs to configure a loopback interface to be used as the router ID for OSPF. Which configuration step is required to make the loopback interface usable for this purpose?

Question 18mediummultiple choice

An engineer configures a Layer 3 interface on a PA-3220 with two IP addresses: 10.1.1.1/24 and 10.2.2.1/24. The interface is assigned to the 'trust' zone in virtual router 'default'. Users on 10.1.1.0/24 report they can reach the internet, but users on 10.2.2.0/24 cannot. The firewall's routing table shows a default route via 10.1.1.254. No policy denies traffic from the trust zone. What is the most likely cause?

Question 19hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

A network engineer is configuring a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the tunnel interface IP address is correctly configured and that the tunnel can be used for routing. Which configuration step is required to assign an IP address to the tunnel interface?

Question 20hardmulti select

A PAN-OS firewall is deployed in a high-availability (HA) active/passive configuration. The administrator needs to ensure that the HA1 control link remains operational even if the primary HA1 link fails. Which two configurations achieve this? (Choose two.)

Question 21mediummulti select

An engineer is configuring a site-to-site VPN between two Palo Alto Networks firewalls. The engineer needs to ensure that the VPN tunnel can be established and that traffic is properly routed. Which two configurations are required on each firewall to enable the VPN tunnel to come up? (Choose two.)

Question 22mediummulti select

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP relay. The DHCP server is located on a different subnet than the DHCP clients. Which two configurations are required to enable DHCP relay on the firewall? (Choose two.)

Question 23hardmultiple choice

A network engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an external router using OSPF. The engineer wants to ensure that the firewall's OSPF router ID is stable and does not change if a physical interface goes down. Which configuration should the engineer use?

Question 24easymultiple choice

Read the full PAN OS Networking Configuration explanation →

A network administrator is configuring a new Layer 3 interface on a PAN-OS firewall. The interface will be used to route traffic between two subnets. Which configuration is required to enable the interface to forward traffic?

Question 25mediummulti select

An administrator is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF). The administrator wants to ensure that traffic matching a PBF rule is forwarded correctly. Which two actions must be taken when creating a PBF rule? (Choose two.)

Question 26mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

An administrator is configuring a new subnet on a Layer 3 interface of a PA-3260. The subnet is 192.168.10.0/24, and the interface is in zone 'dmz' with virtual router 'default'. The administrator wants the firewall to respond to ARP requests for 192.168.10.1 and also to forward traffic for other IPs in the subnet to a downstream router at 192.168.10.2. Which configuration achieves this?

Question 27easymultiple choice

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure the management interface. The administrator wants to access the firewall's web interface from a computer on the 10.0.0.0/24 network. The management interface is currently configured with IP address 192.168.1.1/24. Which action must the administrator take to allow access from the 10.0.0.0/24 network?

Question 28easymultiple choice

Read the full PAN OS Networking Configuration explanation →

An administrator is setting up a new Palo Alto Networks firewall and needs to configure the management interface. The administrator wants to ensure that the firewall can be managed via HTTPS from the internal network. Which configuration is required?

Question 29easymultiple choice

A firewall administrator needs to configure a new Layer 2 interface on a PA-220. The interface will connect to a switch and carry traffic for VLAN 10 and VLAN 20. The administrator wants the firewall to inspect traffic between these VLANs. Which configuration is required?

Question 30hardmulti select

A security engineer is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) to route traffic from a specific source subnet through a dedicated ISP link. The engineer creates a PBF policy with the source subnet and a forward-to next-hop of the ISP gateway. However, traffic is still being routed via the default route. Which two actions should the engineer take to ensure the PBF policy is applied? (Choose two.)

Question 31hardmultiple choice

A network engineer is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) for traffic from the guest network. The engineer wants to forward all HTTP traffic from the guest zone to a web proxy at 10.1.1.10, while other traffic follows the default route. After committing, the engineer notices that HTTP traffic is still following the default route. What is the most likely cause?

Question 32mediummultiple choice

A network engineer is configuring a Palo Alto Networks firewall to use DHCP client on Ethernet1/1 to obtain an IP address from the ISP. The ISP provides a /29 subnet, and the engineer wants the firewall to automatically use the DNS servers provided by the ISP. Which configuration step is required to ensure the firewall accepts the ISP's DNS servers?

Question 33easymultiple choice

Read the full PAN OS Networking Configuration explanation →

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two subnets. The engineer creates a virtual router and assigns interfaces ethernet1/1 and ethernet1/2 to it. The engineer then adds static routes for both subnets. However, traffic is not being routed between the subnets. What is the most likely missing configuration?

Question 34mediummulti select

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

Question 35mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

Question 36easymultiple choice

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

Question 37hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?

Question 38mediummultiple choice

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Question 39easymultiple choice

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

Question 40hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

Question 41easymultiple choice

What is the purpose of an Aggregate Ethernet (AE) interface?

Question 42hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?

Question 43mediummultiple choice

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

Question 44mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

How does the firewall determine which virtual router to use for a packet?

Question 45easymultiple choice

Which object type is required to enable GlobalProtect access for remote users?

Question 46easymultiple choice

Read the full PAN OS Networking Configuration explanation →

Which interface type is used to manage the firewall over the network?

Question 47hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

What is the effect of changing the HA heartbeat interval?

Question 48easymultiple choice

Read the full PAN OS Networking Configuration explanation →

What is the purpose of an HA Control Link?

Question 49hardmultiple choice

Why might OSPF adjacency stay in 'ExStart/Exchange' state?

Question 50mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

Question 51mediummultiple choice

What is the benefit of using a Loopback interface for a GlobalProtect portal?

Question 52hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

Question 53easymultiple choice

Which option is required to use an interface in a security policy?

Question 54easymultiple choice

Read the full PAN OS Networking Configuration explanation →

What is a 'Layer 3' interface in PAN-OS?

Question 55mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

When configuring HA, what is 'Preemption'?

Question 56hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

When using OSPF, what is the 'Router ID' used for?

Question 57mediummultiple choice

Where do you configure the 'Heartbeat' interval for HA?

Question 58easymultiple choice

Read the full PAN OS Networking Configuration explanation →

What is the purpose of a Security Zone?

Question 59hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?

Question 60mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

How can you verify the status of a tunnel interface?

Question 61hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

In BGP, which attribute is used to influence the path selection for outgoing traffic?

Question 62easymultiple choice

How do you add a new interface to an existing zone?

Question 63hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

What is the purpose of 'Path Monitoring' in HA?

Question 64easymultiple choice

Read the full PAN OS Networking Configuration explanation →

What is the default behavior when a firewall is configured for HA but the control link fails?

Question 65hardmultiple choice

Why might a static route not be visible in the routing table?

Question 66mediummultiple choice

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

Question 67easymultiple choice

Read the full PAN OS Networking Configuration explanation →

What is the primary function of a Virtual Router?

Question 68easymultiple choice

What is the function of a 'Tap' mode interface?

Question 69mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

Question 70mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

When configuring an interface for DHCP client, where do you set this?

Question 71hardmultiple choice

What happens to established sessions during an HA failover?

Question 72hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

In BGP, what is a 'Route Map' used for?

Question 73mediummultiple choice

What is the purpose of an 'Aggregate Ethernet' interface?

Question 74easymultiple choice

Read the full PAN OS Networking Configuration explanation →

Which of these is a valid way to define a source IP in a policy?

Question 75hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

Which command confirms that an OSPF neighbor relationship is in the 'Full' state?

Question 76mediummultiple choice

What happens if a zone is not assigned to an interface?

Question 77mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

When configuring a Static Route, what does the 'Metric' field do?

Question 78hardmultiple choice

In GlobalProtect, what is the 'Portal' vs. 'Gateway'?

Question 79easymultiple choice

Read the full PAN OS Networking Configuration explanation →

Which tab is used to configure physical interface settings like speed and duplex?

Question 80hardmulti select

Which THREE routing protocols can be configured on a PAN-OS virtual router?

Question 81mediummulti select

Which THREE items are required to configure a Site-to-Site VPN?

Question 82easymulti select

Which TWO items must match for an OSPF adjacency to form?

Question 83easymulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO settings are configured in a Virtual Router?

Question 84mediummulti select

Which THREE items can be assigned to a Security Zone?

Question 85hardmulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?

Question 86mediummulti select

Read the full PAN OS Networking Configuration explanation →

Which THREE things must be configured to allow HA between two firewalls?

Question 87mediummulti select

Read the full PAN OS Networking Configuration explanation →

Which THREE items are defined in an IKE Crypto Profile?

Question 88easymulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO interface types support IP addresses?

Question 89hardmulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO conditions can trigger an HA failover?

Question 90hardmulti select

Which TWO issues can prevent BGP from reaching the 'Established' state?

Question 91mediummulti select

Read the full PAN OS Networking Configuration explanation →

Which THREE components are involved in a VPN tunnel setup?

Question 92easymulti select

Which TWO items must be configured to allow external management access?

Question 93easymulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO components are involved in configuring GlobalProtect?

Question 94mediummulti select

Read the full PAN OS Networking Configuration explanation →

Which THREE items can be used as a 'Source' in a security policy?

Question 95mediummulti select

Read the full PAN OS Networking Configuration explanation →

Which THREE factors can affect the speed/throughput of a VPN tunnel?

Question 96easymulti select

Which TWO protocols can be used to manage the firewall?

Question 97hardmulti select

Read the full PAN OS Networking Configuration explanation →

Which TWO types of failover can be configured in HA?

Question 98hardmulti select

Which TWO commands are useful for troubleshooting OSPF?

Question 99mediummultiple choice

An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?

Question 100mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?

Question 101mediummultiple choice

A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?

Question 102mediummultiple choice

A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?

Question 103mediummultiple choice

An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?

Question 104easymultiple choice

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?

Question 105mediummultiple choice

An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?

Question 106hardmulti select

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

Question 107hardmultiple choice

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

Question 108mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?

Question 109easymultiple choice

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

Question 110easymultiple choice

Read the full PAN OS Networking Configuration explanation →

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

Question 111easymultiple choice

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

Question 112mediummultiple choice

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

Question 113mediummulti select

Read the full PAN OS Networking Configuration explanation →

A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)

Question 114mediummultiple choice

A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?

Question 115mediummultiple choice

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

Question 116mediummultiple choice

An administrator is configuring a site-to-site VPN between two PAN-OS firewalls. The VPN will use a tunnel interface to route traffic. The administrator has created the IKE gateway and IPsec crypto profile. Which additional configuration is required to assign an IP address to the tunnel interface?

Question 117mediummultiple choice

A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?

Question 118mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

Question 119hardmultiple choice

A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?

Question 120mediummultiple choice

An administrator is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a single physical link that delivers both internet traffic (untagged) and IPTV multicast traffic (VLAN 300). The administrator wants to give the IPTV traffic its own security zone and apply a distinct security policy, while keeping the internet traffic in the existing untagged zone. Which configuration should the administrator use on the physical interface?

Question 121mediummultiple choice

An engineer needs to configure a Palo Alto Networks firewall to act as a DHCP server for a network segment connected to Ethernet1/1. The engineer wants the firewall to assign IP addresses from the 192.168.10.0/24 subnet. Which configuration step is required?

Question 122mediummultiple choice

Read the full PAN OS Networking Configuration explanation →

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a subnet. The firewall interface is configured with a static IP address. Which additional step is required to enable DHCP server functionality on that interface?

Question 123hardmultiple choice

An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?

Question 124hardmultiple choice

A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?

Question 125mediummultiple choice

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

Question 126mediummulti select

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Question 127mediummultiple choice

An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?

Question 128hardmultiple choice

A network engineer is configuring a site-to-site VPN between two PA-5220 firewalls. The engineer wants to ensure that if the primary ISP link fails, the VPN tunnel automatically re-establishes over a backup ISP link without manual intervention. Both firewalls have two ISP connections and the VPN is configured with a tunnel interface. Which PAN-OS feature should the engineer configure to achieve this?

Question 129mediummulti select

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

Question 130easymultiple choice

Read the full PAN OS Networking Configuration explanation →

A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?

Question 131easymultiple choice

A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?

Question 132mediummultiple choice

A network engineer is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The engineer wants the firewall to assign IP addresses to guests and also provide DNS server information. Which configuration step is necessary to achieve this?

Question 133mediummultiple choice

An administrator is configuring a Palo Alto Networks firewall to route traffic between two internal networks. The firewall has two Layer 3 interfaces, Ethernet1/1 and Ethernet1/2, each assigned to different security zones and different virtual routers. The administrator wants traffic from the trust zone to reach the untrust zone, but the firewall is not routing the traffic. What is the most likely cause?

Question 134hardmultiple choice

An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?

Question 135hardmultiple choice

An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?

Question 136hardmultiple choice

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two internal networks: 172.16.1.0/24 on Ethernet1/1 and 172.16.2.0/24 on Ethernet1/2. The firewall has a single virtual router. The engineer wants to ensure that traffic from 172.16.1.0/24 to 172.16.2.0/24 is routed correctly. Which configuration is required?

Question 137hardmulti select

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

Question 138mediummultiple choice

A network engineer is configuring a Palo Alto Networks NGFW with a single virtual router that has two ISP-facing interfaces: ethernet1/1 (default route to 203.0.113.1) and ethernet1/2 (default route to 198.51.100.1). The engineer wants the firewall to automatically use ethernet1/2 when ethernet1/1 fails. What should the engineer configure?

Question 139mediummultiple choice

A network engineer is configuring a Palo Alto Networks firewall to use DHCP on an interface for management access. The engineer wants the firewall to obtain an IP address from a DHCP server and also send its hostname to the DHCP server for DNS registration. Which DHCP client option should the engineer enable?

Question 140hardmultiple choice

Read the full PAN OS Networking Configuration explanation →

A network architect is designing a Palo Alto Networks firewall deployment with two virtual routers. The firewall has two interfaces, Ethernet1/2 and Ethernet1/3, both assigned to different zones. The architect wants to ensure that traffic from Ethernet1/2 can reach Ethernet1/3 without being routed through an external device. Which configuration is necessary?

Question 141easymultiple choice

A network administrator is setting up a Palo Alto Networks firewall and needs to configure an interface for outbound internet access. The ISP provides a static IP address, and the administrator wants to ensure that return traffic from the internet can reach the internal network. Which type of interface configuration is required?

Question 142hardmulti select