NGFW-Engineer PAN OS Networking Configuration Practice Test 3 — 15 Questions

Question 1

A network engineer is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) for traffic from the guest network. The engineer wants to forward all HTTP traffic from the guest zone to a web proxy at 10.1.1.10, while other traffic follows the default route. After committing, the engineer notices that HTTP traffic is still following the default route. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The PBF policy rule is not matching the traffic because the source zone is not specified correctly.. PBF rules are evaluated before the routing table, and they must match on the correct criteria. The most common reason a PBF rule fails to match is an incorrect source zone. In this scenario, the engineer likely did not set the source zone to the guest zone, so the rule never matches HTTP traffic from the guest network, and traffic falls through to the default route.

Answer

The PBF policy rule is not matching because the application is set to 'ssl' instead of 'web-browsing'.

Answer

The PBF policy rule is not matching because the destination address is set to 'any' instead of the proxy IP.

Answer

The PBF policy rule is placed below the default route in the virtual router's routing table.

Question 2

A network engineer is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) for traffic from the guest network. The engineer wants to forward all HTTP traffic from the guest zone to a web proxy at 10.1.1.10, while other traffic follows the default route. After committing, the engineer notices that HTTP traffic is still following the default route. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Automatically accept DNS settings' in the DHCP client interface configuration.. To use DNS servers provided by a DHCP server, you must enable the option to automatically accept DNS settings on the DHCP client interface. This ensures the firewall dynamically updates its DNS configuration with the ISP's servers, rather than relying on statically configured DNS entries.

Answer

Create a DHCP server on the interface and set the DNS server option.

Answer

Configure a static DNS server in the virtual router and enable DNS proxy.

Answer

Enable 'Peer DNS' in the PPPoE configuration.

Question 3

A network engineer is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) for traffic from the guest network. The engineer wants to forward all HTTP traffic from the guest zone to a web proxy at 10.1.1.10, while other traffic follows the default route. After committing, the engineer notices that HTTP traffic is still following the default route. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security policy rules allowing traffic between the zones. In PAN-OS, inter-zone traffic is denied by default. Even with correct routing, security policy rules must be created to allow traffic from the source zone to the destination zone. The scenario describes routing configuration but omits security policies, which are essential for permitting traffic. Therefore, the missing configuration is security policy rules.

Answer

A default route in the virtual router

Answer

Zone assignments for the interfaces

Answer

OSPF configuration to advertise the routes

Question 4

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

Accepted Answer

Apply the profile to the zone under Network > Zones.. Option D is correct because a zone protection profile must first be created as an object under Network > Network Profiles > Zone Protection before it can be referenced anywhere; this defines the flood, reconnaissance, and packet-based attack protections. Option B is correct because after the profile exists, it must be attached to the target security zone under Network > Zones (in the Zone Protection Profile field) for the protections to take effect on that zone's ingress traffic. Option A is incorrect because security policy rules control permitted traffic and are not required to bind a zone protection profile to a zone. Option C is incorrect because assigning a zone to a virtual router is part of basic Layer 3 zone configuration, not zone protection profile configuration. Option E is incorrect because 'Strict' mode is not a valid interface setting for enabling zone protection; there is no such required toggle.

Answer

Create a security policy rule.

Answer

Assign the zone to a virtual router.

Answer

Enable the 'Strict' mode on the interface.

Question 5

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

Accepted Answer

Assign the sub-interface to a security zone. Interfaces must be assigned to a security zone before they can be referenced in a security policy.

Answer

Add the sub-interface to the default zone

Answer

Configure the sub-interface as a loopback

Answer

Enable DHCP server on the sub-interface

Question 6

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

Accepted Answer

Network > Interfaces > Tunnel. Tunnel interfaces act as logical points for VPN traffic and are assigned IP addresses in the Network > Interfaces > Tunnel tab.

Answer

Network > Zones

Answer

Network > GlobalProtect > Gateways

Answer

Network > Virtual Routers

Question 7

When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?

Accepted Answer

The adjacency will not form. OSPF requires the Hello interval and Dead interval to match exactly between neighbors; a mismatch prevents adjacency formation.

Answer

The firewall will use the lowest timer value

Answer

Only LSA type 1 updates are exchanged

Answer

The adjacency forms but drops packets

Question 8

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Accepted Answer

Heartbeat link synchronization. The heartbeat interfaces and HA control links synchronize configuration and session state, ensuring the passive unit is ready for a seamless transition.

Answer

BGP peer failover

Answer

ARP cache clearing

Answer

GlobalProtect gateway synchronization

Question 9

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

Accepted Answer

Configure interfaces in multiple OSPF areas. To be an ABR, the firewall must have interfaces in Area 0 and at least one other non-zero area, configured within the OSPF protocol settings in the virtual router.

Answer

Enable BGP on all interfaces

Answer

Configure multiple virtual routers

Answer

Create a tunnel interface for each area

Question 10

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

Accepted Answer

TCP port 179 is blocked or no route to peer. The 'Active' state in BGP usually indicates the firewall is trying to initiate a TCP connection to the neighbor, but is failing, often due to routing or firewall policy blocking port 179.

Answer

Keepalive timer mismatch

Answer

AS number mismatch

Answer

Router ID is the same

Question 11

What is the purpose of an Aggregate Ethernet (AE) interface?

Accepted Answer

Combine physical links for higher bandwidth and redundancy. AE interfaces provide increased bandwidth and link redundancy by bundling multiple physical ports into a single logical interface.

Answer

Connect two virtual routers

Answer

Increase the number of available VLANs

Answer

Create a secure VPN tunnel

Question 12

You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?

Accepted Answer

Missing route in the virtual router to the internal network. If the virtual router handling the tunnel interface does not have a route to the internal network, the firewall cannot route the decrypted traffic to the destination.

Answer

Missing certificate on the gateway

Answer

Missing default route on the client machine

Answer

Incorrect zone on the tunnel interface

Question 13

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

Accepted Answer

Active/Active uses both firewalls for session processing. Active/Active mode allows both firewalls to process traffic simultaneously and requires link aggregation or specific load balancing, whereas Active/Passive only uses one firewall for traffic.

Answer

Active/Active is only for Layer 2 deployments

Answer

Active/Passive uses both firewalls for session processing

Answer

Active/Passive requires dedicated HA links

Question 14

How does the firewall determine which virtual router to use for a packet?

Accepted Answer

Based on the virtual router assigned to the ingress interface. The firewall uses the virtual router associated with the ingress interface to perform the routing lookup for the packet.

Answer

Based on the zone of the destination interface

Answer

Based on the destination port

Answer

Based on the source IP address

Question 15

Which object type is required to enable GlobalProtect access for remote users?

Accepted Answer

GlobalProtect Gateway. The GlobalProtect Gateway is the entity that terminates the VPN tunnel and applies security policies to remote users.

Answer

GlobalProtect Zone

Answer

GlobalProtect Router

Answer

GlobalProtect Interface