NGFW-Engineer PAN OS Networking Configuration Practice Test 4 — 15 Questions

Question 1

Which interface type is used to manage the firewall over the network?

Accepted Answer

Management interface. The Management interface (MGT) is the dedicated port for out-of-band management of the PAN-OS firewall.

Answer

Aggregate Ethernet interface

Answer

Tunnel interface

Answer

Loopback interface

Question 2

What is the effect of changing the HA heartbeat interval?

Accepted Answer

Changes the detection time for peer failures. Changing the heartbeat interval affects how quickly the firewall detects a peer failure; shorter intervals increase sensitivity but also increase the risk of false failovers.

Answer

Disables session preemption

Answer

Changes the synchronization time for configuration

Answer

Changes the speed of the control link

Question 3

What is the purpose of an HA Control Link?

Accepted Answer

Synchronize configuration and state. The HA Control Link is used to synchronize configuration and state information between the two firewalls in an HA pair.

Answer

Monitor external ISP connectivity

Answer

Manage the firewall from the internet

Answer

Forward user traffic

Question 4

Why might OSPF adjacency stay in 'ExStart/Exchange' state?

Accepted Answer

MTU mismatch on the interfaces. An MTU mismatch between the two OSPF peers prevents them from exchanging large Database Description (DBD) packets, causing the state to hang in ExStart/Exchange.

Answer

Hello timer mismatch

Answer

Area ID mismatch

Answer

Authentication key mismatch

Question 5

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

Accepted Answer

Virtual Router. Static routes for tunnel traffic are configured in the Virtual Router associated with the tunnel interface.

Answer

Tunnel Interface settings

Answer

Zone settings

Answer

Security Policy

Question 6

What is the benefit of using a Loopback interface for a GlobalProtect portal?

Accepted Answer

Provides a stable IP address. A loopback interface provides a stable IP address that does not depend on the status of a physical link, ensuring the portal remains reachable even if a physical interface flaps.

Answer

Automatically encrypts traffic

Answer

Filters traffic based on source

Answer

Increases throughput for VPN users

Question 7

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

Accepted Answer

Proxy ID. The Proxy ID configuration in the IKE Gateway/IPsec tunnel settings defines exactly which traffic (source/destination/protocol) is permitted through the tunnel; unmatched traffic is dropped or routed outside the tunnel.

Answer

Re-key interval

Answer

Dead Peer Detection

Answer

IKE Crypto Profile

Question 8

Which option is required to use an interface in a security policy?

Accepted Answer

Assign a security zone. You must assign a security zone to an interface; only then can that zone be used in a security policy rule.

Answer

Configure an IP address

Answer

Define a management profile

Answer

Enable a virtual router

Question 9

What is a 'Layer 3' interface in PAN-OS?

Accepted Answer

Interface assigned an IP and virtual router. A Layer 3 interface is assigned an IP address and is associated with a virtual router to route traffic based on the routing table.

Answer

Interface bundled for link aggregation

Answer

Interface used only for management

Answer

Interface that passes all traffic without inspection

Question 10

When configuring HA, what is 'Preemption'?

Accepted Answer

Automatically switches active role to the preferred device. Preemption allows the preferred (usually higher-priority) device to automatically take over as the active firewall when it recovers from a failure.

Answer

Resets the sessions during failover

Answer

Forces the passive node to sync faster

Answer

Blocks traffic during failover

Question 11

When using OSPF, what is the 'Router ID' used for?

Accepted Answer

Identifies the router in the OSPF domain. The Router ID is a unique 32-bit identifier used to identify the router in the OSPF autonomous system and is essential for forming adjacencies and identifying the source of LSAs.

Answer

Used to encrypt OSPF packets

Answer

Sets the path metric for routes

Answer

Determines the interface speed

Question 12

Where do you configure the 'Heartbeat' interval for HA?

Accepted Answer

Device > High Availability > General. The heartbeat interval is configured in the HA > General > Election Settings or Heartbeat settings depending on the specific PAN-OS version and HA mode.

Answer

Device > Setup > Management

Answer

Network > Virtual Routers

Answer

Network > Interfaces > HA

Question 13

What is the purpose of a Security Zone?

Accepted Answer

Group interfaces for policy control. Security zones group interfaces to apply consistent security policies, acting as the foundation for the firewall's traffic control.

Answer

Assign IP addresses to subnets

Answer

Define routing tables

Answer

Manage firewall firmware

Question 14

A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?

Accepted Answer

Verify security policies allow traffic to the gateway. Check if the portal/gateway IP is reachable via ping and if the correct security policies allow the GP traffic from the external zone.

Answer

Increase the tunnel encryption level

Answer

Check the local PC's DHCP settings

Answer

Clear the routing cache on the client

Question 15

How can you verify the status of a tunnel interface?

Accepted Answer

Use the CLI command 'show interface tunnel.'. The 'show interface tunnel.' command displays the status, packet counts, and errors for the tunnel interface.

Answer

Check the system logs

Answer

Review the routing table

Answer

Ping the tunnel interface