NGFW-Engineer PAN OS Networking Configuration Practice Test 6 — 15 Questions

Question 1

What happens if a zone is not assigned to an interface?

Accepted Answer

The interface cannot be used in a policy. The interface cannot be used in a security policy, effectively making it unusable for traffic management through the firewall.

Answer

The interface drops all traffic

Answer

The firewall will automatically create a zone

Answer

The interface becomes a management-only port

Question 2

When configuring a Static Route, what does the 'Metric' field do?

Accepted Answer

Determines route preference. The metric is used to choose between multiple routes to the same destination; a lower metric is preferred over a higher one.

Answer

Defines the interface bandwidth

Answer

Sets the tunnel timeout

Answer

Defines the next hop IP

Question 3

In GlobalProtect, what is the 'Portal' vs. 'Gateway'?

Accepted Answer

Portal distributes config, Gateway handles traffic. The Portal is responsible for distributing the configuration/client software, while the Gateway handles the actual tunnel and traffic enforcement.

Answer

Portal handles traffic, Gateway distributes config

Answer

They are the same thing

Answer

Portal is for internal users only

Question 4

Which tab is used to configure physical interface settings like speed and duplex?

Accepted Answer

Network > Interfaces. The Network > Interfaces > Ethernet tab allows you to configure physical settings such as speed and duplex mode.

Answer

Device > Setup

Answer

Policies > Security

Answer

Network > Virtual Routers

Question 5

Which THREE routing protocols can be configured on a PAN-OS virtual router?

Accepted Answer

RIP. PAN-OS supports OSPF, BGP, and RIP as the primary dynamic routing protocols.

Answer

IS-IS

Answer

EIGRP

Question 6

Which THREE items are required to configure a Site-to-Site VPN?

Accepted Answer

IPsec Tunnel. Site-to-Site VPNs require an IKE Gateway (Phase 1), an IPsec Tunnel (Phase 2), and a Tunnel interface to tie them together.

Answer

Aggregate Ethernet

Answer

GlobalProtect Portal

Question 7

Which TWO items must match for an OSPF adjacency to form?

Accepted Answer

Area ID. OSPF requires Area ID and Hello/Dead timers to match to form an adjacency.

Answer

Router Priority

Answer

Interface Speed

Answer

Interface Description

Question 8

Which TWO settings are configured in a Virtual Router?

Accepted Answer

Static Routes. Virtual routers handle static routes and dynamic routing protocols (like OSPF/BGP).

Answer

Management Profile

Answer

Tunnel Interface IPs

Answer

Security Zones

Question 9

Which THREE items can be assigned to a Security Zone?

Accepted Answer

Physical interfaces. Physical interfaces, sub-interfaces, and tunnel interfaces can all be assigned to security zones.

Answer

Virtual routers

Answer

Management interfaces

Question 10

Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?

Accepted Answer

Check firewall System and GlobalProtect logs. Troubleshooting often involves checking the client logs and reviewing the firewall's GlobalProtect logs.

Answer

Change the encryption algorithm

Answer

Reload the firewall firmware

Answer

Restart the management plane

Question 11

Which THREE things must be configured to allow HA between two firewalls?

Accepted Answer

HA data link. HA requires configuration of HA links (control/data), enabling HA in the device settings, and ensuring identical hardware/version.

Answer

Same virtual router configuration

Answer

Different management IP addresses

Question 12

Which THREE items are defined in an IKE Crypto Profile?

Accepted Answer

Hashing algorithm. IKE Crypto Profiles define encryption algorithms, hashing algorithms, and Diffie-Hellman groups for Phase 1.

Answer

Tunnel interface IP

Answer

Proxy ID

Question 13

Which TWO interface types support IP addresses?

Accepted Answer

Layer 3 interface. Layer 3 and Loopback interfaces support IP addresses.

Answer

Aggregate Ethernet (Layer 2)

Answer

Tap interface

Answer

Virtual Wire interface

Question 14

Which TWO conditions can trigger an HA failover?

Accepted Answer

Hardware failure. Failovers can be triggered by hardware failure or by the firewall losing reachability to monitored paths.

Answer

BGP session reset

Answer

Excessive log generation

Answer

Change in management IP

Question 15

Which TWO issues can prevent BGP from reaching the 'Established' state?

Accepted Answer

Blocked TCP port 179. BGP will not establish if there is a mismatch in AS numbers or if TCP port 179 is blocked.

Answer

Router ID mismatch

Answer

Keepalive timer mismatch

Answer

Area ID mismatch