NGFW-Engineer PAN OS Networking Configuration Practice Test 7 — 15 Questions

Question 1

Which THREE components are involved in a VPN tunnel setup?

Accepted Answer

IKE Gateway. VPNs require IKE gateways, IPsec crypto profiles, and tunnel interfaces.

Answer

GlobalProtect Portal

Answer

Aggregate Ethernet

Question 2

Which TWO items must be configured to allow external management access?

Accepted Answer

Management Profile. External management requires an IP on the MGT interface and a Management Profile that permits access (like HTTPS/SSH).

Answer

Tunnel interface

Answer

Security Zone

Answer

Virtual Router

Question 3

Which TWO components are involved in configuring GlobalProtect?

Accepted Answer

Gateway. GP requires a Portal for distribution and a Gateway for traffic management.

Answer

Management Profile

Answer

Virtual Router

Answer

Aggregate Interface

Question 4

Which THREE items can be used as a 'Source' in a security policy?

Accepted Answer

User. Policies can use addresses, address groups, or users as the source of traffic.

Answer

Virtual Router name

Answer

Interface speed

Question 5

Which THREE factors can affect the speed/throughput of a VPN tunnel?

Accepted Answer

Encryption algorithm. VPN throughput is influenced by the encryption algorithm, the CPU load of the firewall, and the MTU settings.

Answer

Management IP

Answer

Zone color

Question 6

Which TWO protocols can be used to manage the firewall?

Accepted Answer

HTTPS. SSH and HTTPS are standard protocols used for remote management of the PAN-OS web/CLI interfaces.

Answer

DHCP

Answer

FTP

Answer

SMTP

Question 7

Which TWO types of failover can be configured in HA?

Accepted Answer

Path Monitoring. HA failover can be triggered by 'Link Monitoring' (interface status) and 'Path Monitoring' (resource reachability).

Answer

Interface Speed Monitoring

Answer

Zone Monitoring

Answer

Route Monitoring

Question 8

Which TWO commands are useful for troubleshooting OSPF?

Accepted Answer

show routing protocol ospf rib. The 'show routing protocol ospf neighbor' and 'show routing protocol ospf rib' commands are essential for debugging OSPF neighbors and learned routes.

Answer

show system processes

Answer

show hardware

Answer

show log routing

Question 9

An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?

Accepted Answer

OSPF dynamic cost based on HA state. OSPF dynamic cost based on HA state allows the firewall to automatically adjust its OSPF interface cost depending on whether it is active or passive. In an active/passive HA pair, the passive firewall advertises a higher cost, so OSPF routing prefers the active firewall. If a failover occurs, the newly active firewall lowers its cost, and traffic shifts accordingly. This provides deterministic routing behavior without manual intervention.

Answer

OSPF graceful restart

Answer

OSPF link-state advertisement (LSA) throttling

Answer

OSPF cost adjustment via HA priority

Question 10

An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?

Accepted Answer

The two interfaces are in the same broadcast domain, and the firewall does not route between interfaces in the same subnet; it requires them to be in different subnets or use a different mechanism.. The correct answer is that the firewall does not route between interfaces in the same subnet. PAN-OS requires each Layer 3 interface to be in a unique subnet to perform routing. When two interfaces share a subnet, the firewall cannot determine which interface to use for routing, resulting in a route lookup failure. The solution is to assign different subnets or use a different design.

Answer

The firewall requires a static route for the directly connected subnet to be added manually to the virtual router.

Answer

The firewall does not allow two interfaces in different zones to have IPs in the same subnet; it requires a virtual router to resolve the conflict.

Answer

The firewall requires a policy-based forwarding rule to redirect traffic between the two interfaces.

Question 11

A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?

Accepted Answer

Create an aggregate interface group (AE) on each firewall with the same interface name and configure LACP in active mode on the member interfaces.. Aggregate Ethernet (AE) interfaces are the correct method to bundle multiple physical links into a single logical link using LACP. The same AE interface name must be used on both firewalls to ensure consistent configuration and seamless failover. LACP in active mode allows the firewall to initiate the LACP negotiation with the switch, forming a port-channel. This configuration ensures that the switch sees a single logical link from each firewall, even though only the active firewall forwards traffic.

Answer

Create a tunnel interface and assign the physical interfaces as tunnel endpoints to achieve link aggregation.

Answer

Enable Link Aggregation on the firewall by configuring a VLAN interface with multiple physical interfaces as members.

Answer

Configure a redundant interface group on each firewall and set the redundancy mode to active-active.

Question 12

A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?

Accepted Answer

In the Network > Interfaces > Tunnel section, by editing the tunnel interface.. The tunnel interface IP address is configured on the tunnel interface, which is located under Network > Interfaces > Tunnel. This IP is used for routing and as the source address for traffic sent through the VPN. The other options are related to VPN configuration but do not include the tunnel interface IP setting.

Answer

In the Network > IPSec Tunnels section, under the Proxy ID tab.

Answer

In the IKE Gateway configuration, under the Advanced tab.

Answer

In the IPSec Crypto Profile configuration.

Question 13

An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?

Accepted Answer

Enable 'Advertise Default Route' in the OSPF Area configuration and select 'Match'.. The 'Match' option under OSPF Area configuration for advertising a default route ensures the firewall originates a default route into OSPF only when a corresponding default route exists in its routing table. This conditional advertisement prevents the firewall from attracting traffic it cannot forward, which is critical for stable routing in scenarios where the default route may be learned dynamically or withdrawn.

Answer

Create a static route to 0.0.0.0/0 with a next-hop of 'discard' and redistribute static routes into OSPF.

Answer

Enable 'Advertise Default Route' in the OSPF Area configuration and select 'Always'.

Answer

Configure an OSPF export rule that matches the default route and set the metric to 0.

Question 14

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?

Accepted Answer

Configure the interface as a Layer 3 interface and assign it to a virtual router.. To assign an IP address to a firewall interface for routing, the interface must be configured as a Layer 3 interface and associated with a virtual router. The virtual router handles routing decisions, and the IP address is set on the interface. This enables the firewall to route traffic between zones. Other interface types like Layer 2, Tap, or Virtual Wire do not support IP address assignment for routing.

Answer

Configure the interface as a Tap interface and assign it to a virtual wire.

Answer

Configure the interface as a Layer 2 interface and assign it to a VLAN.

Answer

Configure the interface as a Virtual Wire interface and assign it to a zone.

Question 15

An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?

Accepted Answer

The OSPF instance is not enabled on the virtual router 'VR-Trust'.. OSPF must be enabled on the virtual router and the interface must be included in an OSPF area. Without this, the firewall will not send or process OSPF hello packets, preventing adjacency formation. The interface being Layer 3 and assigned to a zone is necessary but not sufficient; the OSPF configuration on the virtual router is the critical missing step.

Answer

The interface is not configured as a Layer 3 interface in the Network > Interfaces section.

Answer

The interface is not assigned to a security zone.

Answer

The virtual router does not have a static route to the OSPF neighbor.