NGFW-Engineer PAN OS Networking Configuration Practice Test 8 — 15 Questions

Question 1

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a static route to 0.0.0.0/0 and ensure it is active in the virtual router.. To advertise a static default route into OSPF on a Palo Alto Networks firewall, you must first ensure the static default route exists and is active in the virtual router. Then, you need to create a redistribution profile that matches the default route and apply it as an export rule in the OSPF configuration. This two-step process ensures that the default route is injected into OSPF and propagated to neighbors. Without both steps, the default route will not be advertised.

Answer

Enable 'Default Information Originate' in the OSPF global settings.

Answer

Enable 'Advertise Default Route' in the OSPF area configuration.

Answer

Set the OSPF router priority to a non-zero value to allow default route propagation.

Question 2

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

Accepted Answer

MTU mismatch on the interfaces. The EXSTART state in OSPF is part of the database exchange process where routers negotiate master/slave roles. If the Maximum Transmission Unit (MTU) on the interfaces does not match, the routers cannot successfully exchange database description packets, and the adjacency remains stuck in EXSTART. Checking MTU settings is a key troubleshooting step for this issue. Area mismatches, hello interval mismatches, and duplicate router IDs would cause different neighbor states.

Answer

Mismatched OSPF area IDs

Answer

Duplicate router IDs

Answer

Incorrect OSPF hello interval

Question 3

A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?

Accepted Answer

Create an OSPF area and add the interface as an OSPF interface in the Virtual Router configuration.. OSPF on PAN-OS is configured within a virtual router. You must define an OSPF area and then add the Layer 3 interface to that area. This step activates OSPF on the interface, allowing it to form adjacencies. Without adding the interface to an OSPF area, the firewall will not participate in OSPF on that interface, regardless of other settings.

Answer

Configure a static route to the neighbor and enable OSPF via the CLI with 'set protocol ospf enable'.

Answer

Enable OSPF globally under Device > Setup > Routing.

Answer

Assign the interface to the 'trust' zone and enable OSPF in the zone protection profile.

Question 4

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

Accepted Answer

Management interface. The dedicated management interface is designed for out-of-band management, providing isolation from data traffic. It has its own IP address and is in a separate zone, ensuring that management access is not mixed with data plane traffic. This meets the requirement for isolation and secure management.

Answer

Layer 2 interface

Answer

Layer 3 interface

Answer

Virtual wire interface

Question 5

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

Accepted Answer

Layer 3 interface. A Layer 3 interface in PAN-OS is a routed interface that can be assigned an IP address and used as a gateway for a subnet. It operates at the network layer and can be assigned to a security zone, enabling routing between zones. This is the standard interface type for connecting to internal networks, DMZs, or the internet when the firewall is acting as a router. Layer 2, Virtual Wire, and Tunnel interfaces do not provide the same routing capabilities and are used for different purposes.

Answer

Virtual Wire interface

Answer

Tunnel interface

Answer

Layer 2 interface

Question 6

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

Accepted Answer

Destination NAT with port translation (PAT). Destination NAT with port translation enables the firewall to use the destination port to distinguish between multiple internal servers that share a single public IP address. This is the standard method for conserving public addresses while hosting several services. The other NAT types either do not consider the destination port or are meant for outbound or internal hairpin traffic, not inbound service publishing.

Answer

Source NAT with dynamic IP and port

Answer

Destination NAT with a static IP mapping

Answer

U-Turn NAT with a static route

Question 7

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

Accepted Answer

Enable OSPF on the virtual router and assign the interface to an OSPF area.. To form an OSPF adjacency, the firewall must have OSPF enabled on the virtual router and the participating interface must be assigned to an OSPF area. This allows the firewall to send and receive Hello packets. Without these steps, the firewall will not participate in OSPF, regardless of other settings.

Answer

Create a static route to the ISP router and enable OSPF on the virtual router.

Answer

Configure a loopback interface and assign it to the same OSPF area as the ISP router.

Answer

Set the interface type to Layer 2 and enable OSPF on the Layer 2 interface.

Question 8

A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)

Accepted Answer

Enable OSPF globally and configure areas and interfaces under the virtual router.. To enable OSPF on a Palo Alto Networks firewall, you must first create a virtual router and assign the relevant interfaces to it. Then, within that virtual router, you enable OSPF globally and configure areas and interface participation. These two tasks are essential for OSPF to form adjacencies and exchange routes. Other tasks like BGP configuration, loopback interfaces, or enabling OSPF on the management interface are not required for basic OSPF operation.

Answer

Enable OSPF on the management interface.

Answer

Set up a loopback interface with an IP address.

Answer

Configure BGP for route redistribution.

Question 9

A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?

Accepted Answer

PPPoE interface. The PPPoE interface type on a Palo Alto Networks firewall is specifically designed to negotiate a PPPoE session with an ISP, including authentication and dynamic IP address assignment. When an ISP requires PPPoE, configuring the Ethernet interface as a PPPoE interface is the correct approach. Other interface types like Layer 3 with DHCP or Layer 2 do not support the PPPoE protocol and would fail to establish the required connection.

Answer

Layer 3 interface with DHCP client enabled

Answer

Tunnel interface with IPsec

Answer

Layer 2 interface with VLAN tag

Question 10

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

Accepted Answer

Assign all three interfaces (GigabitEthernet1/1, GigabitEthernet1/2, and the tunnel interface) to a single virtual router, and place each interface in its own zone.. A single virtual router in PAN-OS can contain multiple Layer 3 interfaces, including physical and tunnel interfaces, and will route traffic between them based on its routing table. Assigning each interface to its own zone allows granular security policies. This design efficiently routes between internal, guest, and tunnel networks without the complexity of multiple virtual routers.

Answer

Configure all interfaces as Layer 2 and use VLANs to segment the networks, then route between VLANs using a Layer 3 subinterface.

Answer

Create three separate virtual routers, one for each network, and configure static routes between them.

Answer

Use policy-based forwarding to direct traffic between the networks, and assign each interface to a different virtual router.

Question 11

An administrator is configuring a site-to-site VPN between two PAN-OS firewalls. The VPN will use a tunnel interface to route traffic. The administrator has created the IKE gateway and IPsec crypto profile. Which additional configuration is required to assign an IP address to the tunnel interface?

Accepted Answer

Create a tunnel interface under Network > Interfaces > Tunnel, then assign an IP address in the interface settings.. Tunnel interfaces in PAN-OS are created as logical interfaces under Network > Interfaces > Tunnel. They require an IP address to function as the local endpoint for the VPN. This IP is used for routing traffic into the tunnel. The IKE gateway and IPsec crypto profile handle the secure channel, but the tunnel interface IP is essential for the data plane.

Answer

Assign the IP address directly in the IKE gateway configuration under the Advanced tab.

Answer

Configure the IP address in the IPsec crypto profile under the Tunnel Interface field.

Answer

Use the 'set network interface tunnel ip' command in the CLI to assign the IP address.

Question 12

A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?

Accepted Answer

Configure a virtual router and assign both interfaces to it. To route traffic between Layer 3 interfaces, PAN-OS uses virtual routers. Assigning both interfaces to the same virtual router allows the firewall to use its routing table to forward packets between them. While security policies are needed to permit the traffic, the fundamental routing configuration is the virtual router assignment.

Answer

Assign both interfaces to the same security zone

Answer

Create a security policy allowing traffic between the two zones

Answer

Enable OSPF on both interfaces

Question 13

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

Accepted Answer

Configure a Path Monitoring profile on the primary default route.. Path Monitoring on a static route allows the firewall to periodically ping a specified IP address through that route. If the pings fail, the route is withdrawn, and the backup route takes over. This provides automatic failover for static routes, which is necessary when not using dynamic routing protocols.

Answer

Enable OSPF on both ISP interfaces and configure equal-cost multipath.

Answer

Set the backup default route with a higher administrative distance than the primary.

Answer

Configure a static route with a lower metric on the backup ISP and enable BFD.

Question 14

A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?

Accepted Answer

A PBF policy with a source address match and application filters for HTTP and HTTPS.. Policy-based forwarding rules can match on source address and application. To forward only HTTP and HTTPS traffic from a specific source, the PBF policy must include both a source address match and application filters for those applications. This ensures that other traffic from the same source follows the normal routing table.

Answer

A PBF policy with a source address match and a next-hop virtual router.

Answer

A static route with a next-hop that is reachable only from the trust zone.

Answer

A PBF policy with a destination address match and a service object for HTTP and HTTPS.

Question 15

An administrator is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a single physical link that delivers both internet traffic (untagged) and IPTV multicast traffic (VLAN 300). The administrator wants to give the IPTV traffic its own security zone and apply a distinct security policy, while keeping the internet traffic in the existing untagged zone. Which configuration should the administrator use on the physical interface?

Accepted Answer

Create a Layer 3 subinterface for VLAN 300 and assign it to a new zone, while leaving the parent interface untagged for internet traffic.. Using a Layer 3 subinterface for VLAN 300 allows the firewall to route tagged IPTV traffic separately from untagged internet traffic. The subinterface can be assigned to a new zone, enabling distinct security policies. This is the correct way to handle multiple logical networks on one physical interface while maintaining Layer 3 routing.

Answer

Use a loopback interface with a VLAN tag and assign it to the IPTV zone.

Answer

Configure the physical interface as a Layer 2 interface and create two VLAN objects for internet and IPTV traffic.

Answer

Create a virtual wire between two physical interfaces and map VLAN 300 to a separate virtual wire.