NGFW-Engineer PAN OS Networking Configuration Practice Test 9 — 15 Questions

Question 1

An engineer needs to configure a Palo Alto Networks firewall to act as a DHCP server for a network segment connected to Ethernet1/1. The engineer wants the firewall to assign IP addresses from the 192.168.10.0/24 subnet. Which configuration step is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a DHCP Server profile and assign it to the interface under Network > DHCP > DHCP Server.. The correct step is to create a DHCP Server profile and assign it to the interface. This profile defines the pool of addresses, gateway, DNS, and lease parameters. The firewall then listens for DHCP requests on that interface and responds with addresses from the pool. Other options either enable client mode, relay, or security features not related to serving DHCP.

Answer

Assign a static IP address to the interface and enable DHCP snooping.

Answer

Enable DHCP on the interface Ethernet1/1 under Network > Interfaces > Ethernet.

Answer

Configure a DHCP Relay agent on the interface to forward requests to an external server.

Question 2

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a subnet. The firewall interface is configured with a static IP address. Which additional step is required to enable DHCP server functionality on that interface?

Accepted Answer

Enable DHCP server in the interface's advanced settings and define an address pool.. The correct answer is to enable DHCP server in the interface's advanced settings and define an address pool. PAN-OS allows an interface with a static IP to function as a DHCP server. This is configured under the interface's IPv4 or IPv6 settings, where you specify the address pool, lease times, and other parameters. No external relay is needed.

Answer

Configure a DHCP relay agent to forward requests to an external DHCP server.

Answer

Create a security policy rule allowing DHCP traffic from the zone to the DHCP server.

Answer

Enable DHCP client on the interface to obtain an IP address dynamically.

Question 3

An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?

Accepted Answer

Using the management interface for HA1 requires that the management interfaces are in the same subnet and that HA1 IP addresses are configured.. When using the management interface for HA1, you must configure HA1 IP addresses on both firewalls in the same subnet. This ensures that the control link can communicate. The management interface is not automatically set up for HA; explicit configuration is required. This is a valid and supported configuration, though often a dedicated HA1 interface is preferred.

Answer

Using the management interface for HA1 is not supported; HA1 must use a dedicated data interface.

Answer

HA2 must use the same interface as HA1; it cannot be configured on a separate interface.

Answer

HA2 can be configured on the same interface as HA1, but it is not recommended due to performance issues.

Question 4

A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?

Accepted Answer

On the tunnel interface itself under Network > Interfaces > Tunnel > IPv4.. The correct answer is to configure the tunnel interface IP address on the tunnel interface under Network > Interfaces > Tunnel > IPv4. In PAN-OS, a tunnel interface is a logical interface that must be assigned an IP address to route traffic through the VPN. This address is separate from the IKE and IPsec configurations, which handle authentication and encryption.

Answer

In the IKE Gateway configuration under Network > Interfaces > Tunnel.

Answer

In the IPsec Crypto Profile under Network > Interfaces > Tunnel.

Answer

In the VPN tunnel configuration under Network > IPSec Tunnels > Proxy IDs.

Question 5

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

Accepted Answer

Configure the subinterface with the appropriate VLAN tag and assign it to a Layer 3 security zone.. A Layer 3 subinterface must be associated with a VLAN tag to correctly identify and process the tagged guest traffic on the physical interface. It also must be placed in a Layer 3 security zone so that security policy and routing can be applied to that traffic. Without both the tag and zone assignment, the firewall cannot enforce policy or route the guest network.

Answer

Set the parent interface to Layer 2 mode and create a VLAN interface for the guest network.

Answer

Enable jumbo frames on the parent interface to accommodate the additional VLAN header.

Answer

Create a VLAN object under Network > VLANs and assign it to the subinterface.

Question 6

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Accepted Answer

Assign an IP address to the tunnel interface.. To route traffic into a site-to-site VPN tunnel, the tunnel interface must have an IP address to serve as a next-hop, and a static route must direct traffic for the remote network to that tunnel interface. These two steps ensure the firewall can forward packets into the tunnel. Dynamic routing and security policies are separate concerns that may be needed for full connectivity but are not the routing configuration itself.

Answer

Create a security policy allowing traffic from the local zone to the VPN zone.

Answer

Configure a NAT policy to translate traffic entering the tunnel.

Answer

Enable OSPF on the tunnel interface.

Question 7

An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?

Accepted Answer

Assign both interfaces to the same virtual router; no static routes are needed because the subnets are directly connected.. To route between two directly connected subnets, both interfaces must be assigned to the same virtual router. The firewall automatically creates directly connected routes for each interface's subnet. No static routes or dynamic routing protocols are needed because the routes are already in the routing table as connected routes.

Answer

Assign both interfaces to different virtual routers and configure inter-virtual-router routing.

Answer

Assign both interfaces to the same virtual router and configure a static route for each subnet.

Answer

Assign both interfaces to the same virtual router and enable OSPF to advertise the connected subnets.

Question 8

A network engineer is configuring a site-to-site VPN between two PA-5220 firewalls. The engineer wants to ensure that if the primary ISP link fails, the VPN tunnel automatically re-establishes over a backup ISP link without manual intervention. Both firewalls have two ISP connections and the VPN is configured with a tunnel interface. Which PAN-OS feature should the engineer configure to achieve this?

Accepted Answer

Dead Peer Detection (DPD) with a short interval and a secondary peer IP address in the IKE Gateway configuration.. The correct answer is DPD with a secondary peer IP. DPD monitors the peer's availability; when the primary link fails, DPD detects the dead peer and initiates renegotiation. By specifying a secondary peer IP (the backup ISP address of the remote firewall) in the IKE Gateway, the local firewall can attempt to establish the tunnel over the backup link automatically. This combination provides seamless failover without manual intervention.

Answer

Policy-Based Forwarding (PBF) with a rule that redirects VPN traffic to the backup ISP.

Answer

Virtual Router Redundancy Protocol (VRRP) between the two ISP links to provide a virtual IP that the VPN uses.

Answer

Quality of Service (QoS) profiles to prioritize VPN traffic on the primary link.

Question 9

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

Accepted Answer

Enable DHCP server on the Layer 3 interface and configure an IP pool with the desired range.. To configure the firewall as a DHCP server, you must enable DHCP server on the Layer 3 interface and define an IP pool with the desired range. Additionally, you must set lease time and DNS server settings within the DHCP server configuration to meet the specific requirements. These two steps are essential for the firewall to provide IP addresses and network parameters to clients.

Answer

Configure a DHCP relay agent to forward requests to an external DHCP server.

Answer

Create a security policy allowing DHCP traffic from the guest zone to the firewall's management interface.

Answer

Assign a static IP address to the guest client devices manually.

Question 10

A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?

Accepted Answer

Add a static route in the virtual router with destination 0.0.0.0/0 and next-hop 203.0.113.1.. The firewall uses its virtual router to make forwarding decisions. To reach the internet, it needs a default route pointing to the next-hop gateway. Adding a static route with destination 0.0.0.0/0 and the next-hop IP address ensures that all traffic without a more specific route is sent to the ISP. This is the fundamental step for internet connectivity.

Answer

Enable OSPF on ethernet1/1 to dynamically learn the default route.

Answer

Create a policy-based forwarding rule to redirect all traffic to 203.0.113.1.

Answer

Configure a NAT rule to translate all outbound traffic to the firewall's external IP address.

Question 11

A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?

Accepted Answer

Management interface. The management interface on a Palo Alto Networks firewall is specifically designed for out-of-band management. It is separate from data interfaces and cannot be used for data traffic, ensuring dedicated management access. Assigning an IP address to the MGT interface allows administrators to connect via SSH or HTTPS without impacting data plane operations. Other interface types like Layer 3 or loopback can be used for management but are not dedicated solely to that purpose.

Answer

Layer 2 interface

Answer

Loopback interface

Answer

Layer 3 interface

Question 12

A network engineer is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The engineer wants the firewall to assign IP addresses to guests and also provide DNS server information. Which configuration step is necessary to achieve this?

Accepted Answer

Enable DHCP server on the interface and configure an address pool. Enabling the DHCP server on the interface and configuring an address pool is the essential step for the firewall to assign IP addresses. The firewall can also provide DNS and other options within the DHCP server configuration. Other options like relay or security policies are not required for the firewall itself to be a DHCP server.

Answer

Configure a DHCP relay agent pointing to an external DHCP server

Answer

Configure a static route for the guest network

Answer

Create a security policy allowing DHCP traffic from the guest zone to the firewall

Question 13

An administrator is configuring a Palo Alto Networks firewall to route traffic between two internal networks. The firewall has two Layer 3 interfaces, Ethernet1/1 and Ethernet1/2, each assigned to different security zones and different virtual routers. The administrator wants traffic from the trust zone to reach the untrust zone, but the firewall is not routing the traffic. What is the most likely cause?

Accepted Answer

The two interfaces are in different virtual routers, so the firewall cannot route between them.. Interfaces in different virtual routers cannot route traffic between each other by default. To allow routing between the trust and untrust zones, the interfaces must be in the same virtual router, or inter-virtual-router routing must be configured. The most likely cause is the virtual router separation, which prevents the firewall from forwarding packets between the two networks.

Answer

A security policy is missing to allow traffic between the trust and untrust zones.

Answer

The interfaces are not configured with IP addresses.

Answer

The firewall requires a virtual wire to route between different zones.

Question 14

An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?

Accepted Answer

The firewall uses the virtual router associated with the ingress interface to make the routing decision.. The firewall uses the virtual router associated with the ingress interface to perform the route lookup. This means the routing table of that virtual router is consulted. If the route points to an egress interface in another virtual router, the packet is dropped unless route leaking is configured. The egress virtual router is not used for the initial decision.

Answer

The firewall uses the virtual router associated with the egress interface to make the routing decision.

Answer

The firewall uses the virtual router with the lowest administrative distance for the destination network.

Answer

The firewall uses the virtual router that has a default route configured.

Question 15

An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?

Accepted Answer

Set the OSPF priority on ethernet1/1 to a value higher than other routers on that network.. In OSPF, the DR is elected based on the highest priority. To make the firewall the DR on a specific network, you must set its OSPF priority on that interface to a value higher than any other router on the same network. The default priority is 1, so setting it to a higher number (e.g., 2 or more) ensures the firewall wins the election, assuming other routers have lower priorities.

Answer

Set the OSPF network type to point-to-point on ethernet1/1.

Answer

Enable OSPF on ethernet1/2 only and set it as passive.

Answer

Configure a higher router ID on the firewall than other routers.