NGFW-Engineer PAN OS Networking Configuration — Timed 50 Questions

Question 1

An administrator needs to implement redundant HA links. Which configuration ensures that the HA1 control link maintains connectivity if the primary physical link fails?

Accepted Answer

Configure a secondary HA2 interface.. HA1 backup links allow for control plane redundancy, ensuring synchronization continues if the primary link is disrupted.

Answer

Configure a virtual wire between HA1 and HA2 ports.

Answer

Assign the same IP to both HA1 interfaces.

Question 2

You are configuring a virtual wire interface. Which setting is required to ensure that traffic is passed between the two interfaces?

Accepted Answer

Assign a security zone to each interface. Virtual wire requires a vwire object mapping two interfaces; once the object is assigned to the interfaces, traffic is passed based on the virtual wire security policy.

Answer

Configure an IP address on both interfaces

Answer

Create a loopback interface

Answer

Enable dynamic routing on the virtual wire

Question 3

You are configuring a new Ethernet interface on a PA-5220. You must ensure the interface processes traffic for a specific VLAN ID tagged on an 802.1Q trunk. Which interface type should you select?

Accepted Answer

Layer3. A subinterface is required to handle tagged VLAN traffic on a physical Ethernet interface in PAN-OS.

Answer

Tap

Answer

Virtual Wire

Answer

Layer2

Question 4

When troubleshooting a BGP route that is not appearing in the routing table, which command provides the most insight?

Accepted Answer

show routing protocol bgp rib-in. The 'show routing protocol bgp rib-in' command shows the prefixes received from peers before they are filtered and installed in the RIB.

Answer

show interface all

Answer

show system state

Answer

show routing fib

Question 5

An administrator wants to permit traffic between two sub-interfaces on the same physical port. What is required?

Accepted Answer

Security policy allowing traffic between the zones. If the sub-interfaces are in different zones, a security policy is required; if they are in the same zone, no policy is needed if intra-zone traffic is enabled.

Answer

Enable DHCP relay on both interfaces

Answer

A VPN tunnel between the sub-interfaces

Answer

A static route pointing to the physical port

Question 6

Which object defines the encryption settings for a Site-to-Site VPN?

Accepted Answer

IKE Crypto Profile. The IKE Crypto Profile defines the encryption, hashing, and DH group settings for the IKE negotiation phase.

Answer

Virtual Router

Answer

IPsec Crypto Profile

Answer

Tunnel Interface

Question 7

How do you delete a security policy rule?

Accepted Answer

Policies > Security > Delete. In the Policies > Security tab, select the rule and click the 'Delete' button at the bottom of the page.

Answer

Network > Zones > Delete

Answer

Device > Setup > Delete

Answer

Right-click the rule and 'Remove'

Question 8

Which TWO factors contribute to a successful BGP peer establishment?

Accepted Answer

TCP connectivity on port 179. BGP requires matching Autonomous System numbers and TCP connectivity (port 179) between the peers.

Answer

Matching interface speed

Answer

OSPF adjacency

Answer

Matching router descriptions

Question 9

Which TWO interface modes are commonly used to segment traffic?

Accepted Answer

Layer 3. Layer 3 and Virtual Wire modes are common ways to segment and protect traffic.

Answer

Aggregate Ethernet

Answer

Management

Answer

Loopback

Question 10

Which THREE settings are configured in a Layer 3 interface?

Accepted Answer

Virtual Router. L3 interfaces require an IP address, a zone assignment, and an association with a virtual router.

Answer

Aggregate setting

Answer

Management Profile

Question 11

Which TWO conditions are required for a firewall to become the 'Active' unit in HA?

Accepted Answer

Highest device priority. A firewall becomes active based on the device priority and whether it successfully wins the election process.

Answer

Being the passive unit first

Answer

Having the most interfaces

Answer

Having the latest firmware

Question 12

An engineer needs to configure a Layer 3 subinterface on a Palo Alto Networks firewall to support multiple VLANs on a single physical interface. The physical interface is already configured as a Layer 3 interface with an IP address. What must be done before creating the subinterface?

Accepted Answer

Create the subinterface and assign a VLAN tag and IP address to it.. Creating a Layer 3 subinterface requires specifying a VLAN tag and an IP address. The physical interface can remain a Layer 3 interface with its own IP address; subinterfaces are added under it. This allows the firewall to route traffic for multiple VLANs on a single physical link, which is common in trunked environments.

Answer

Remove the IP address from the physical interface and assign it to the subinterface.

Answer

Enable VLAN tagging on the physical interface by assigning it to a VLAN object.

Answer

Change the physical interface type to Layer 2 and then create the subinterface.

Question 13

An administrator is configuring a sub-interface on a Palo Alto Networks firewall to allow traffic between two zones. The physical interface is already configured as a Layer 3 interface with an IP address. The administrator creates a sub-interface with VLAN tag 100 and assigns it to a new zone. After committing, traffic is not passing. What is a mandatory configuration step that the administrator likely missed?

Accepted Answer

The sub-interface must have an IP address configured.. The mandatory step that is often missed is configuring an IP address on the sub-interface. A sub-interface is a logical Layer 3 interface and requires an IP address to route traffic. Without it, the firewall cannot forward packets, and traffic will fail. Other steps like zone assignment and virtual router assignment are also required, but the IP address is fundamental.

Answer

The parent interface must be configured with the same VLAN tag as the sub-interface.

Answer

The sub-interface must be assigned to a virtual router different from the parent interface.

Answer

The sub-interface must be configured as a Layer 2 interface.

Question 14

An engineer configures a new Palo Alto Networks firewall with two interfaces in the same security zone. The firewall is running PAN-OS 11.1. Traffic entering one interface and exiting the other within the same zone is being blocked by an implicit rule. What is the default behavior for intra-zone traffic, and how can the engineer allow it?

Accepted Answer

Intra-zone traffic is denied by default; create a security policy rule allowing the zone to itself.. The correct answer is to create a security policy rule allowing the zone to itself. By default, PAN-OS includes an implicit intra-zone rule that denies traffic between interfaces within the same zone. To permit such traffic, a custom rule with source and destination zones both set to the same zone must be created. This overrides the implicit deny and allows the desired communication.

Answer

Intra-zone traffic is allowed if the interfaces are in different virtual routers.

Answer

Intra-zone traffic is controlled by the 'intrazone-default' rule, which can be modified to allow specific applications.

Answer

Intra-zone traffic is allowed by default; no action is needed.

Question 15

An engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to ensure that the tunnel interface is properly configured to route traffic over the VPN. Which two configurations are required on the tunnel interface? (Choose two.)

Accepted Answer

Assign the tunnel interface to a security zone.. A tunnel interface must be assigned to a security zone and to a virtual router. The zone enables security policy enforcement, and the virtual router enables routing of traffic into and out of the tunnel. These two configurations are essential for a functional route-based Site-to-Site VPN.

Answer

Configure the tunnel interface as a Layer 2 interface.

Answer

Enable OSPF on the tunnel interface.

Answer

Configure the tunnel interface with an IP address.

Question 16

A network architect is designing a Palo Alto Networks firewall deployment that requires policy-based forwarding (PBF) to route specific traffic out of a particular ISP link based on the source IP address. The firewall has two ISP connections on different interfaces. The architect wants to ensure that if the primary ISP link fails, traffic is automatically rerouted to the secondary ISP. Which PAN-OS feature should be used to monitor the primary ISP link and trigger the PBF rule to use the secondary link?

Accepted Answer

Policy-Based Forwarding (PBF) with a link monitoring profile. Policy-Based Forwarding (PBF) with a link monitoring profile allows the firewall to monitor the health of a specific ISP link. If the monitored IP becomes unreachable, the PBF rule is deactivated, and traffic can be forwarded using the next matching rule or the routing table, which can point to the secondary ISP. This provides automatic failover for policy-based forwarding. Other options like dynamic routing or static routes do not offer the same granular, policy-based control.

Answer

Static routes with path monitoring

Answer

Dynamic routing with OSPF and BFD

Answer

HA active/active configuration with link monitoring

Question 17

An administrator is setting up a new Palo Alto Networks firewall and needs to configure a loopback interface to be used as the router ID for OSPF. Which configuration step is required to make the loopback interface usable for this purpose?

Accepted Answer

Assign an IP address to the loopback interface and ensure it is up/up.. The OSPF router ID on a Palo Alto Networks firewall is determined by the highest IP address of a loopback interface that is up/up, or if none, the highest IP of a physical interface. Therefore, the essential step is to assign an IP address to the loopback interface and ensure it is operational. Security zone assignment, passive mode, or enabling OSPF on the interface are not prerequisites for router ID selection.

Answer

Assign an IP address to the loopback interface and enable OSPF on it.

Answer

Assign an IP address to the loopback interface and add it to a security zone.

Answer

Assign an IP address to the loopback interface and configure it as a passive interface in OSPF.

Question 18

An engineer configures a Layer 3 interface on a PA-3220 with two IP addresses: 10.1.1.1/24 and 10.2.2.1/24. The interface is assigned to the 'trust' zone in virtual router 'default'. Users on 10.1.1.0/24 report they can reach the internet, but users on 10.2.2.0/24 cannot. The firewall's routing table shows a default route via 10.1.1.254. No policy denies traffic from the trust zone. What is the most likely cause?

Accepted Answer

The default route is reachable only via 10.1.1.254, so return traffic for 10.2.2.0/24 is sent to the wrong next hop or dropped due to asymmetric routing.. The correct answer focuses on the routing asymmetry caused by the default route being on the 10.1.1.0/24 subnet. Even though the interface has both IPs, return traffic for 10.2.2.0/24 will follow the default route to 10.1.1.254, which may not have a path back to 10.2.2.0/24, or the firewall may drop packets if it sees them arriving on a different interface than expected. Ensuring proper routing or adding a specific route for 10.2.2.0/24 solves the problem.

Answer

The second IP address requires a separate Layer 3 interface because PAN-OS supports only one IP per interface.

Answer

A security policy must explicitly allow traffic from the 10.2.2.0/24 subnet because the trust zone only permits 10.1.1.0/24 by default.

Answer

The firewall requires a separate virtual router for each IP subnet assigned to an interface.

Question 19

A network engineer is configuring a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the tunnel interface IP address is correctly configured and that the tunnel can be used for routing. Which configuration step is required to assign an IP address to the tunnel interface?

Accepted Answer

Configure the tunnel interface as a Layer 3 interface and assign a static IP address in the same subnet as the remote tunnel interface.. To use a tunnel interface for routing, it must be configured as a Layer 3 interface with an IP address. This IP address should be in the same subnet as the remote tunnel interface to enable direct communication. Assigning the tunnel interface to a virtual router and zone is also necessary, but the IP address assignment is the key step for routing functionality.

Answer

Configure a static route to the remote network pointing to the tunnel interface, and the firewall will automatically assign an IP address to the tunnel interface.

Answer

Use a loopback interface with an IP address and reference it in the IPsec tunnel configuration as the local identity.

Answer

Create a tunnel interface in the Network > Interfaces > Tunnel section and assign it to a virtual router and a security zone.

Question 20

A PAN-OS firewall is deployed in a high-availability (HA) active/passive configuration. The administrator needs to ensure that the HA1 control link remains operational even if the primary HA1 link fails. Which two configurations achieve this? (Choose two.)

Accepted Answer

Enable HA1 backup link and specify a different physical interface for it.. To ensure HA1 control link redundancy, you must configure an HA1 backup link on a separate physical interface. This provides an alternate path for HA control traffic if the primary link fails. Both options that specify a separate physical interface for the backup are correct. Other options do not provide link redundancy.

Answer

Configure HA1 backup link on a different subnet than the primary HA1 link.

Answer

Enable HA1 encryption and configure a dedicated VLAN for HA traffic.

Answer

Use the same physical interface for HA1 and HA2 with VLAN tagging.