190 questions total · 3pages · All types, answers revealed
Page 3 of 3
Which TWO features require a valid subscription license?
Requires a license for the database.
Why this answer
Advanced threat features like URL filtering and Threat Prevention (Antivirus/Vulnerability) require active subscriptions.
Which TWO methods can be used to update the security policy on a Palo Alto Networks NGFW programmatically?
Modern method for configuration and monitoring.
Why this answer
The XML API and the REST API (on newer versions) are the primary programmatic methods.
When using the Panorama API to push a configuration, what is the 'xpath' parameter used for?
xpath navigates the configuration tree.
Why this answer
The 'xpath' specifies the exact location in the configuration hierarchy where the change is being applied.
In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?
Heartbeat links monitor health and sync session tables.
Why this answer
The heartbeat interfaces and HA control links synchronize configuration and session state, ensuring the passive unit is ready for a seamless transition.
Which setting in a Security Policy rule determines whether traffic is permitted or denied?
Action defines the rule's outcome.
Why this answer
The 'Action' column in the security policy rule dictates whether traffic matching the rule is allowed, dropped, or reset.
You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?
EDLs must be provided as plain text files.
Why this answer
EDLs must be text files containing entries separated by newlines, with specific formatting depending on the type (IP, Domain, or URL).
Which THREE things must be configured to allow HA between two firewalls?
Required for session sync.
Why this answer
HA requires configuration of HA links (control/data), enabling HA in the device settings, and ensuring identical hardware/version.
Which TWO items must be configured to allow external management access?
Required to permit services.
Which TWO protocols are commonly used for log forwarding to SIEMs?
Increasingly used for secure, REST-based log delivery.
An administrator wants to permit traffic between two sub-interfaces on the same physical port. What is required?
Security policies are required for inter-zone traffic.
Why this answer
If the sub-interfaces are in different zones, a security policy is required; if they are in the same zone, no policy is needed if intra-zone traffic is enabled.
Selecting 'None' in the translation type effectively disables NAT for that rule.
Why this answer
NAT is designed to change IP addresses. If you need to preserve the source, you should not configure NAT, or use source NAT with 'None' as the translation type if applicable.
Which protocol is typically used for integrating Palo Alto Networks firewalls with authentication servers like LDAP or RADIUS?
LDAP is a primary protocol for authentication integration.
You need to automate the retrieval of URL filtering logs from the firewall. Which API endpoint type is used to execute a 'show' command?
Op is for operational commands.
Why this answer
The 'op' type is used to execute operational commands, including 'show' commands to retrieve logs or status.
Which command confirms that an OSPF neighbor relationship is in the 'Full' state?
This shows OSPF neighbors and their state.
Why this answer
The 'show routing protocol ospf neighbor' command displays the neighbor state, which should be 'Full' for a successfully established OSPF relationship.
You need to perform a packet capture on a specific firewall interface. Which tool is used?
This is the dedicated GUI tool for PCAPs.
Why this answer
The Packet Capture tool under Monitor > Packet Capture allows for selecting interfaces and defining filters.
If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?
High CPU or processing load causes the API to return 503.
Why this answer
A 503 error often indicates that the management plane is overloaded, or the XML API service is busy processing a previous command.
An administrator needs to identify the cause of intermittent connectivity drops for a specific application. What feature provides the most granular visibility?
PCAP allows for the inspection of the full packet flow to determine why sessions are dropping.
Why this answer
Packet capture and session flow logging are the most granular tools available in PAN-OS.
Which TWO actions must be performed to successfully configure a zone protection profile on a zone?
The profile is applied in the zone configuration menu.
Why this answer
Zone protection profiles require the profile to be defined and then explicitly applied to the security zone.
Which TWO features are part of the 'Integration and Automation' domain?
Core automation tool.
Why this answer
External Dynamic Lists and XML API are core automation tools.
What is the effect of changing the HA heartbeat interval?
Interval defines how often the peer is polled.
Why this answer
Changing the heartbeat interval affects how quickly the firewall detects a peer failure; shorter intervals increase sensitivity but also increase the risk of false failovers.
What happens to established sessions during an HA failover?
Session sync allows stateful failover.
Why this answer
If 'Session Synchronization' is enabled, the session table is synchronized, allowing established sessions to persist through the failover without being dropped.
You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?
Device > Dynamic Updates is the correct location to configure update schedules for Applications, Threats, and WildFire.
Why this answer
Dynamic update scheduling is configured under the Device tab in the PAN-OS web interface.
What is the recommended method to update the firewall's threat signatures?
This is the correct path for threat signatures.
Why this answer
Dynamic Updates under Device > Dynamic Updates allows for downloading and installing the latest signature packages.
What is the function of a 'Tap' mode interface?
Tap is for passive monitoring.
Why this answer
Tap mode interfaces allow the firewall to monitor traffic by receiving a copy of the traffic (via a SPAN port), without being inline.
The firewall looks here for the bootstrap directory tree.
Why this answer
The VM-Series looks for a specific directory structure on the attached storage device, starting with '/config/bootstrap/'.
Which TWO protocols can be used to manage the firewall?
Standard web GUI protocol.
In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?
Both nodes actively process traffic in A/A.
Why this answer
Active/Active mode allows both firewalls to process traffic simultaneously and requires link aggregation or specific load balancing, whereas Active/Passive only uses one firewall for traffic.
You are deploying a dynamic address group (DAG) that is populated by an external cloud platform. Which feature must be enabled on the NGFW to allow the firewall to receive these updates automatically?
The VM Information Source feature allows the firewall to query cloud providers for tags to populate DAGs.
Why this answer
VM Monitoring or the use of the XML API to push IP-to-Tag mappings is required. For dynamic cloud environments, the 'VM Information Source' feature or 'User-ID agent' integration with cloud tags is typically used.
You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?
An Interface Management Profile allows you to define specific services (HTTPS, SSH, Ping) and permitted IP addresses for management access.
Why this answer
Management Interface Settings under Device > Setup > Interfaces allow the restriction of management access via Service Routes and Interface Management Profiles.
When configuring HA, what is 'Preemption'?
Preemption restores the primary node to active status.
Why this answer
Preemption allows the preferred (usually higher-priority) device to automatically take over as the active firewall when it recovers from a failure.
Which tab is used to configure physical interface settings like speed and duplex?
This is where physical attributes are set.
Why this answer
The Network > Interfaces > Ethernet tab allows you to configure physical settings such as speed and duplex mode.
Which feature is used to ensure the firewall clock is accurate?
NTP is the standard for time synchronization.
Why this answer
NTP (Network Time Protocol) settings under Device > Setup > Services are used to synchronize time.
Required to point to the Panorama IP.
Why this answer
The Panorama IP, the serial number (or auth code), and the device group are standard parameters.
Which THREE items can be used as a 'Source' in a security policy?
Identity-based source.
Why this answer
Policies can use addresses, address groups, or users as the source of traffic.
Which THREE settings can be modified in a custom Antivirus Profile?
Define which traffic to scan.
Why this answer
Antivirus profiles allow you to select which protocols to scan, the action for each file type, and file blocking options.
Which CLI command displays the API key if already generated for an admin?
For security, the API key is not stored in plain text that can be retrieved.
Why this answer
Actually, the API key is never displayed via CLI once created. The admin must regenerate it if forgotten.
What is the primary benefit of using Panorama templates for automation?
Templates centralize network-related settings.
Why this answer
Templates allow for centralized network configuration management, ensuring consistency across firewalls.
When configuring a Static Route, what does the 'Metric' field do?
Lower metric = higher preference.
Why this answer
The metric is used to choose between multiple routes to the same destination; a lower metric is preferred over a higher one.
What is the purpose of the 'Pan-OS-Python' library's 'refresh_from_candidate' method?
It fetches the latest state from the device.
Why this answer
This method updates the local Python object state to match the firewall's current candidate configuration.
Which tab in the web interface is used to create and manage security policies?
Policies manages Security, NAT, and other rule types.
Why this answer
The 'Policies' tab is where all firewall rule sets are managed.
Page 3 of 3
Practice NGFW-Engineer by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →