NGFW-Engineer PAN OS Networking Configuration Practice Question

Which THREE items are required to configure a Site-to-Site VPN?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

IPsec Tunnel

Site-to-Site VPNs require an IKE Gateway (Phase 1), an IPsec Tunnel (Phase 2), and a Tunnel interface to tie them together.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Aggregate Ethernet
Why it's wrong here
Not required.
✓
IPsec Tunnel
Why this is correct
Phase 2 object.
✗
GlobalProtect Portal
Why it's wrong here
Used for remote access VPN.
✓
IKE Gateway
Why this is correct
Phase 1 object.
✓
Tunnel Interface
Why this is correct
Logical interface for the VPN.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

This NGFW-Engineer question is part of Courseiva's 190-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Practice tests

Quick scored rounds with instant marking and a written explanation per question.

NGFW-Engineer Practice Test 2 — 25 Questions→NGFW-Engineer Practice Exam 4 — 20 Questions→

Study by exam domain

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

PAN OS Networking Configuration PAN OS Device Setting Configuration Integration And Automation

Filter by question format

Pick a question style and work only that format until it feels routine.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

PAN OS Networking Configuration practice questions NGFW-Engineer fundamentals practice questions NGFW-Engineer troubleshooting practice questions

Continue studying

Study guide Certified Next-Generation Firewall Engineer (NGFW-Engineer) exam guide All Palo Alto Networks practice questions

This NGFW-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NGFW-Engineer exam.