Certified Next-Generation Firewall Engineer (NGFW-Engineer) (NGFW-Engineer) — Questions 1–75

The Management Interface Settings allow you to define an allowed IP address list to restrict access to the management plane.

You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.

The Dashboard tab contains system resources widgets that show real-time CPU and memory load.

IKE Crypto Profiles define encryption algorithms, hashing algorithms, and Diffie-Hellman groups for Phase 1.

Path Monitoring allows the firewall to monitor reachability to critical network resources (like a gateway or server); if the path fails, the firewall can trigger an HA failover.

The 'test routing fib-lookup' command is the primary tool for verifying how the firewall will route a packet.

A 403 error indicates that the API key provided has insufficient permissions or the admin account associated with the key lacks the necessary role to access the resource.

DNS settings for the firewall management plane are found under Device > Setup > Services.

The 'show interface tunnel.<id>' command displays the status, packet counts, and errors for the tunnel interface.

Cortex XSOAR is the industry-leading SOAR platform designed for security orchestration and automation.

Policy Optimizer helps identify unused rules and improve policy efficiency by suggesting changes to security rules.

The Portal is responsible for distributing the configuration/client software, while the Gateway handles the actual tunnel and traffic enforcement.

Application override matches traffic based on source, destination, and service (port/protocol).

Creating an App-ID override or adjusting security policies to use more specific signatures can reduce unnecessary processing, but creating an Application Filter/Group is the standard method for management; however, using 'Application Override' is the direct way to bypass App-ID for known, trusted traffic.

Service routes require defining the source interface and the source IP address for specific services.

Assigning an interface to a security zone makes it eligible for participation in security policies.

The Proxy ID configuration in the IKE Gateway/IPsec tunnel settings defines exactly which traffic (source/destination/protocol) is permitted through the tunnel; unmatched traffic is dropped or routed outside the tunnel.

Aggregate Ethernet (AE) allows you to combine multiple physical interfaces into one logical interface for higher throughput and link redundancy.

Layer 3 and Loopback interfaces support IP addresses.

Hairpin NAT requires the security policy to allow the traffic into the zone where the server resides and for the NAT rule to be correctly configured with the source zone set to the internal zone.

L3 interfaces require an IP address, a zone assignment, and an association with a virtual router.

The default security policy for traffic moving between different zones is to drop it.

PAN-OS supports various authentication methods including local database, LDAP, RADIUS, and TACACS+.

Threat prevention includes Antivirus, Anti-Spyware, and Vulnerability Protection profiles.

If the HA control link fails, the firewalls may lose synchronization, and both could potentially try to become 'Active' (a split-brain scenario) unless heartbeat link monitoring is correctly configured.

Administrators can authenticate using local database accounts or external services like RADIUS or TACACS+.

The interface cannot be used in a security policy, effectively making it unusable for traffic management through the firewall.

The IKE Crypto Profile defines the encryption, hashing, and DH group settings for the IKE negotiation phase.

BGP will not establish if there is a mismatch in AS numbers or if TCP port 179 is blocked.

Regularly fetching and verifying the 'running-config' against a known-good baseline or source-of-truth is critical for integrity.

OSPF requires Area ID and Hello/Dead timers to match to form an adjacency.

Agentless User-ID requires defining a service account, enabling WMI/WinRM, and adding the domain controller as a server to monitor.

Changes on a Palo Alto firewall are 'staged' and only active once the 'Commit' button is pressed.

You must define the source URL and set the update frequency in the EDL object.

In the Network > Interfaces > [Interface Name] > IPv4 tab, you can select 'DHCP' for the IP configuration.

The 'show session all' command is the standard way to view active sessions on the firewall.

VPN configuration requires a tunnel interface, a crypto profile (IKE/IPsec), and a static/dynamic route.

Physical interfaces, sub-interfaces, and tunnel interfaces can all be assigned to security zones.

The Local IP is the interface IP address on the firewall that will initiate or receive the VPN connection.

Virtual wire requires a vwire object mapping two interfaces; once the object is assigned to the interfaces, traffic is passed based on the virtual wire security policy.

The 'Export' option in the Device > Setup > Operations tab allows for taking a configuration snapshot.

Service routes are used to define which interface the firewall uses to reach services like DNS, NTP, and updates.

SSL/TLS service settings under Device > Setup > Management > SSL/TLS Service Profile allow you to restrict minimum TLS versions.

A 400 error indicates that the request sent by the client is malformed or invalid according to the API schema.

Session synchronization settings within the HA configuration are required to ensure session tables are mirrored across peers.

'type=config' is used to perform create, read, update, or delete operations on the device configuration.

A Virtual Router maintains the routing table and processes packets based on destination IP, performing route lookups for traffic.

PAN-OS supports OSPF, BGP, and RIP as the primary dynamic routing protocols.

Common actions include 'Allow', 'Deny', 'Drop', 'Reset', and log forwarding configuration.

The firewall uses the virtual router associated with the ingress interface to perform the routing lookup for the packet.

The WildFire Analysis profile is specifically designed to identify and sandbox suspicious files to detect malware.

Overlapping subnets cause routing conflicts, leading to unpredictable traffic flow.

The Router ID is a unique 32-bit identifier used to identify the router in the OSPF autonomous system and is essential for forming adjacencies and identifying the source of LSAs.

Regions in the address object allow you to define rules based on the source or destination country.

User-ID must be configured to map users to groups for group-based policy enforcement.

The 'Monitor' tab > 'Logs' > 'System' is the central place to see all system-level events.

The firewall requires a server monitoring configuration to be defined for the specific domain controller or server being monitored by the agent.

A Layer 3 interface is required for routing traffic between subnets.

A Layer 3 interface is assigned an IP address and is associated with a virtual router to route traffic based on the routing table.

Check logs, verify credentials, and test connectivity to the management interface.

The API allows targeting the device group directly, which Panorama then propagates to the individual firewalls.

To be an ABR, the firewall must have interfaces in Area 0 and at least one other non-zero area, configured within the OSPF protocol settings in the virtual router.

PAN-OS supports forwarding almost all log types (Traffic, Threat, System, etc.) to external log collectors.

In the Network > Zones tab, select the desired zone and add the interface to the 'Interfaces' list in the zone configuration window.

EDLs, User-ID mapping, and API-based injection are primary methods.

A loopback interface provides a stable IP address that does not depend on the status of a physical link, ensuring the portal remains reachable even if a physical interface flaps.

OSPF requires the Hello interval and Dead interval to match exactly between neighbors; a mismatch prevents adjacency formation.

Log Forwarding Profiles allow for HTTP/S integration to send notifications to webhooks or external servers when a log is generated.

SSL decryption requires a root CA certificate, a profile, and the activation of decryption on the policy.

App-ID relies on application signatures. If the traffic is not using standard HTTP, it will not be identified as web-browsing.

The 'Drop' action silently discards the packet, whereas 'Reset' sends a TCP RST or ICMP unreachable.

An MTU mismatch between the two OSPF peers prevents them from exchanging large Database Description (DBD) packets, causing the state to hang in ExStart/Exchange.

If the virtual router handling the tunnel interface does not have a route to the internal network, the firewall cannot route the decrypted traffic to the destination.

The Palo Alto Networks firewall can leverage User-ID agents or agentless methods like querying Active Directory domain controllers via WMI or Syslog.

Management profiles specifically enable services (like HTTP, SSH) and define permitted IP addresses.