190 questions total · 3pages · All types, answers revealed
Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?
These profiles scan for malicious behavior and patterns.
Why this answer
Threat Prevention profiles (specifically Anti-Spyware/Vulnerability Protection) detect command-and-control activity and suspicious traffic patterns.
Which TWO settings are configured in a Virtual Router?
Core functionality.
Which object type should be used to group multiple IP addresses to simplify security policy management?
Address groups are designed to collect multiple address objects into one entity.
Why this answer
Address Groups allow the grouping of multiple address objects, simplifying policy rules.
A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?
The VR handles routing logic.
Why this answer
Static routes for tunnel traffic are configured in the Virtual Router associated with the tunnel interface.
Which tab allows you to configure the firewall's hostname and domain?
This contains general identity settings.
Why this answer
Device > Setup > Management > General Settings is the path for setting the firewall's identity.
Which tab is used to view real-time log activity?
Monitor is for log viewing.
Why this answer
The 'Monitor' tab provides real-time access to traffic, threat, and system logs.
You are integrating an NGFW with Panorama for centralized management. You need to ensure that local firewall configurations are not overwritten when the device is imported into Panorama. Which setting in the Panorama > Setup > Operations tab or import process prevents this?
Selecting 'Merge' allows the existing local configuration to be integrated into the Panorama structure rather than being wiped by a push.
Why this answer
When importing a device into Panorama, the 'Import device configuration' process allows you to choose to merge or overwrite. To preserve local policy elements, one should use the 'Import into Template Stack' and 'Import into Device Group' workflows with careful selection of the 'Merge' option.
This file defines the basic registration parameters for Panorama.
Why this answer
The 'init-cfg.txt' file is required for bootstrapping and contains the Panorama IP and authorization key to register the VM.
Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?
This is the correct path for assigning tunnel IPs.
Why this answer
Tunnel interfaces act as logical points for VPN traffic and are assigned IP addresses in the Network > Interfaces > Tunnel tab.
How do you verify if a security policy is actually matching the traffic you expect?
The hit count is designed exactly for this purpose.
Why this answer
The 'hit count' feature in the policy list provides real-time information on how many sessions have matched a specific rule.
Which TWO types of files can be included in a bootstrap package?
The primary configuration bootstrap file.
Why this answer
Init-cfg.txt and software images are common components of bootstrap packages.
When automating log forwarding to an external SIEM, what is the best practice regarding the management plane load?
Log Collectors handle log storage and forwarding, reducing load on the firewall.
Why this answer
Offloading log management to dedicated log collectors or using efficient forwarding profiles prevents management plane degradation.
Which object type should you use to handle large lists of URLs that you want to block or allow?
EDLs efficiently manage external lists of URLs/IPs.
Why this answer
External Dynamic Lists (EDL) are specifically designed to ingest and manage large lists of URLs, IPs, or domains.
In BGP, which attribute is used to influence the path selection for outgoing traffic?
Local Preference dictates outbound exit points.
Why this answer
The 'Local Preference' attribute is used within an AS to influence the path taken by traffic leaving the AS; a higher value is preferred.
When integrating an NGFW with an external SIEM for log ingestion, which TWO of the following methods are natively supported for log forwarding?
SNMP Traps are a valid method for alerting SIEM systems.
What is the purpose of the 'Pre-Rulebase' and 'Post-Rulebase' in Panorama?
Pre and Post rules provide mandatory security standards.
Why this answer
These allow administrators to enforce global security policies that cannot be modified by local device administrators.
An administrator wants to use a script to back up firewall configurations daily. Which management interface service must be enabled to allow the script to download the config file?
The XML API provides the 'keygen' and 'export' commands necessary for automated backup scripts.
Why this answer
The XML API is the standard method for scripts to programmatically export configurations (running-config).
Which TWO conditions can trigger an HA failover?
Catastrophic failure triggers failover.
Why this answer
Failovers can be triggered by hardware failure or by the firewall losing reachability to monitored paths.
Which THREE items are part of the 'Device > Setup' configuration?
Global system services.
Why this answer
Device > Setup covers global configuration like management interfaces, services, and operations.
Which TWO factors contribute to a successful BGP peer establishment?
Required for transport.
Which option is required to use an interface in a security policy?
Zone assignment is the fundamental requirement.
Why this answer
You must assign a security zone to an interface; only then can that zone be used in a security policy rule.
An administrator needs to quickly identify if an API call was successful from the firewall side. Which log should be reviewed?
System logs track management and API activity.
Why this answer
The 'System' logs contain entries for web interface and API interactions.
Which THREE parameters are commonly used in the XML API to target specific policy objects?
Defines the scope of the configuration change.
Why this answer
XPath, Element Name, and Device Group/Template context are standard.
What is the purpose of a 'Zone' in a Palo Alto Networks firewall?
Policies are applied to zones, not directly to physical interfaces.
Why this answer
Zones are logical groupings of interfaces that allow for the application of security policies to traffic moving between them.
Which feature allows an NGFW to dynamically update security objects based on an external feed such as an IP list or URL list?
EDLs are designed specifically for this purpose.
Why this answer
External Dynamic Lists (EDL) allow the firewall to consume lists from external web servers and use them in policies automatically.
Which tab is used to configure logging settings for a specific security policy?
The Actions tab inside the policy rule defines log settings.
Why this answer
The 'Actions' tab within the security policy edit window is where logging options are configured.
Which TWO types of NAT are supported in PAN-OS?
For outgoing traffic.
Why this answer
Source NAT and Destination NAT are the two primary NAT types.
When troubleshooting a BGP route that is not appearing in the routing table, which command provides the most insight?
This shows routes before the RIB filter.
Why this answer
The 'show routing protocol bgp rib-in' command shows the prefixes received from peers before they are filtered and installed in the RIB.
An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?
This is the correct Terraform resource for defining security rules.
Why this answer
The 'panos_security_rule' resource is the standard Terraform resource for managing security policies on Palo Alto Networks devices.
In an AWS Lambda function automating firewall changes, why should you use the 'pan-os-python' library with 'xapi' directly rather than the higher-level classes?
XAPI provides a lower-overhead, stateless interaction.
Why this answer
In serverless environments like Lambda, managing long-lived sessions or complex object hierarchies is often less efficient than raw XML requests via XAPI.
When utilizing the Panorama plugin for AWS, what is the primary benefit of the 'S3 bucket' integration for log ingestion?
S3 is designed for high-durability storage, making it ideal for log archival.
Why this answer
The S3 integration allows the firewall to offload logs to cloud storage, providing long-term retention and cost-effective storage for compliance without requiring local disk expansion.
A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?
Zone assignment is mandatory for all interface types.
Why this answer
Interfaces must be assigned to a security zone before they can be referenced in a security policy.
You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?
When managing objects via Panorama API, the XPath must reflect the hierarchy of the device group or vsys container.
Why this answer
The XML API requires precise XPath syntax. If the object exists in the GUI but the API fails, it is often due to the object being nested within a specific Device Group or Vsys that was not properly specified in the XPath.
To ensure high availability for an automated script, which Panorama component should the script target?
Panorama provides a centralized API for all managed devices.
Why this answer
Targeting the Panorama M-series or virtual appliance ensures the script manages the entire policy set for all managed firewalls.
What happens if a packet matches no security policies?
The implicit 'deny all' action drops unmatched traffic.
Why this answer
The 'intrazone-default' and 'interzone-default' rules define the implicit behavior for unmatched traffic, which is to drop.
Where do you configure the 'Heartbeat' interval for HA?
General HA settings contain link/heartbeat parameters.
Why this answer
The heartbeat interval is configured in the HA > General > Election Settings or Heartbeat settings depending on the specific PAN-OS version and HA mode.
You have configured a GlobalProtect VPN, but users cannot access internal resources. What is the first troubleshooting step?
If the tunnel interface is not in a zone, security policies cannot be applied to traffic emerging from the VPN.
Why this answer
Checking the tunnel interface and routing is critical, but verifying the zone assignment is the most frequent configuration oversight.
Which THREE components are involved in a VPN tunnel setup?
Core component.
Why this answer
VPNs require IKE gateways, IPsec crypto profiles, and tunnel interfaces.
What is the default port for the Panorama XML API?
443 is the standard HTTPS port for the API.
Why this answer
The XML API operates over the standard HTTPS port, 443.
What is the purpose of an Aggregate Ethernet (AE) interface?
That is the definition of LACP/AE.
Why this answer
AE interfaces provide increased bandwidth and link redundancy by bundling multiple physical ports into a single logical interface.
Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?
Essential for server-side issues.
Why this answer
Troubleshooting often involves checking the client logs and reviewing the firewall's GlobalProtect logs.
Which TWO objects can be used as a source in a Security Policy?
Standard method for source matching.
Why this answer
Policies can match traffic based on IP addresses, address groups, regions, or User-ID user groups.
Which feature must be enabled to inspect traffic for threats?
Security profiles, when attached to a policy, enable threat inspection.
Why this answer
Security profiles (Vulnerability Protection, Antivirus, etc.) must be attached to security policies to perform threat inspection.
Which file type is required for an External Dynamic List (EDL) to function correctly?
Text files are the standard for EDLs.
Why this answer
EDLs expect raw text files formatted appropriately for the list type, accessible via HTTP/HTTPS.
Which object type is required to enable GlobalProtect access for remote users?
Gateway terminates the connection.
An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?
Changes remain in candidate config until committed.
Why this answer
The script modifies the candidate configuration; a 'commit' must be performed to push those changes to the running configuration.
You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?
BGP requires TCP 179 and reachability.
What is the recommended way to manage certificates on a Palo Alto Networks firewall?
This is the native GUI tool for certificate management.
Why this answer
The Certificate Management section under Device > Certificate Management allows for importing, generating, and managing certificates.
How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?
EDLs allow automatic ingestion of blocklists.
Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?
Pan-python is the official library designed for automation via Python scripts.
Why this answer
Pan-python is the standard library provided by Palo Alto Networks for interacting with the XML API using Python.
An administrator needs to automate the deployment of security policy updates using Panorama. Which XML API method should be invoked to commit changes to the candidate configuration?
This is the correct path for triggering a configuration commit via the XML API.
Why this answer
The commit operation is performed via the 'commit' tag in the XML API request to the Panorama management server.
Which THREE items are found under the 'Network' tab?
Zone membership config.
Why this answer
The Network tab covers interfaces, virtual routers, and zones.
An administrator wants to ensure that internal users only access approved websites. Which profile is used?
URL filtering profiles allow or block categories of websites.
Why this answer
URL Filtering profiles control access to specific categories of websites.
A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?
GP traffic must be explicitly permitted.
Why this answer
Check if the portal/gateway IP is reachable via ping and if the correct security policies allow the GP traffic from the external zone.
Which TWO components are involved in configuring GlobalProtect?
Core component.
Why this answer
GP requires a Portal for distribution and a Gateway for traffic management.
If the IDs do not match the expected values on the peer, the negotiation will fail to complete, leaving the state at init-passive.
Why this answer
An 'init-passive' state indicates that the firewall is waiting for the peer to initiate the connection, suggesting a mismatch in initiator/responder settings or phase 1 proposal parameters.
Which TWO commands are useful for troubleshooting OSPF?
Checks OSPF route table.
Why this answer
The 'show routing protocol ospf neighbor' and 'show routing protocol ospf rib' commands are essential for debugging OSPF neighbors and learned routes.
What is the purpose of a Security Zone?
Zones are the logical containers for policy enforcement.
Why this answer
Security zones group interfaces to apply consistent security policies, acting as the foundation for the firewall's traffic control.
How do you delete a security policy rule?
The standard delete action.
Why this answer
In the Policies > Security tab, select the rule and click the 'Delete' button at the bottom of the page.
Which TWO types of failover can be configured in HA?
Monitors gateway reachability.
Why this answer
HA failover can be triggered by 'Link Monitoring' (interface status) and 'Path Monitoring' (resource reachability).
If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?
HA sync is the native method to maintain identical configurations in an HA pair.
Why this answer
High Availability (HA) synchronization ensures that configuration changes made on the primary firewall are mirrored to the secondary firewall.
Which THREE factors can affect the speed/throughput of a VPN tunnel?
Affects processing overhead.
What is the purpose of an HA Control Link?
Control links handle control plane sync.
Why this answer
The HA Control Link is used to synchronize configuration and state information between the two firewalls in an HA pair.
Which TWO items can be configured in a Virtual Router?
Automatic routing protocols.
In BGP, what is a 'Route Map' used for?
Route maps are used for route manipulation.
Why this answer
A Route Map is used to filter, modify, or manipulate BGP attributes during the import or export of routes, providing granular control over routing policy.
What is the primary function of a Security Profile Group?
This simplifies the application of security settings to policies.
Why this answer
A Security Profile Group allows you to bundle multiple security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) into a single object for easy policy assignment.
Which object should be configured for a server that needs to be accessed from the internet via a public IP?
Destination NAT allows inbound traffic mapping.
Why this answer
Destination NAT maps a public IP to an internal private IP, enabling access to internal servers.
How do you ensure that a specific security policy rule is only active during business hours?
Schedules allow time-based rule enforcement.
Why this answer
The 'Schedule' object allows you to define time-based constraints for policy rules.
Which THREE items are required to configure a Site-to-Site VPN?
Phase 2 object.
Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?
Standard auth protocol.
Why might a static route not be visible in the routing table?
Routes require a valid next hop path.
Why this answer
If the next hop is not reachable through an interface associated with the virtual router, the static route is considered invalid and will not be installed in the RIB.
Which interface type is used to manage the firewall over the network?
The dedicated MGT port.
Why this answer
The Management interface (MGT) is the dedicated port for out-of-band management of the PAN-OS firewall.
Which TWO interface modes are commonly used to segment traffic?
Standard segmenting mode.
Why this answer
Layer 3 and Virtual Wire modes are common ways to segment and protect traffic.
You are configuring a new Security Policy. Which TWO settings are required to enable App-ID enforcement for a rule?
You must select specific applications or 'any'.
Why this answer
App-ID is enforced when you specify an Application and a Service (or leave it as application-default).
When using the 'pan-os-python' library, which class is primarily used to interact with firewall configuration objects?
This class represents and manipulates address objects in the configuration.
Why this answer
The 'panos.firewall.Firewall' or 'panos.panorama.Panorama' classes are used to connect, but configuration objects are handled by classes within the 'panos.objects' namespace.
Practice NGFW-Engineer by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →