Certified Next-Generation Firewall Engineer (NGFW-Engineer) (NGFW-Engineer) — Questions 226–247

The User-ID agent must monitor the correct Domain Controller to receive user mapping information. Additionally, the firewall must be configured with the correct source IP of the agent to accept updates. If either is misconfigured, user identification will fail even if connectivity exists. This is a common oversight in User-ID deployments.

The management interface on Palo Alto Networks firewalls allows you to specify permitted IP addresses that are allowed to access the management interface. By setting this to 10.10.10.0/24, only hosts in that subnet can connect. Disabling all services except HTTPS ensures that only secure web access is allowed. This is the correct and direct method to restrict management access as required.

HTTPS provides encrypted, browser-based access to the firewall's management interface, satisfying the requirement for a secure management protocol. Unlike plain HTTP or Telnet, TLS protects credentials and configuration traffic in transit, and it operates over TCP port 443, which is typically permitted through intervening network devices.

Active/Active distributes session processing across both firewalls simultaneously, satisfying the HA requirement for concurrent traffic handling. Unlike Active/Passive, where the standby device forwards nothing until failover, both peers here share the load, typically via session ownership or flow distribution. This directly answers the stem's demand for the defining difference between the two modes.

Preemption automatically restores the active role to the preferred device once it recovers, satisfying the requirement that the designated primary resumes handling traffic after a failover. Without it, the peer retains the active role indefinitely, so the preferred device stays passive despite being healthy and available.

To validate a self-signed certificate, the firewall must trust it. Importing the certificate into the trusted certificate store and referencing it in the LDAP server profile allows the firewall to verify the server's identity. This is the correct approach for self-signed certificates.

DPD detects when the primary peer becomes unreachable and triggers tunnel renegotiation. By configuring a secondary peer IP address (the backup ISP IP of the remote firewall) in the IKE Gateway, the firewall can attempt to establish the VPN over the backup link. This provides automatic failover without manual intervention. DPD intervals and retry settings control how quickly failover occurs.

Physical speed and duplex are Layer 1 properties configured on the interface itself, so they belong under Network > Interfaces. This tab exposes the hardware-level settings for each physical port, satisfying the stem's requirement to configure speed and duplex directly on the interface rather than through a virtual or policy-based view.

NTP synchronises the firewall's system clock against authoritative time servers, satisfying the requirement for an accurate clock. Accurate time underpins certificate validation, log correlation and licence enforcement, so configuring NTP servers is the standard mechanism for keeping the device clock correct.

OSPF DR election is primarily determined by the interface priority. The router with the highest priority becomes the DR. By setting a higher priority on the firewall's OSPF interface, the engineer increases the likelihood of the firewall being elected as DR. The default priority is 1, and a value of 0 means the router is ineligible to become DR.

Required to point to the Panorama IP.

Security policies accept User as a source, matching traffic by authenticated directory identity rather than IP address alone. This satisfies the source requirement by enabling identity-based rules that follow the user regardless of device or network location.

Protocol settings are configurable within a custom Antivirus Profile, letting you set separate actions for each protocol the profile inspects — HTTP, FTP, SMB, SMTP, IMAP and POP3 — including decode and block behaviour. This satisfies the stem's requirement for modifiable profile settings, since protocol-level action tuning is a supported field.

Panorama and PAN-OS store only a hashed representation of the API key, so the plaintext value cannot be displayed after generation. The CLI offers no retrieval command, meaning the key must be regenerated if lost.

The export API type with category=configuration retrieves the full running configuration in XML format. This is the correct method to obtain the entire configuration. It is commonly used for backups or analysis. The response includes the complete configuration, which can be saved or processed further.

The management interface (MGT) is a dedicated out-of-band interface used for firewall management. You can assign an IP address, configure a management profile to restrict access to specific IP addresses, and enable services like HTTPS, SSH, and SNMP. This is the correct interface to restrict management access to a specific subnet.

Templates hold shared network and device settings that Panorama pushes to many managed firewalls, so one edit propagates everywhere. This satisfies the automation benefit by removing per-firewall duplication, giving a single point to manage shared network configuration across the estate.

Metric assigns a preference value to a static route; when multiple routes match the same destination, the firewall installs the route with the lowest metric into the routing table. It therefore breaks ties between otherwise identical routes.

Configuring a Virtual Router with path monitoring allows the firewall to track the health of the primary ISP link and automatically fail over to a secondary link when the primary fails. Path monitoring uses ICMP pings to monitor the reachability of a target IP address, and upon failure, the default route is removed, allowing the backup route to take effect.

The refresh_from_candidate method re-reads the firewall's candidate configuration and updates the local Python object's attributes to match it, discarding stale local values. This synchronises the Python object with the firewall's config, satisfying the constraint of reflecting uncommitted candidate changes in automation scripts.

To configure the firewall as a DHCP server, you must create a DHCP Server profile that defines the address pool, lease times, and other options, and then assign it to the interface. This is done under Network > DHCP > DHCP Server. This step is required for the firewall to serve IP addresses.

The Policies tab provides the central workspace for defining, ordering and deploying security rules, satisfying the requirement to create and manage security policies through the web interface. Rule creation, zone assignment, application filtering and policy commit all occur here, making it the only tab matching the stem's stated task.