CCNA PAN OS Device Setting Configuration Questions — Page 2 of 2

MCQeasy

Which feature is used to ensure the firewall clock is accurate?

A.DHCP

B.DNS

C.SNMP

D.NTP

AnswerD

NTP synchronises the firewall's system clock against authoritative time servers, satisfying the requirement for an accurate clock. Accurate time underpins certificate validation, log correlation and licence enforcement, so configuring NTP servers is the standard mechanism for keeping the device clock correct.

Why this answer

NTP (Network Time Protocol) settings under Device > Setup > Services are used to synchronize time.

Practice this question →

Multi-Selecthard

Which THREE settings can be modified in a custom Antivirus Profile?

Select 3 answers

A.GlobalProtect version

B.Protocol settings

C.File type exceptions

D.Action for detected malware

E.System hostname

AnswersB, C, D

Protocol settings are configurable within a custom Antivirus Profile, letting you set separate actions for each protocol the profile inspects — HTTP, FTP, SMB, SMTP, IMAP and POP3 — including decode and block behaviour. This satisfies the stem's requirement for modifiable profile settings, since protocol-level action tuning is a supported field.

Why this answer

In a custom Antivirus Profile on Palo Alto Networks firewalls, option B (Protocol settings) is correct because the profile lets you enable/disable scanning per protocol (HTTP, FTP, SMTP, IMAP, POP3, SMB) and configure decode settings such as maximum file size and decode depth for each. Option C (File type exceptions) is correct because the profile includes a File Blocking/exception list where you specify file types (by extension or MIME type) that should be exempted from antivirus scanning. Option D (Action for detected malware) is correct because each antivirus signature is assigned an action such as alert, drop, reset-both, or block, which is configurable within the profile.

Option A (GlobalProtect version) is not part of an Antivirus Profile; it is configured in the GlobalProtect portal/agent settings. Option E (System hostname) is a device-level setting configured under Device > Setup, not within an Antivirus Profile.

Practice this question →

MCQeasy

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

A.Layer 3 interface

B.Management interface

C.Layer 2 interface

D.Loopback interface

AnswerB

The management interface (MGT) is a dedicated out-of-band interface used for firewall management. You can assign an IP address, configure a management profile to restrict access to specific IP addresses, and enable services like HTTPS, SSH, and SNMP. This is the correct interface to restrict management access to a specific subnet.

Why this answer

The management interface is specifically designed for out-of-band management and allows you to restrict access via a management profile. You can specify permitted IP addresses and services. While other interfaces can be used for management in some designs, the dedicated management interface is the standard and most secure method for restricting management access.

Exam trap

The trap here is assuming any interface with an IP address can serve as the management interface; only the dedicated MGT interface provides out-of-band access.

Practice this question →

MCQmedium

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

A.Policy-Based Forwarding (PBF)

B.High Availability (HA) active/passive

C.Virtual Router with path monitoring

D.Link Aggregation Group (LAG)

AnswerC

Configuring a Virtual Router with path monitoring allows the firewall to track the health of the primary ISP link and automatically fail over to a secondary link when the primary fails. Path monitoring uses ICMP pings to monitor the reachability of a target IP address, and upon failure, the default route is removed, allowing the backup route to take effect.

Why this answer

Path monitoring within a Virtual Router enables the firewall to detect when a monitored path becomes unreachable and to remove the associated route from the routing table. This allows a backup default route to take over, achieving automatic ISP failover. Link aggregation and HA address different redundancy needs, while PBF does not provide automatic failover.

Exam trap

The trap here is confusing firewall redundancy (HA) with link redundancy; HA does not provide ISP failover.

Practice this question →

MCQeasy

Which tab in the web interface is used to create and manage security policies?

A.Policies

B.Device

C.Objects

D.Network

AnswerA

The Policies tab provides the central workspace for defining, ordering and deploying security rules, satisfying the requirement to create and manage security policies through the web interface. Rule creation, zone assignment, application filtering and policy commit all occur here, making it the only tab matching the stem's stated task.

Why this answer

The 'Policies' tab is where all firewall rule sets are managed.

Practice this question →