troubleshooting

You are configuring a new NGFW and need to ensure administrative access is restricted to a specific management subnet. Which interface setting should you modify to enforce this?

Which of these is a valid way to define a source IP in a policy?

What is the best way to monitor the firewall's CPU and memory usage?

Which THREE items are defined in an IKE Crypto Profile?

What is the purpose of 'Path Monitoring' in HA?

A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?

You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?

Where do you configure the DNS servers that the firewall itself uses to resolve hostnames for updates?

How can you verify the status of a tunnel interface?

Which tool in the Palo Alto Networks ecosystem is designed specifically for automated orchestration of security workflows?

What is the purpose of the 'Policy Optimizer' feature?

In GlobalProtect, what is the 'Portal' vs. 'Gateway'?

An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a subnet. The firewall interface is configured with a static IP address. Which additional step is required to enable DHCP server functionality on that interface?

Which TWO of the following settings are required when configuring a Service Route to ensure the firewall uses a specific interface for external traffic?

A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?

An administrator needs to automate the process of updating a dynamic address group based on external threat intelligence. Which PAN-OS feature allows the firewall to automatically update the group members from an external HTTP source?

When configuring an interface, what is the role of a 'Security Zone'?

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

What is the purpose of an 'Aggregate Ethernet' interface?

Which TWO interface types support IP addresses?

What is the default action for the 'interzone-default' security policy?

A network engineer is configuring a Palo Alto Networks firewall to use DHCP on an interface for management access. The engineer wants the firewall to obtain an IP address from a DHCP server and also send its hostname to the DHCP server for DNS registration. Which DHCP client option should the engineer enable?

Which TWO of the following are valid methods to authenticate administrators to the firewall?

A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?

An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?

Which THREE features are associated with Threat Prevention?

What is the default behavior when a firewall is configured for HA but the control link fails?

An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?

Which TWO of the following are valid methods for an administrator to authenticate to the Palo Alto Networks firewall management plane?

What happens if a zone is not assigned to an interface?

Which TWO issues can prevent BGP from reaching the 'Established' state?

In a complex automation environment, how can you ensure the integrity of the firewall configuration across multiple automated runs?

Which TWO items must match for an OSPF adjacency to form?

A security engineer is writing a Python script to automate the creation of a security rule on a Palo Alto Networks NGFW using the PAN-OS XML API. The script must ensure that the rule is placed in the correct position in the rulebase and that the configuration is committed. Which sequence of API calls should the script perform?

Which THREE steps are involved in the standard User-ID agentless configuration?

What must you do after making any change in the web interface to make it active?

Which TWO actions are required to successfully integrate a new External Dynamic List (EDL)?

When configuring an interface for DHCP client, where do you set this?

You are experiencing issues with traffic passing through the firewall. What command is used to see the session table in the CLI?

Which TWO items are required to configure a site-to-site IPsec VPN?

Which THREE items can be assigned to a Security Zone?

An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

How do you back up the firewall's configuration?

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two internal networks: 172.16.1.0/24 on Ethernet1/1 and 172.16.2.0/24 on Ethernet1/2. The firewall has a single virtual router. The engineer wants to ensure that traffic from 172.16.1.0/24 to 172.16.2.0/24 is routed correctly. Which configuration is required?

You are deploying a new Palo Alto Networks NGFW at a branch office. The branch has a single ISP link that provides both IPv4 and IPv6 connectivity. You need to configure the firewall's external interface to obtain both an IPv4 and an IPv6 address dynamically from the ISP. What should you do?

A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?

How do you ensure that only the most secure TLS versions are used for management access?

You are troubleshooting a REST API integration issue where the firewall returns '400 Bad Request'. What should you check first?

An administrator wants to change the firewall's hostname and configure the timezone to UTC. Which configuration path should the administrator use?

A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)

When using the Panorama XML API for a batch operation, what is the purpose of the 'type=config' parameter?

What is the primary function of a Virtual Router?

Which THREE routing protocols can be configured on a PAN-OS virtual router?

You are configuring a Palo Alto Networks firewall to authenticate administrators using an external LDAP server. You want to ensure that only members of the 'IT-Admins' group can log in with read-write privileges, while other authenticated users have read-only access. What should you configure?

Which THREE options are available under the 'Actions' tab of a Security Policy?

How does the firewall determine which virtual router to use for a packet?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

You are configuring a Security Profile to detect and prevent malware. Which profile is most appropriate for identifying malicious files being downloaded?

What is the consequence of having overlapping IP subnets on different interfaces?

When using OSPF, what is the 'Router ID' used for?

An engineer is configuring a Palo Alto Networks firewall to use a custom certificate for the management interface (Web UI). The certificate is issued by an internal CA and has a CN of 'firewall.example.com'. After importing the certificate and private key, the engineer configures the management interface to use this certificate. However, when accessing the Web UI via https://firewall.example.com, the browser still shows a certificate warning. What is the most likely cause?

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

An administrator wants to use a specific user's group membership for policy enforcement. What is the requirement?

Where do you view the system logs to troubleshoot hardware issues?

A network engineer is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The engineer wants the firewall to assign IP addresses to guests and also provide DNS server information. Which configuration step is necessary to achieve this?

Which type of interface is used for connecting to a Layer 3 network?

A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?

A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?

What is a 'Layer 3' interface in PAN-OS?

Which THREE actions should be performed during a standard automation failure troubleshooting process?

When managing multiple firewalls through Panorama, what is the best way to ensure an automation script performs the same action on all devices in a device group?

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Which TWO types of logs can be forwarded to an external server?

A network engineer is configuring a Palo Alto Networks NGFW with a single virtual router that has two ISP-facing interfaces: ethernet1/1 (default route to 203.0.113.1) and ethernet1/2 (default route to 198.51.100.1). The engineer wants the firewall to automatically use ethernet1/2 when ethernet1/1 fails. What should the engineer configure?

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

How do you add a new interface to an existing zone?

Which THREE data sources can an NGFW use to dynamically populate address objects?

What is the benefit of using a Loopback interface for a GlobalProtect portal?

When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?

An administrator wants to trigger a script automatically when a security policy is matched. Which feature can be used to send a notification to an external web server?

Which THREE components are necessary to successfully implement SSL Forward Proxy?

You notice that the firewall is not identifying traffic as 'web-browsing' even though it is on port 80. What is the most likely cause?

Which action in a security policy should be used to drop traffic silently without sending a notification to the client?

Why might OSPF adjacency stay in 'ExStart/Exchange' state?

A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. The engineer wants to ensure the response is in a structured format that can be easily parsed by a Python script. Which API request type should be used?

An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?

An engineer is writing a Python script using the pan-os-python library to update an address group on a PA-VM firewall. The script must ensure that the change is only staged and not committed until a separate approval process completes. Which method should be used to push the modified configuration to the firewall's candidate configuration?

An automation engineer is deploying a new firewall using a bootstrapping process. The engineer needs to ensure that the firewall automatically registers with Panorama and receives its license and configuration after the initial boot. Which component must be included in the bootstrap package to enable automatic registration with Panorama?

You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?

Which TWO settings are required to configure an Interface Management Profile?

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?

Which TWO settings are configured in a Virtual Router?

An engineer is integrating a Palo Alto Networks NGFW with a CI/CD pipeline to automate policy updates. The pipeline uses the XML API and must ensure that changes are validated before committing. Which two actions are required to achieve this? (Choose two.)

Which object type should be used to group multiple IP addresses to simplify security policy management?

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

Which tab allows you to configure the firewall's hostname and domain?

You are setting up a new Palo Alto Networks firewall in a branch office. The management interface needs to be reachable from the internal network for administrators to manage the device. You have configured the management interface with an IP address and default gateway. Which additional configuration is required to allow management access from the internal network?

Which tab is used to view real-time log activity?

A security team wants Panorama to automatically push a new security policy rule to all managed firewalls as soon as a change is saved in a specific device group. Which Panorama feature should they configure to accomplish this?

You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

A security automation script uses the XML API to retrieve logs from a Palo Alto Networks firewall. The script needs to filter logs for a specific source IP and time range. Which API request correctly retrieves the filtered logs?

Which TWO types of files can be included in a bootstrap package?

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

When automating log forwarding to an external SIEM, what is the best practice regarding the management plane load?

Which object type should you use to handle large lists of URLs that you want to block or allow?

In BGP, which attribute is used to influence the path selection for outgoing traffic?

A security engineer needs to programmatically create a new address object in a Palo Alto Networks NGFW using the XML API. The engineer authenticates with an API key and sends a POST request to /api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/address&element=<entry name='WebServer'><ip-netmask>10.1.1.5/32</ip-netmask></entry>. The API returns a success response. However, the address object does not appear in the candidate configuration when checked via the web interface. What is the most likely cause?

An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?

A network architect is designing a Palo Alto Networks firewall deployment with two virtual routers. The firewall has two interfaces, Ethernet1/2 and Ethernet1/3, both assigned to different zones. The architect wants to ensure that traffic from Ethernet1/2 can reach Ethernet1/3 without being routed through an external device. Which configuration is necessary?

An administrator wants to use a script to back up firewall configurations daily. Which management interface service must be enabled to allow the script to download the config file?

You are setting up a new Palo Alto Networks NGFW and need to configure the management interface. Which parameter must be configured to allow administrative access from a remote subnet?

Which TWO conditions can trigger an HA failover?

Which THREE items are part of the 'Device > Setup' configuration?

Which option is required to use an interface in a security policy?

A security team is integrating a Next-Generation Firewall with an orchestration platform using the XML API. The platform needs to retrieve the current running configuration of a specific security policy rule named 'Allow-Web'. Which API request should the engineer use?

You need to configure a Palo Alto Networks firewall to resolve domain names for its management traffic. Which DNS configuration should you set?

An administrator needs to quickly identify if an API call was successful from the firewall side. Which log should be reviewed?

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

Which feature allows an NGFW to dynamically update security objects based on an external feed such as an IP list or URL list?

Which tab is used to configure logging settings for a specific security policy?

Which TWO types of NAT are supported in PAN-OS?

An engineer is automating a Next-Generation Firewall to dynamically register IP addresses from a custom cloud inventory system. The solution must update a Dynamic Address Group (DAG) using the XML API. After authenticating, the engineer sends a request to the /api/?type=user-id&action=set endpoint with an XML payload containing <entry ip="10.1.1.5" persistent="0"/> inside a <register> tag. The API responds with success, but the address does not appear in the DAG. What is the most likely cause?

An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?

In an AWS Lambda function automating firewall changes, why should you use the 'pan-os-python' library with 'xapi' directly rather than the higher-level classes?

When utilizing the Panorama plugin for AWS, what is the primary benefit of the 'S3 bucket' integration for log ingestion?

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?

An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?

Where do you configure the 'Heartbeat' interval for HA?

An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?

Which THREE components are involved in a VPN tunnel setup?

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?

What is the default port for the Panorama XML API?

What is the purpose of an Aggregate Ethernet (AE) interface?

Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?

Which TWO objects can be used as a source in a Security Policy?

You are configuring a Palo Alto Networks firewall to use an external log forwarding profile to send traffic logs to a syslog server. You want to ensure that only traffic logs from a specific security policy are forwarded. What is the correct way to achieve this?

Which file type is required for an External Dynamic List (EDL) to function correctly?

A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?

Which object type is required to enable GlobalProtect access for remote users?

An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

What is the recommended way to manage certificates on a Palo Alto Networks firewall?

How do you ensure that the firewall automatically blocks traffic from a list of known malicious IP addresses?

Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?

Which THREE items are found under the 'Network' tab?

An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?

An administrator wants to ensure that internal users only access approved websites. Which profile is used?

A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?

A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?

Which TWO components are involved in configuring GlobalProtect?

Which TWO commands are useful for troubleshooting OSPF?

What is the purpose of a Security Zone?

A network administrator needs to configure a Palo Alto Networks firewall to send syslog messages to an external server for auditing. Which configuration path should the administrator use to add a syslog server?

Which TWO types of failover can be configured in HA?

If you have a primary and secondary firewall, what is the best way to synchronize configuration changes?

An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?

Which THREE factors can affect the speed/throughput of a VPN tunnel?

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

What is the purpose of an HA Control Link?

Which TWO items can be configured in a Virtual Router?

A company uses a SOAR platform to enrich and block indicators of compromise. The SOAR playbook must add malicious IP addresses to an External Dynamic List (EDL) hosted on an internal web server that the firewall already consumes. Which action should the playbook take?

You are configuring a Palo Alto Networks firewall to perform decryption of outbound SSL traffic for a specific set of users. You have created a decryption policy that matches the traffic and applied a decryption profile. However, after committing, you notice that some websites are not being decrypted, and users report certificate errors. You have verified that the forward trust certificate is installed and trusted by the endpoints. What is the most likely cause for the websites not being decrypted?

In BGP, what is a 'Route Map' used for?

An administrator is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a single physical link that delivers both internet traffic (untagged) and IPTV multicast traffic (VLAN 300). The administrator wants to give the IPTV traffic its own security zone and apply a distinct security policy, while keeping the internet traffic in the existing untagged zone. Which configuration should the administrator use on the physical interface?

An administrator is configuring a site-to-site VPN between two PAN-OS firewalls. The VPN will use a tunnel interface to route traffic. The administrator has created the IKE gateway and IPsec crypto profile. Which additional configuration is required to assign an IP address to the tunnel interface?

What is the primary function of a Security Profile Group?

A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?

A network security engineer is deploying a Palo Alto Networks NGFW in a data center that uses a single public IP address block. The engineer must allow several internal web servers to be reached from the internet using different public IP addresses, but only has one egress interface. Which configuration should be used to meet this requirement?

You have a Palo Alto Networks firewall deployed in a data center with two ISPs. You need to configure the firewall so that if the primary ISP link fails, traffic automatically fails over to the secondary ISP without manual intervention. You have already configured both ISP interfaces with static IPs and default routes with different metrics. Which additional configuration is required to enable automatic failover?

A firewall administrator is configuring a Palo Alto Networks NGFW and needs to ensure that management access to the firewall's web interface is only allowed from the internal network 10.0.0.0/24. The management interface is on a dedicated out-of-band network. Which configuration should the administrator use?

A security engineer is using the PAN-OS XML API to update the description of an existing address object named 'WebServer' in the 'Shared' location. The API request is sent with the correct API key and the following XPath: /config/shared/address/entry[@name='WebServer']. The server responds with a '403 Forbidden' error. What is the most likely cause?

A security automation team uses the PAN-OS XML API to programmatically create a new security policy rule. The script authenticates with an API key and sends a POST request to the firewall. The API returns a success status, but the rule does not appear in the web interface. What is the most likely reason?

A security automation team is integrating a Palo Alto Networks NGFW with a third-party orchestration platform. The platform requires the firewall to send logs to an external syslog server for correlation. The team must configure the firewall to forward traffic logs to the syslog server. Which two configuration elements are required on the firewall to forward traffic logs to an external syslog server? (Choose two.)

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

An engineer is setting up a new Palo Alto Networks firewall and needs to configure the device to send logs to an external syslog server. Which configuration step is required to ensure that logs are forwarded to the syslog server?

Which object should be configured for a server that needs to be accessed from the internet via a public IP?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

How do you ensure that a specific security policy rule is only active during business hours?

Which THREE items are required to configure a Site-to-Site VPN?

Which TWO authentication protocols are commonly supported by PAN-OS for VPN user authentication?

Why might a static route not be visible in the routing table?

Which interface type is used to manage the firewall over the network?

A security engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the PAN-OS XML API. The script must authenticate using an API key. Which HTTP header should be used to pass the API key in the request?

You are configuring a Palo Alto Networks NGFW to enforce a security policy that allows only HTTP and HTTPS traffic from the untrusted zone to the DMZ. You want to ensure that the firewall performs application identification and applies the appropriate security profiles. Which tab in the WebUI do you use to create the security policy rule?

An engineer is configuring a Palo Alto Networks firewall to authenticate administrators against an external LDAP directory. The security team requires that only members of the group 'NGFW-Admins' can log in with full read-write access, while members of 'NGFW-Auditors' must receive read-only access. Which two configuration steps are required on the firewall to meet these requirements? (Choose two.)

A junior administrator is setting up a new Palo Alto Networks NGFW and wants to change the idle timeout for administrators logged into the Web UI so that sessions expire after 30 minutes of inactivity. Where should this change be made?

Which TWO features require a valid subscription license?

Which TWO methods can be used to update the security policy on a Palo Alto Networks NGFW programmatically?

You are deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration. The two firewalls are directly connected via a dedicated HA link. You need to ensure that the passive firewall takes over seamlessly if the active firewall fails, preserving existing sessions. Which HA setting should you configure to achieve this?

When using the Panorama API to push a configuration, what is the 'xpath' parameter used for?

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

A network security administrator is deploying a pair of Palo Alto Networks NGFWs in an active/passive high availability configuration at a data center. The two firewalls are connected by a dedicated HA link, and each has its own management interface. The administrator needs to ensure that after a failover, the new active device automatically takes over the management IP address that administrators use to reach the Web UI, without requiring DNS changes. Which setting must be configured?

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

Which THREE things must be configured to allow HA between two firewalls?

A network administrator is setting up a Palo Alto Networks firewall and needs to configure an interface for outbound internet access. The ISP provides a static IP address, and the administrator wants to ensure that return traffic from the internet can reach the internal network. Which type of interface configuration is required?

You are configuring a new Palo Alto Networks firewall and need to set up the management interface. You want to ensure that the firewall can be managed from a secure network and that administrative access is restricted. Which configuration should you apply to the management interface?

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Which TWO items must be configured to allow external management access?

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

Which TWO protocols are commonly used for log forwarding to SIEMs?

You are configuring a Palo Alto Networks firewall for a branch office that uses a single public IP address from the ISP. The ISP has assigned you 203.0.113.10/32 and requires that all outbound traffic from the 192.168.10.0/24 network appears to originate from that address. You must ensure return traffic is correctly routed back to the originating internal host. Which NAT configuration should you implement?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

You need to automate the retrieval of URL filtering logs from the firewall. Which API endpoint type is used to execute a 'show' command?

Which command confirms that an OSPF neighbor relationship is in the 'Full' state?

You need to perform a packet capture on a specific firewall interface. Which tool is used?

If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

What is the effect of changing the HA heartbeat interval?

What happens to established sessions during an HA failover?

You are managing a firewall and need to ensure that dynamic updates are downloaded automatically. Where do you configure the schedule for these updates?

What is the recommended method to update the firewall's threat signatures?

An administrator is configuring a Palo Alto Networks firewall to route traffic between two internal networks. The firewall has two Layer 3 interfaces, Ethernet1/1 and Ethernet1/2, each assigned to different security zones and different virtual routers. The administrator wants traffic from the trust zone to reach the untrust zone, but the firewall is not routing the traffic. What is the most likely cause?

What is the function of a 'Tap' mode interface?

In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?

An automation engineer is using the PAN-OS XML API to modify an existing security policy rule. The script retrieves the current rule configuration, changes the action from 'allow' to 'deny', and sends the updated XML back to the firewall. However, the API returns an error indicating that the rule already exists. What is the most likely cause?

You are configuring a Palo Alto Networks firewall to integrate with an external LDAP server for User-ID. You have configured the LDAP server profile and the User-ID agent, but users are not being identified in the traffic logs. You have verified that the firewall can reach the LDAP server and that the agent is connected. Which action should you take next to troubleshoot the issue?

An engineer is configuring a Palo Alto Networks firewall to allow management access only from a secure internal subnet. The firewall's management interface is currently on the default 192.168.1.1/24 network. The engineer wants to restrict management access to the 10.10.10.0/24 subnet and ensure that only HTTPS is used. Which configuration should be applied?

Which TWO protocols can be used to manage the firewall?

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

When configuring HA, what is 'Preemption'?

An engineer is configuring a Palo Alto Networks NGFW to authenticate administrators using an external LDAP server. The LDAP server uses a self-signed certificate. The engineer needs to ensure that the firewall can validate the LDAP server's certificate during authentication. What should the engineer do?

A network engineer is configuring a site-to-site VPN between two PA-5220 firewalls. The engineer wants to ensure that if the primary ISP link fails, the VPN tunnel automatically re-establishes over a backup ISP link without manual intervention. Both firewalls have two ISP connections and the VPN is configured with a tunnel interface. Which PAN-OS feature should the engineer configure to achieve this?

Which tab is used to configure physical interface settings like speed and duplex?

Which feature is used to ensure the firewall clock is accurate?

A network engineer is configuring a Palo Alto Networks firewall to participate in OSPF with neighboring routers. The engineer wants to ensure that the firewall becomes the Designated Router (DR) on a broadcast network. Which two OSPF parameters should the engineer configure to influence DR election? (Choose two.)

Which THREE configuration items are required in the 'init-cfg.txt' file for a VM-Series firewall to join a Panorama server?

Which THREE items can be used as a 'Source' in a security policy?

Which THREE settings can be modified in a custom Antivirus Profile?

Which CLI command displays the API key if already generated for an admin?

A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. Which API request type should be used?

You are configuring a new firewall and need to set up the management interface. You want to restrict management access to only a specific subnet. Which type of interface should you configure to apply a management profile with permitted IP addresses?

What is the primary benefit of using Panorama templates for automation?

When configuring a Static Route, what does the 'Metric' field do?

You are deploying a PA-3200 Series firewall at a branch office. The branch uses a single ISP link and you want the firewall to automatically fail over to a secondary ISP if the primary link goes down. You have both links connected to separate interfaces. Which PAN-OS feature should you configure to achieve this?

What is the purpose of the 'Pan-OS-Python' library's 'refresh_from_candidate' method?

An engineer needs to configure a Palo Alto Networks firewall to act as a DHCP server for a network segment connected to Ethernet1/1. The engineer wants the firewall to assign IP addresses from the 192.168.10.0/24 subnet. Which configuration step is required?

Which tab in the web interface is used to create and manage security policies?