NGFW-ENGINEER Exam Questions

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates,...

How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish. Which of the...

Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses a...

For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

Which PAN-OS method of mapping users to IP addresses is the most reliable?

In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

A PA-Series firewall with all licensable features is being installed. The customer's Security policy requires that users do not directly access websites. Instead, a security device...

What must be configured before a firewall administrator can define policy rules based on users and groups?

Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?

Which networking technology can be configured on Layer 3 interfaces but not on Layer 2 interfaces?

What is a result of enabling split tunneling in the GlobalProtect portal configuration with the "Both Network Traffic and DNS" option?

According to dynamic updates best practices, what is the recommended threshold value for content updates in a mission- critical network?

An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS, Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-...

When deploying Palo Alto Networks NGFWs in a cloud service provider (CSP) environment, which method ensures high availability (HA) across multiple availability zones?

An engineer at a managed services provider is updating an application that allows its customers to request firewall changes to also manage SD-WAN. The application will be able to m...

Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)

An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to transition between zones witho...

Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?

Which set of options is available for detailed logs when building a custom report on a Palo Alto Networks NGFW?

An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must be minimized. What is the recom...

Which two statements describe an external zone in the context of virtual systems (VSYS) on a Palo Alto Networks firewall? (Choose two.)

Which zone type allows traffic between zones in different virtual systems (VSYS), without the traffic leaving the firewall?

A multinational organization wants to use the Cloud Identity Engine (CIE) to aggregate identity data from multiple sources (on premises AD, Azure AD, Okta) while enforcing strict d...

An engineer is implementing a new rollout of SAML for administrator authentication across a company's Palo Alto Networks NGFWs. User authentication on company firewalls is currentl...

An enterprise uses GlobalProtect with both user- and machine-based certificate authentication and requires pre-logon, OCSP checks, and minimal user disruption. They manage multiple...

Which statement applies to Log Collector Groups?

Which interface types should be used to configure link monitoring for a high availability (HA) deployment on a Palo Alto Networks NGFW?

Which CLI command is used to configure the management interface as a DHCP client?

Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?

What is the purpose of assigning an Admin Role Profile to a user in a Palo Alto Networks NGFW?

After upgrading PAN-OS, which action is recommended to ensure that all features function correctly?

In an authentication sequence, what happens if the "Continue on client cert failure" option is enabled?

Before upgrading a Palo Alto Networks firewall to a new PAN-OS version, which preliminary step is crucial to ensure a smooth upgrade process?

How does a Palo Alto firewall handle traffic between two different security zones?

For explicit proxy deployment, which port is typically used by the client browsers to send requests to the proxy?

In a Collector Group with multiple Log Collectors, enabling redundancy ensures that:

How do Zone Protection Profiles enhance network security?

To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series device...

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewa...

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

By default, which type of traffic is configured by service route configuration to use the management interface?

Which type of firewall resource can be assigned when configuring a new firewall virtual system (VSYS)?

Which forwarding methods can be used on the Objects tab when configuring the Log Forwarding profile?

In a hybrid cloud deployment, what is the primary function of Ansible in managing Palo Alto Networks NGFWs?

Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)