NGFW-ENGINEER Exam Questions

How does a Palo Alto Networks firewall choose the best route when it receives routes for the same destination from different routing protocols?

A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hier...

What is a key difference between OSPF and BGP when used in a Palo Alto Networks firewall?

Which protocol and port number are used by default for IKE Phase 1 negotiations in an IPSec VPN?

What is the function of a Certificate Revocation List (CRL) in a PKI?

In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

Which two zone types are valid when configuring a new security zone? (Choose two.)

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authen...

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, t...

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is re...

In an enterprise network, security administrators want to control traffic based on application behavior rather than only using IP addresses and TCP/UDP ports. Which NGFW capability...

A company deploys an NGFW and notices that several applications running over HTTPS (TCP 443) cannot be accurately identified. What is the MOST likely reason for this behavior?

An organization wants to protect its internal network from previously unknown malware that does not match any existing signatures. Which NGFW feature BEST addresses this requiremen...

A security engineer creates a policy allowing only members of the 揊inance?Active Directory group to access a cloud-based accounting application. Which NGFW capability makes this po...

After enabling multiple security profiles such as IPS, antivirus, and URL filtering on an NGFW, users report degraded network performance. Which factor is MOST likely causing the i...

An NGFW is deployed inline to inspect traffic without requiring any changes to existing IP addressing or routing configurations. Which deployment mode is being used?

A security team wants to block peer-to-peer file sharing applications even when those applications attempt to evade detection by using non-standard ports. Which NGFW capability ena...

Why is SSL/TLS decryption considered critical for effective NGFW security inspection in modern networks?

An NGFW policy allows general web browsing but blocks access to known malicious or high-risk websites. Which NGFW security function is MOST directly responsible for this behavior?

An organization requires a single security platform that integrates firewalling, VPN, intrusion prevention, and malware protection to simplify operations. Which security concept BE...

An organization is deploying VM-Series firewalls in Microsoft Azure to secure its VNets. A key requirement is that the security infrastructure must be resilient to the failure of a...

When creating a Log Forwarding profile on a PAN-OS firewall to direct logs to various external and internal systems, which set of methods is available?

A company is enabling SSL Forward Proxy to inspect encrypted traffic. A security engineer generates a new certificate on the firewall and flags it with the "Forward Trust" certific...

An administrator is configuring a site-to-site IPSec VPN and assigns an IP address to the tunnel interface. Which two abilities are enabled by this specific configuration step? (Ch...

A DevOps team is building a repeatable process for deploying new Palo Alto Networks VM-Series firewalls. The entire infrastructure, including virtual networks, subnets, and the fir...

A network security engineer is segmenting a single firewall into VSYS-A and VSYS-B. For traffic to flow from VSYS-A to VSYS-B, external zones are required. What are two fundamental...

A network engineer observes a pattern of anomalous traffic hitting an external-facing zone, including a high volume of TCP packets that are not part of a new session handshake (non...

An administrator is configuring a GlobalProtect pre-logon VPN. The administrator has already imported the necessary internal certificate authority (CA) certificates for issuing mac...

A network administrator needs to replace the default self-signed certificate on a firewall with one signed by the company's internal certificate authority (CA). Which two firewall...

A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner's Check Point Security Gateway. The partner has provided a specific l...

Which method creates the most reliable user-to-IP mapping due to being based on a direct authentication from the user's device to the firewall?

An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an access route. Users report that public web browsing works, but they cannot...

Which initial action is required to configure logical routers?

A network security engineer at a 24/7 online retailer is upgrading an active/passive high availability (HA) cluster of PAN-OS firewalls. The primary goal is to perform the upgrade...

A government agency needs to ensure that all user web access is explicitly mediated and authenticated. The agency has the following requirements: - Client browsers must be manually...

A network security engineer is reviewing the dynamic update settings for a fleet of firewalls in a financial institution that has a policy prioritizing operational stability above...

What is the correct sequence of evaluation for Security policy rulebases?

An administrator needs to ensure that a firewall can download threat prevention and software updates, but the management port is on an isolated network without internet access. Whi...

An organization is adopting an Infrastructure as Code (IaC) approach to manage its entire network environment, including its Palo Alto Networks firewalls. The organization has chos...

A network security engineer wants to create Security policy rules that allow or deny traffic based on a user's department, which corresponds to groups in the company's Active Direc...

When an engineer creates a new VSYS on a supported firewall platform, which resource can be explicitly limited in the VSYS configuration to control its capacity?

A large organization has separate production and development environments, each with its own set of firewalls managed by Panorama. The organization uses Cloud Identity Engine (CIE)...

An administrator must perform several actions on a fleet of firewalls from a central Panorama instance. To maintain efficiency, the administrator wants to only perform actions that...

A network administrator is configuring an Aggregate Ethernet (AE) interface on an active/passive high availability (HA) pair. To reduce network downtime during a failover, the admi...

A firewall administrator needs to configure a new Palo Alto Networks firewall so that its management interface automatically obtains an IP address, netmask, and default gateway fro...

When multiple routes have the same destination prefix, which attribute does the firewall use first to determine route preference?

An organization must secure its AWS and Azure environments using a managed Palo Alto Networks solution, and all policies must be synchronized from an existing Panorama deployment....

A cloud security team wants to extend its existing Palo Alto Networks Security policies into the organization's Kubernetes environments. The team requires an NGFW solution that can...

A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy...

A network security engineer needs to permit traffic between two distinct VSYS that reside on one Palo Alto Networks firewall. This traffic will not egress the firewall to an extern...