NGFW-ENGINEER Exam Questions

What is the requirement for interface link speeds when configuring a virtual wire on a Palo Alto Networks firewall?

When configuring a physical interface on a Palo Alto Networks firewall, which IP-based service is only available if the interface is set to Layer 3 mode?

A network engineer observes that after a primary link recovers, the firewall immediately switches traffic back from the backup static route to the primary static route. The enginee...

A Palo Alto Networks firewall has the following interfaces configured: - ethernet1/1 (Layer 3) - ethernet1/2 (TAP) - ethernet1/3 (Layer 2) - ethernet1/4 (virtual wire) An administr...

An administrator is designing a public key infrastructure (PKI) integration for a large-scale deployment with thousands of users authenticating via client certificates. A key desig...

An organization is migrating its data center to Amazon Web Services (AWS) and needs to deploy VM-Series firewalls to inspect all ingress and egress traffic. The solution must provi...

Which two services are configured by applying an SSL/TLS service profile? (Choose two.)

A firewall administrator uses Panorama to manage a fleet of firewalls. After successfully onboarding the firewalls to Strata Logging Service and enabling cloud logging via a templa...

What is a valid configurable limit for setting resource quotas when defining a new VSYS on a Palo Alto Networks firewall?

When considering the various methods for User-ID to learn user-to-IP address mappings, which source is considered the most accurate due to the mapping being explicitly created thro...

After a recent high availability (HA) failover test on an active/passive cluster, an engineer noted a 30-45 second delay before traffic started flowing through a Link Aggregation C...

An engineer is creating an automation workflow. The first step is to deploy a new VM-Series firewall into a VMware vSphere environment, including its virtual machine (VM) configura...

An organization uses Cloud Identity Engine (CIE) to gather user information from its on-premises Active Directory (AD) for employees and a separate Azure AD for external partners....

What are two valid zone types that can be selected from the zone configuration menu, per Palo Alto Networks best practices? (Choose two.)

An administrator is configuring dynamic updates on a Palo Alto Networks firewall that protects a hospital's patient record system. The primary concern is ensuring maximum stability...

An engineer is configuring a GlobalProtect portal and wants to enable split tunneling. The the DNS servers assigned by the VPN, while allowing all other DNS queries to be resolved...

An automation engineer is developing a Python script to standardize SD-WAN deployments across multiple customer tenants in Panorama. A key requirement is to programmatically create...

A security administrator is creating a new custom report to get a consolidated view of network events and needs to select a database to query for the report data. Which valid set o...

An organization's Security policy states that for all outbound web traffic, the TCP session to the external web server must be established by the firewall, not the user's workstati...

An administrator is troubleshooting a newly configured site-to-site VPN between a PAN-OS firewall and a third-party policy-based VPN gateway. The tunnel allows traffic between the...

An organization needs a GlobalProtect solution that meets two key requirements: - IT administrators must be able to run scripts and push updates to endpoints before a user logs in....

What is the primary use case for the CN-Series NGFW?

After a recent security audit, a company is required to enforce more strict validation for all certificate-based authentication, including for GlobalProtect clients. An engineer ob...

An administrator enables SSL Forward Proxy decryption using a self-signed certificate on a Palo Alto Networks firewall as the forward trust certificate. Shortly after, users report...

An engineer is configuring a site-to-site IPSec VPN to a partner network. The IKE Gateway and IPSec tunnel configurations are complete, and the tunnel interface has been assigned t...

A network administrator is configuring path monitoring for a primary static route to ensure immediate failback from a backup route. The administrator wants the primary route to bec...