Palo Alto Networks NGFW-Engineer Exam Questions Instant Access

Question 1

An organization uses Cloud Identity Engine (CIE) to gather user information from its on-premises Active Directory (AD) for employees and a separate Azure AD for external partners. Due to compliance regulations, the firewalls protecting the internal network must not have any identity information about external partners. Conversely, firewalls in the partner-facing DMZ should only be aware of partner identities.

Which CIE feature is designed to solve this data partitioning requirement?

APanorama templates, which can be used to push different User-ID agent configurations to each firewall group

BSegments, which can be configured to create distinct, filter-based views of users and groups that are then redistributed only to the appropriate firewalls

CMultiple tenants, where a separate CIE tenant is required for each user directory to maintain isolation

DDirectory sync filtering, which is used at the source to prevent specific OUs from being imported into CIE

Answer : B

Question 2

An administrator is troubleshooting a newly configured site-to-site VPN between a PAN-OS firewall and a third-party policy-based VPN gateway. The tunnel allows traffic between the first pair of configured subnets, but traffic to a newly added remote subnet is failing. The administrator has confirmed that routing and Security policies are correct.

What is the most likely cause of this issue?

AA static route for the new subnet pointing to the tunnel interface is missing.

BThe Security policy for the new subnet must be placed above the existing VPN policy.

CThe new local and remote subnets are missing from the Proxy ID configuration.

DThe tunnel's maximum transmission unit (MTU) size must be increased to accommodate the new traffic.

Answer : C

Question 3

A network security engineer at a 24/7 online retailer is upgrading an active/passive high availability (HA) cluster of PAN-OS firewalls. The primary goal is to perform the upgrade with no service interruption to online transactions. The engineer has already downloaded the new software to both devices.

Which sequence of actions will meet this requirement?

AFrom Panorama, create a scheduled software update job targeting both firewalls in the HA pair to run at the same time, then rely on the HA election process to manage the failover automatically.

BUpgrade the passive firewall first while it is still in the passive state. Once it reboots and is operational, suspend the active firewall to fail over to the newly upgraded device. Then, upgrade the remaining firewall.

CForce the active firewall into a suspended state to trigger a failover, then upgrade and reboot it. Suspend the currently active firewall to fail traffic back to the upgraded unit. Upgrade the remaining firewall.

DDisable HA synchronization on the active firewall, upgrade the passive firewall, and then re-enable synchronization. Once synchronized, repeat the process on the other firewall.

Answer : C

Question 4

An organization needs a GlobalProtect solution that meets two key requirements:

* IT administrators must be able to run scripts and push updates to endpoints before a user logs in.

* Users must authenticate with their cloud identity provider, which is protected by multi-factor authentication (MFA).

Which GlobalProtect authentication configuration should be used to meet both requirements?

ACookie-based authentication for both pre-logon and user logon.

BSAML authentication for pre-logon and certificate-based authentication for user logon.

CSingle authentication profile using Kerberos to handle both pre-logon and user logon.

DCertificate-based authentication for pre-logon and SAML authentication for user logon.

Answer : D

Question 5

A network security engineer is segmenting a single firewall into VSYS-A and VSYS-B. For traffic to flow from VSYS-A to VSYS-B, external zones are required.

What are two fundamental properties of the external zones needed for this configuration? (Choose two.)

AThey must be linked to the same virtual router as the ingress interface.

BThey represent their parent VSYS without being tied to a physical or logical interface.

CThey are a security construct belonging to a single VSYS.

DThey are automatically created when inter-VSYS routing is enabled.

Answer : B, C

Question 6

What is the requirement for interface link speeds when configuring a virtual wire on a Palo Alto Networks firewall?

AThey must be configured with auto-negotiate settings regardless of the port type.

BThey must all be either copper or fiber optic, however they can be different.

CThey must have the same link speed and transmission mode.

DThey must be the same media type.

Answer : C

Question 7

A Managed Security Service Provider (MSSP) is creating a new VSYS for a customer.

To prevent this customer's traffic from overwhelming the firewall's state table, which resource limit should the MSSP configure for the new VSYS?

AMax security profiles

BMax bandwidth

CMax sessions

DMax Log Forwarding profiles

Answer : C

Palo Alto Networks Next-Generation Firewall Engineer NGFW-Engineer Exam Questions