NGFW-Engineer by Palo Alto Networks Valid Free Exam Practice Test

Question 1

Which type of firewall resource can be assigned when configuring a new firewall virtual system (VSYS)?

A. Sessions limit B. Memory C. CPU D. Security profile limit

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 2

What must be configured before a firewall administrator can define policy rules based on users and groups?

A. Group mapping settings B. User Mapping profile C. LDAP Server profile D. Authentication profile

Correct Answer: C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 3

A network security engineer at a 24/7 online retailer is upgrading an active/passive high availability (HA) cluster of PAN-OS firewalls. The primary goal is to perform the upgrade with no service interruption to online transactions. The engineer has already downloaded the new software to both devices.
Which sequence of actions will meet this requirement?

A. From Panorama, create a scheduled software update job targeting both firewalls in the HA pair to run at the same time, then rely on the HA election process to manage the failover automatically. B. Force the active firewall into a suspended state to trigger a failover, then upgrade and reboot it. Suspend the currently active firewall to fail traffic back to the upgraded unit. Upgrade the remaining firewall. C. Disable HA synchronization on the active firewall, upgrade the passive firewall, and then re-enable synchronization. Once synchronized, repeat the process on the other firewall. D. Upgrade the passive firewall first while it is still in the passive state. Once it reboots and is operational, suspend the active firewall to fail over to the newly upgraded device. Then, upgrade the remaining firewall.

Correct Answer: B

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 4

Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?

A. Modification of post NAT rules, creation of new views on the local firewall ACC tab, creation of local custom reports B. Modification of local security rules, modification of a Layer 3 interface, modification of the firewall device hostname C. Modification of pre-security rules, modification of a virtual router, modification of an IKE Gateway Network Profile D. Restarting the local firewall, running a packet capture, accessing the firewall CLI

Correct Answer: C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 5

A network administrator is hardening a new Palo Alto Networks firewall and wants to ensure that all firewall- generated management traffic, such as calls to Strata Logging Service, uses a dedicated in-band data port instead of the out-of-band management port.
Which configuration setting should the administrator modify to reroute this type of traffic?

A. Service route B. Virtual router C. Static route D. Interface Management profile

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 6

A network security engineer is designing a resilient architecture for inspecting traffic in Google Cloud Platform (GCP). The design must ensure that firewall service is maintained even if a single GCP zone becomes unavailable.
Which architecture should be used for the VM-Series firewalls in this use case?

A. Instance group of VM-Series firewalls spread across multiple zones with traffic routed to them by a GCP Internal Load Balancer B. Ansible playbook that monitors the health of the primary firewall and launches a new one in a different zone when a failure is detected C. PAN-OS active/active high availability (HA) cluster configured with dedicated HA interfaces in a shared VPC D. Single, large VM-Series firewall in one zone that is configured for live migration to another zone upon failure

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 7

A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner's Check Point Security Gateway. The partner has provided a specific list of local and remote IP address subnets that are permitted through the tunnel. The initial tunnel configuration on the PAN-OS firewall fails during the IKE Phase 2 exchange.
Which configuration step is essential to ensure compatibility with the policy-based Check Point gateway?

A. Enable Dead Peer Detection (DPD) in the IKE Gateway configuration. B. Define the local and remote subnets provided by the partner in the Proxy ID settings. C. Create individual Security policies for each pair of local and remote subnets. D. Assign a specific IP address to the tunnel interface to match the Check Point gateway.

Correct Answer: B

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 8

How does a Palo Alto Networks firewall choose the best route when it receives routes for the same destination from different routing protocols?

A. The route that was received first will be entered into the forwarding table, and all subsequent routes will be rejected. B. It compares the administrative distance and chooses the one with the lowest value. C. It compares the administrative distance and chooses the one with the highest value. D. It will attempt to load balance the traffic across all routes.

Correct Answer: B

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Palo Alto Networks Next-Generation Firewall Engineer - NGFW-Engineer Exam Practice Test