Question 1
What is the purpose of assigning an Admin Role Profile to a user in a Palo Alto Networks NGFW?
Correct Answer:
C. Define granular permissions for management tasks.
Free Palo Alto Networks Next-Generation Firewall Engineer NGFW-Engineer Exam Questions
Question 2
A network security engineer needs to permit traffic between two distinct VSYS that reside on one Palo Alto Networks firewall. This traffic will not egress the firewall to an external device.
Which zone type must be configured to act as the logical source and destination for this traffic flow?
Correct Answer:
A. External
Question 3
An organization's Security policy states that for all outbound web traffic, the TCP session to the external web server must be established by the firewall, not the user's workstation. This requires configuring user web browsers to point to the firewall. Authentication is also required.
Which solution on a PA-Series firewall meets these specific needs?
Correct Answer:
B. Explicit proxy
Question 4
An organization is securing its cloud workloads using the Palo Alto Networks platform. The goal is to use a fully managed firewall service that integrates with Panorama for consistent policy management. The solution must be scalable and require minimal changes to the existing routing fabric.
* The AWS cloud uses a distributed architecture where each application virtual private cloud (VPC) routes internet traffic through its own internet gateway.
* The Azure cloud is built around a Virtual WAN (vWAN) hub for centralized connectivity.
Which two deployments meet these criteria? (Choose two.)
Correct Answer:
C. Cloud NGFW endpoints in each application VPC, updating the VPC route tables to direct traffic through the endpoints; D. Cloud NGFW as a security partner in the vWAN hub with routing configured to send traffic through the NGFW
Question 5
A security administrator is creating a new custom report to get a consolidated view of network events and needs to select a database to query for the report data.
Which valid set of databases is available for the task?
Correct Answer:
B. Traffic, User-ID, Application Statistics, HIP Match
Question 6
''Both Network Traffic and DNS'' option?
Correct Answer:
D. It specifies which domains are resolved by the VPN-assigned DNS servers and which domains are resolved by the local DNS servers.
Question 7
A network security engineer is designing a resilient architecture for inspecting traffic in Google Cloud Platform (GCP). The design must ensure that firewall service is maintained even if a single GCP zone becomes unavailable.
Which architecture should be used for the VM-Series firewalls in this use case?
Correct Answer:
C. Instance group of VM-Series firewalls spread across multiple zones with traffic routed to them by a GCP Internal Load Balancer
Question 8
A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner's Check Point Security Gateway. The partner has provided a specific list of local and remote IP address subnets that are permitted through the tunnel. The initial tunnel configuration on the PAN-OS firewall fails during the IKE Phase 2 exchange.
Which configuration step is essential to ensure compatibility with the policy-based Check Point gateway?
Correct Answer:
A. Define the local and remote subnets provided by the partner in the Proxy ID settings.
Question 9
In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?
Correct Answer:
A. To forward packets to the HA peer during session setup and asymmetric traffic flow
Question 10
How does a Palo Alto Networks firewall choose the best route when it receives routes for the same destination from different routing protocols?
Correct Answer:
D. It compares the administrative distance and chooses the one with the lowest value.