Free NGFW-Engineer: Palo Alto Networks Next-Generation Firewall Engineer Exam Questions and Answers

An engineer is configuring path monitoring on an active/passive pair of firewalls. The active firewall must fail over only when both 10.20.0.1 and 10.20.0.2 are unreachable from virtual router VR-Core. A single unreachable destination must not trigger a failover. Which configuration meets the requirement?

• AA. Place both destinations in one path group and set the path group Failure Condition to Any
• BB. Enable link monitoring on the connected interfaces and set the link group Failure Condition to All
• CC. Place both destinations in one path group and set the path group Failure Condition to All
• DD. Create two path groups, each containing one destination, and set the path monitoring Failure Condition to Any

A firewall performs SSL Forward Proxy decryption using a subordinate CA certificate issued by the company's enterprise root CA, which all managed clients trust. The engineer must make sure that when a destination server presents a certificate signed by an untrusted issuer, users see a browser certificate warning instead of a trusted connection. Which configuration meets the requirement?

• AA. Mark the enterprise subordinate CA certificate as both Forward Trust Certificate and Forward Untrust Certificate
• BB. Keep a single Forward Trust Certificate and enable blocking of sessions with untrusted issuers in the Decryption profile
• CC. Generate a separate CA certificate, mark it as the Forward Untrust Certificate, and do not distribute it to clients
• DD. Import a CA certificate already trusted by clients and mark it as the Forward Untrust Certificate

An engineer is planning zones for a new firewall deployment. Which two statements about security zones are correct? (Choose two.)

Select 2 answers.

• AA. An interface can be a member of only one zone at a time
• BB. A zone has one type, such as Layer 3 or virtual wire, and the interfaces assigned to it must match that type
• CC. Traffic between two interfaces in the same zone is denied until an intrazone rule is added
• DD. Layer 2 and Layer 3 interfaces can share a single zone if they are in the same virtual system

A company hosts workloads in an Azure hub-and-spoke network. The security team must terminate GlobalProtect gateways for remote users, run IPSec tunnels with BGP to on-premises sites, and manage all policy from an existing Panorama. The team accepts responsibility for sizing and upgrading the firewalls. Which deployment option meets the requirements?

• AA. VM-Series firewalls deployed in the hub virtual network
• BB. Cloud NGFW for Azure deployed as a native resource in each spoke virtual network
• CC. PA-Series firewalls in a colocation facility reached through ExpressRoute
• DD. CN-Series firewalls deployed as a DaemonSet on AKS clusters

An engineer imports the certificate and private key of an internal web server, 10.1.1.50, to the firewall to decrypt connections from external clients. The decryption rule from the untrust zone to this server uses the SSL Forward Proxy type with the firewall's Forward Trust certificate. The decryption log shows failed sessions, and external clients receive certificate warnings. Which change corrects the configuration?

• AA. Change the rule type to SSL Inbound Inspection and select the imported server certificate
• BB. Add the server to a No Decrypt rule and install its certificate on the clients
• CC. Mark the imported server certificate as the Forward Trust Certificate
• DD. Generate a new CA certificate on the firewall and mark it as the Forward Untrust Certificate

A firewall has two default static routes: one through ISP1 with metric 10 and a backup through ISP2 with metric 20. An engineer adds path monitoring to the ISP1 route with two monitored destinations, 203.0.113.10 and 198.51.100.10. The route must be withdrawn only when both destinations stop responding to ICMP pings. Which configuration meets the requirement?

• AA. Set the ping count on each monitored destination to 10 and the failure condition to Any
• BB. Set the path monitoring failure condition on the ISP1 route to All
• CC. Attach a BFD profile that lists both destinations to the ISP1 route
• DD. Set the preemptive hold time on the ISP2 route to the maximum value

A company routes all remote-user traffic through a GlobalProtect gateway. Video conferencing traffic to a SaaS provider is degrading the tunnel, and the provider's IP addresses change frequently. The engineer must send this traffic directly from the endpoint and keep everything else in the tunnel. Which configuration meets the requirement?

• AA. Add the provider's domain as an Exclude Domain in the Split Tunnel settings of the gateway agent configuration
• BB. Add the provider's domain to a URL Filtering profile allow list applied to the tunnel zone
• CC. Add the provider's current IP ranges as Exclude entries under Access Route in the gateway agent configuration
• DD. Add the provider's domain as an Include Domain in the Split Tunnel settings of the gateway agent configuration

In Cloud NGFW for AWS, which construct holds the Security rules and security profiles that are applied to a firewall when Panorama is not used?

• AA. Device Group
• BB. Virtual system
• CC. Template Stack
• DD. Rulestack

Interfaces ethernet1/3 and ethernet1/4 are both Layer 3 interfaces in the Lab zone, and each connects to a different lab subnet. Both subnets have a rule allowing access to the untrust zone. Hosts in one subnet are able to reach hosts in the other. Without changing the zone assignments, how can the engineer block traffic between the subnets?

• AA. Create an intrazone rule with Lab as the source and destination zone and the action set to Deny
• BB. Create an interzone rule with Lab as the source and destination zone and the action set to Deny
• CC. Apply a Zone Protection profile to the Lab zone that drops traffic between its interfaces
• DD. Create a rule from Lab to untrust that denies traffic destined to the lab subnets

A Panorama management server, two dedicated Log Collectors and 12 managed firewalls all run PAN-OS 10.2. An engineer plans to move the entire environment to PAN-OS 11.1. In which order should the devices be upgraded?

• AA. Panorama, then Log Collectors, then firewalls
• BB. Log Collectors, then Panorama, then firewalls
• CC. Firewalls, then Log Collectors, then Panorama
• DD. Firewalls and Panorama together, then Log Collectors