Free NGFW-Engineer: Palo Alto Networks Next-Generation Firewall Engineer Exam Questions and Answers

Which statement applies to Log Collector Groups?

• AA. Log redundancy is available only if each Log Collector has the same amount of total disk storage.
• BB. Enabling redundancy increases the log processing traffic in a Collector Group by 50%.
• CC. In any single Collector Group, all the Log Collectors must run on the same Panorama model.
• DD. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish. Which of the following actions will resolve this issue?

• AA. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface.
• BB. Configure the Proxy IDs to match the Cisco ASA configuration.
• CC. Check that IPSec is enabled in the management profile on the external interface.
• DD. Validate the tunnel interface VLAN against the peer's configuration.

What must be configured before a firewall administrator can define policy rules based on users and groups?

• AA. User Mapping profile
• BB. Authentication profile
• CC. Group mapping settings
• DD. LDAP Server profile

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon. How does the GlobalProtect agent process the authentication flow on Windows endpoints?

• AA. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
• BB. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
• CC. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
• DD. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.

Which two zone types are valid when configuring a new security zone? (Choose two.)

Select 2 answers.

• AA. Tunnel
• BB. Intrazone
• CC. Internal
• DD. Virtual Wire

Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?

• AA. Restarting the local firewall, running a packet capture, accessing the firewall CLI
• BB. Modification of local security rules, modification of a Layer 3 interface, modification of the firewall device hostname
• CC. Modification of pre-security rules, modification of a virtual router, modification of an IKE Gateway Network Profile
• DD. Modification of post NAT rules, creation of new views on the local firewall ACC tab, creation of local custom reports

Which networking technology can be configured on Layer 3 interfaces but not on Layer 2 interfaces?

• AA. DDNS
• BB. Link Duplex
• CC. NetFlow
• DD. LLDP

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall. Which firewall models support this configuration?

• AA. PA-5280, PA-7080, PA-3250, VM-Series
• BB. PA-455, VM-Series, PA-1410, PA-5450
• CC. PA-3260, PA-5410, PA-850, PA-460
• DD. PA-7050, PA-1420, VM-Series, CN-Series

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third-party gateway? (Choose two.)

Select 2 answers.

• AA. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
• BB. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
• CC. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
• DD. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured. What function do certificate profiles serve in this context?

• AA. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
• BB. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
• CC. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication.
• DD. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.