NGFW-ENGINEER practice questions 91–100

1. Question 91 · 107 in bank

   Select 2

   What are two valid zone types that can be selected from the zone configuration menu, per Palo Alto Networks best practices? (Choose two.)

   • ALayer 3
   • BLayer 2
   • CManagement
   • DDMZ

   Show answer

   Answer: AB

   Next question

2. Question 92 · 107 in bank

   An automation engineer is developing a Python script to standardize SD-WAN deployments across multiple customer tenants in Panorama. A key requirement is to programmatically create path quality profiles to monitor link performance based on latency, jitter, and packet loss. Which API call is required for this task?

   • AXML API command with an xpath of config/devices/entry/vsys/entry/path-quality-profiles on Panorama
   • BXML API command with an xpath of sdwan/path-quality-profiles on a managed firewall
   • CPOST request to the SDWanPathQualityProfiles object endpoint via the REST API on Panorama
   • DPOST request to the pathMonitoringProfiles object endpoint via the REST API on a managed firewall

   Show answer

   Answer: C

   Next question

3. Question 93 · 107 in bank

   A security administrator is creating a new custom report to get a consolidated view of network events and needs to select a database to query for the report data. Which valid set of databases is available for the task?

   • AThreat, URL Filtering, WildFire Submissions, GlobalProtect
   • BTraffic, User-ID, Application Statistics, HIP Match
   • CData Filtering, IP-Tag, User-ID, Endpoint Security
   • DSystem, Config, Authentication, Session Flow

   Show answer

   Answer: B

   Next question

4. Question 94 · 107 in bank

   An organization's Security policy states that for all outbound web traffic, the TCP session to the external web server must be established by the firewall, not the user's workstation. This requires configuring user web browsers to point to the firewall. Authentication is also required. Which solution on a PA-Series firewall meets these specific needs?

   • ATransparent proxy
   • BExplicit proxy
   • CGlobalProtect with User-ID
   • DDecryption policy with Authentication Portal

   Show answer

   Answer: B

   Next question

5. Question 95 · 107 in bank

   An administrator is troubleshooting a newly configured site-to-site VPN between a PAN-OS firewall and a third-party policy-based VPN gateway. The tunnel allows traffic between the first pair of configured subnets, but traffic to a newly added remote subnet is failing. The administrator has confirmed that routing and Security policies are correct. What is the most likely cause of this issue?

   • AA static route for the new subnet pointing to the tunnel interface is missing.
   • BThe Security policy for the new subnet must be placed above the existing VPN policy.
   • CThe new local and remote subnets are missing from the Proxy ID configuration.
   • DThe tunnel's maximum transmission unit (MTU) size must be increased to accommodate the new traffic.

   Show answer

   Answer: C

   Next question

6. Question 96 · 107 in bank

   An organization needs a GlobalProtect solution that meets two key requirements: • IT administrators must be able to run scripts and push updates to endpoints before a user logs in. • Users must authenticate with their cloud identity provider, which is protected by multi-factor authentication (MFA). Which GlobalProtect authentication configuration should be used to meet both requirements?

   • ACookie-based authentication for both pre-logon and user logon.
   • BSAML authentication for pre-logon and certificate-based authentication for user logon.
   • CSingle authentication profile using Kerberos to handle both pre-logon and user logon.
   • DCertificate-based authentication for pre-logon and SAML authentication for user logon.

   Show answer

   Answer: D

   Next question

7. Question 97 · 107 in bank

   An administrator enables SSL Forward Proxy decryption using a self-signed certificate on a Palo Alto Networks firewall as the forward trust certificate. Shortly after, users report receiving "Your connection is not private" browser errors for all external websites. What is the most likely cause of these widespread certificate errors?

   • AThe decryption policy is configured with a "no-decrypt" action, which causes browsers to reject the connection.
   • BThe external websites are using TLS 1.3, which cannot be decrypted by the firewall without a specific license.
   • CThe firewall's forward untrust certificate has expired, preventing it from identifying untrusted sites.
   • DThe firewall's self-signed CA certificate is not deployed to the trusted certificate store on client endpoints.

   Show answer

   Answer: D

   Next question

8. Question 98 · 107 in bank

   An engineer configures a PA-440 firewall to act as a switch by creating several Layer 2 interfaces and assigning them all to VLAN 20. A file server is connected to interface ethernet1/1, and client workstations are connected to interfaces ethernet1/2 and ethemet1/3. All devices are in VLAN 20. The clients are unable to access the file server. Which configuration step to allow this communication by default is missing?

   • ACreate an Aggregate Ethernet (AE) group that includes all three interfaces.
   • BPlace ethernet1/1, ethernet1/2, and ethernet1/3 into the same Layer 2 zone.
   • CCreate an "allow" Security policy with the source and destination VLAN set to "VLAN 20".
   • DCreate a Layer 3 subinterface for VLAN 20 to enable routing.

   Show answer

   Answer: B

   Next question

9. Question 99 · 107 in bank

   Select 2

   An organization is migrating its GlobalProtect user authentication from an existing LDAP directory to a new Kerberos server. To ensure a smooth transition, the network security team needs to allow users from both directories to authenticate for a period of 90 days. The firewall should first attempt authentication against the new Kerberos server and then fall back to the legacy LDAP server if the initial attempt fails. Which two configurations are required to implement this authentication fallback strategy? (Choose two.)

   • AConfigure a new RADIUS proxy on the firewall to handle authentication requests for both Kerberos and LDAP.
   • BImplement a User-ID Group Mapping policy to link users between the LDAP and Kerberos directories.
   • CConfigure an authentication sequence that lists the Kerberos authentication profile first, followed by the LDAP authentication profile.
   • DConfigure a new authentication profile that references the Kerberos server profile.

   Show answer

   Answer: CD

   Next question

10. Question 100 · 107 in bank

    A network administrator is hardening a new Palo Alto Networks firewall and wants to ensure that all firewall-generated management traffic, such as calls to Strata Logging Service, uses a dedicated in-band data port instead of the out-of-band management port. Which configuration setting should the administrator modify to reroute this type of traffic?

    • AService route
    • BInterface Management profile
    • CVirtual router
    • DStatic route

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 91. 107 questions available.