NGFW-ENGINEER practice questions 101–107

1. Question 101 · 107 in bank

   A Managed Security Service Provider (MSSP) is creating a new VSYS for a customer. To prevent this customer’s traffic from overwhelming the firewall’s state table, which resource limit should the MSSP configure for the new VSYS?

   • AMax security profiles
   • BMax bandwidth
   • CMax sessions
   • DMax Log Forwarding profiles

   Show answer

   Answer: C

   Next question

2. Question 102 · 107 in bank

   Select 2

   Which two Palo Alto Networks firewall services are secured by attaching an SSL/TLS service profile to their configuration? (Choose two.)

   • AAuthentication portal
   • BGlobalProtect portal
   • CLDAP server profiles
   • DPrisma Access service connections

   Show answer

   Answer: AB

   Next question

3. Question 103 · 107 in bank

   Select 2

   To comply with new directives mandating the use of quantum-resistant cryptography for all data-in-transit a network engineer is tasked with reconfiguring existing IKEv2 VPN tunnels between PA-Series firewalls to meet this requirement. Which two actions should the engineer take to ensure compliance? (Choose two.)

   • AConfigure an IKE Crypto profile with one or more post-quantum rounds selected and apply it to an IKE Gateway configured for the post-quantum key exchange mechanism.
   • BEstablish a shared secret of at least 64 characters and configure it as a post-quantum pre-shared key (PPK) within an IKEv2-only IKE Gateway.
   • CGenerate a post-quantum pre-shared key (PPK) and apply it within the IPSec tunnel configuration's advanced settings.
   • DEnable GlobalProtect with quantum-resistant tunneling and apply the profile to the IKE Gateway.

   Show answer

   Answer: AB

   Next question

4. Question 104 · 107 in bank

   Select 2

   An organization is securing its cloud workloads using the Palo Alto Networks platform. The goal is to use a fully managed firewall service that integrates with Panorama for consistent policy management. The solution must be scalable and require minimal changes to the existing routing fabric. • The AWS cloud uses a distributed architecture where each application virtual private cloud (VPC) routes internet traffic through its own internet gateway. • The Azure cloud is built around a Virtual WAN (vWAN) hub for centralized connectivity. Which two deployments meet these criteria? (Choose two.)

   • ANative cloud provider firewalls in both cloud environments and connected to Panorama for management
   • BCloud NGFW in each spoke VNet with User-Defined Routes (UDRs) to redirect traffic bypassing the vWAN hub
   • CCloud NGFW endpoints in each application VPC, updating the VPC route tables to direct traffic through the endpoints
   • DCloud NGFW as a security partner in the vWAN hub with routing configured to send traffic through the NGFW

   Show answer

   Answer: CD

   Next question

5. Question 105 · 107 in bank

   A holding company has recently acquired two new businesses, each with its own Okta identity provider. The holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three organizations’ firewalls. However, for legal reasons, the firewalls of Company A must only receive identity data from Company A's Okta instance, and the firewalls of Company B must only receive data from Company B's Okta instance. Which configuration in CIE supports this requirement with highest operational efficiency?

   • AConfigure a CIE tenant, connect Okta, and create segments.
   • BConfigure the firewalls for each company to query their respective Okta IdPs directly, bypassing CIE for redistribution.
   • CPush all identity data to Panorama and use Panorama's group mapping include/exclude lists to control what each firewall learns.
   • DCreate a master CIE tenant for the holding company and peer it with two subordinate tenants, one for each acquired business.

   Show answer

   Answer: A

   Next question

6. Question 106 · 107 in bank

   A network engineer has configured a PAN-OS firewall for client certificate authentication. The firewall has the corporate root CA certificate loaded. Client certificates are issued by an intermediate certificate authority (CA), which is signed by the root CA. However, when users attempt to connect, the authentication fails, and system logs indicate an "invalid certificate" error. What is the most likely cause of this authentication failure?

   • AIntermediate CA certificate has not been imported onto the firewall and added to the trust chain.
   • BClient certificates were generated with an insecure key length (e.g., 1024-bit RSA).
   • CFirewall clock is out of sync with the CA server by more than five minutes.
   • DOnline Certificate Status Protocol (OCSP) responder is unreachable, and no certificate revocation list (CRL) fallback is configured.

   Show answer

   Answer: A

   Next question

7. Question 107 · 107 in bank

   An administrator needs to perform several maintenance tasks on a managed firewall directly from the Panorama console without using the Context Switch feature. Which set of tasks can the administrator fully execute from the Panorama UI?

   • AEdit a post-rule. Create a new certificate profile. Configure the firewall's hostname.
   • BDownload and install a new content update. View current firewall session details. Initiate a device reboot.
   • CCreate a new zone. Configure a new virtual router. View the local ACC on the firewall.
   • DModify the IP address of a Layer 3 interface. Configure a new local administrator account. Edit a pre-rule.

   Show answer

   Answer: A

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 101. 107 questions available.