NGFW-ENGINEER practice questions 11–20

1. Question 11 · 107 in bank

   In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured. What function do certificate profiles serve in this context?

   • AThey store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
   • BThey define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
   • CThey allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication.
   • DThey provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.

   Show answer

   Answer: B

   Next question

2. Question 12 · 107 in bank

   How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

   • AIt does not accept the configuration.
   • BIt accepts the configuration but throws a warning message.
   • CIt removes the static route because 0 is a NULL value.
   • DIt reinstalls the route into the routing information base (RIB) as soon as the path comes up.

   Show answer

   Answer: D

   Next question

3. Question 13 · 107 in bank

   Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

   • ASet Transmission Rate to “fast.”
   • BSet passive link state to “Auto.”
   • CSet “Enable in HA Passive State.”
   • DSet LACP mode to “Active.”

   Show answer

   Answer: C

   Next question

4. Question 14 · 107 in bank

   After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish. Which of the following actions will resolve this issue?

   • AEnsure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface.
   • BConfigure the Proxy IDs to match the Cisco ASA configuration.
   • CCheck that IPSec is enabled in the management profile on the external interface.
   • DValidate the tunnel interface VLAN against the peer’s configuration.

   Show answer

   Answer: B

   Next question

5. Question 15 · 107 in bank

   When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

   • AService graph
   • BAnsible automation modules
   • CPanorama role-based access control (RBAC)
   • DCN-Series firewalls

   Show answer

   Answer: D

   Next question

6. Question 16 · 107 in bank

   When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

   • AFlood Protection
   • BProtocol Protection
   • CPacket-Based Attack Protection
   • DReconnaissance Protection

   Show answer

   Answer: C

   Next question

7. Question 17 · 107 in bank

   Select 2

   For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

   • AUse of dynamic routing protocols
   • BTunnel monitoring
   • CUse of peer IP
   • DRedistribution of User-ID

   Show answer

   Answer: AB

   Next question

8. Question 18 · 107 in bank

   Which PAN-OS method of mapping users to IP addresses is the most reliable?

   • APort mapping
   • BGlobalProtect
   • CSyslog
   • DServer monitoring

   Show answer

   Answer: B

   Next question

9. Question 19 · 107 in bank

   In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

   • ATo forward packets to the HA peer during session setup and asymmetric traffic flow
   • BTo exchange hellos, heartbeats, HA state information, and management plane synchronization for routing and User-ID information
   • CTo synchronize sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in an HA pair
   • DTo perform session cache synchronization among all HA peers having the same cluster ID

   Show answer

   Answer: A

   Next question

10. Question 20 · 107 in bank

    A PA-Series firewall with all licensable features is being installed. The customer’s Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions. Which action meets the requirements in this scenario?

    • ADeploy the transparent proxy with Web Cache Communications Protocol (WCCP).
    • BDeploy the Next-Generation Firewalls as normal and install the User-ID agent.
    • CDeploy the Advanced URL Filtering license and captive portal.
    • DDeploy the explicit proxy with Kerberos authentication scheme.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 11. 107 questions available.