NGFW-ENGINEER practice questions 41–50

1. Question 41 · 107 in bank

   Which zone type allows traffic between zones in different virtual systems (VSYS), without the traffic leaving the firewall?

   • AIsolated
   • BTransient
   • CExternal
   • DInternal

   Show answer

   Answer: C

   Next question

2. Question 42 · 107 in bank

   A multinational organization wants to use the Cloud Identity Engine (CIE) to aggregate identity data from multiple sources (on premises AD, Azure AD, Okta) while enforcing strict data isolation for different regional business units. Each region’s firewalls, managed via Panorama, must only receive the user and group information relevant to that region. The organization aims to minimize administrative overhead while meeting data sovereignty requirements. Which approach achieves this segmentation of identity data?

   • ACreate one CIE tenant, aggregate all identity data into a single view, and redistribute the full dataset to all firewalls. Rely on per-firewall Security policies to restrict access to out-of-scope user and group information.
   • BEstablish separate CIE tenants for each business unit, integrating each tenant with the relevant identity sources. Redistribute user and group data from each tenant only to the region’s firewalls, maintaining a strict one-to-one mapping of tenant to business unit.
   • CDisable redistribution of identity data entirely. Instead, configure each regional firewall to pull user and group details directly from its local identity providers (IdPs).
   • DDeploy a single CIE tenant that collects all identity data, then configure segments within the tenant to filter and redistribute only the relevant user/group sets to each regional firewall group.

   Show answer

   Answer: D

   Next question

3. Question 43 · 107 in bank

   An enterprise uses GlobalProtect with both user- and machine-based certificate authentication and requires pre-logon, OCSP checks, and minimal user disruption. They manage multiple firewalls via Panorama and deploy domain-issued machine certificates via Group Policy. Which approach ensures continuous, secure connectivity and consistent policy enforcement?

   • AUse a wildcard certificate from a public CA, disable all revocation checks to reduce latency, and manage certificate renewals manually on each firewall.
   • BDistribute root and intermediate CAs via Panorama template, use distinct certificate profiles for user versus machine certs, reference an internal OCSP responder, and automate certificate deployment with Group Policy.
   • CConfigure a single certificate profile for both user and machine certificates. Rely solely on CRLs for revocation to minimize complexity.
   • DDeploy self-signed certificates on each firewall, allow IP-based authentication to override certificate checks, and use default GlobalProtect settings for user / machine identification.

   Show answer

   Answer: B

   Next question

4. Question 44 · 107 in bank

   Select 2

   An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML. Which two actions meet the criteria? (Choose two.)

   • ACreate a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
   • BCreate an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.
   • CCreate and apply an authentication profile with the “SAML Identity Provider” Server Profile.
   • DCreate and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.

   Show answer

   Answer: AC

   Next question

5. Question 45 · 107 in bank

   Which statement applies to Log Collector Groups?

   • ALog redundancy is available only if each Log Collector has the same amount of total disk storage.
   • BEnabling redundancy increases the log processing traffic in a Collector Group by 50%.
   • CIn any single Collector Group, all the Log Collectors must run on the same Panorama model. D. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.

   Show answer

   Answer: C

   Next question

6. Question 46 · 107 in bank

   Which CLI command is used to configure the management interface as a DHCP client?

   • Aset network dhcp interface management
   • Bset network dhcp type management-interface
   • Cset deviceconfig system type dhcp-client
   • Dset deviceconfig management type dhcp-client

   Show answer

   Answer: C

   Next question

7. Question 47 · 107 in bank

   Which interface types should be used to configure link monitoring for a high availability (HA) deployment on a Palo Alto Networks NGFW?

   • AHA, Virtual Wire, and Layer 2
   • BTap, Virtual Wire, and Layer 3
   • CVirtual Wire, Layer 2, and Layer 3
   • DHA, Layer 2, and Layer 3

   Show answer

   Answer: C

   Next question

8. Question 48 · 107 in bank

   Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

   • AImport the new subordinate CA certificate into the trust stores of all client devices.
   • BSet the subordinate CA certificate as the default routing certificate for all network traffic.
   • CConfigure the subordinate CA to issue certificates with indefinite validity periods.
   • DDisable all existing SSL decryption rules until the new certificate is fully propagated.

   Show answer

   Answer: A

   Next question

9. Question 49 · 107 in bank

   What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?

   • AScanning, Isolation, Whitelisting, Logging
   • BDiscovery, Deployment, Detection, Prevention
   • CPolicy Generation, Discovery, Enforcement, Logging
   • DProfiling, Policy Generation, Enforcement, Reporting

   Show answer

   Answer: B

   Next question

10. Question 50 · 107 in bank

    What is the purpose of assigning an Admin Role Profile to a user in a Palo Alto Networks NGFW?

    • AAllow access to all resources without restrictions.
    • BEnable multi-factor authentication (MFA) for administrator access.
    • CDefine granular permissions for management tasks.
    • DRestrict access to sensitive report data.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 41. 107 questions available.