NGFW-ENGINEER practice questions 51–60

1. Question 51 · 107 in bank

   An organization is deploying VM-Series firewalls in Microsoft Azure to secure its VNets. A key requirement is that the security infrastructure must be resilient to the failure of an entire Azure Availability Zone. What is the recommended method to achieve this goal?

   • ADeploy multiple, independent VM-Series firewalls in different Availability Zones and use an Azure Load Balancer to distribute traffic to them.
   • BImplement a Terraform configuration that automatically redeploys the firewall in a new zone if the original one fails.
   • CUse Azure Traffic Manager to direct traffic to a primary VM-Series firewall, with a second firewall in another zone as a failover target.
   • DConfigure PAN-OS active/passive high availability (HA) between two VM-Series instances in separate Availability Zones using HA links over a VNet peering connection.

   Show answer

   Answer: A

   Next question

2. Question 52 · 107 in bank

   When creating a Log Forwarding profile on a PAN-OS firewall to direct logs to various external and internal systems, which set of methods is available?

   • ASyslog, Panorama, SD-WAN
   • BPanorama/Cloud logging, email, Syslog
   • CEmail, Syslog, NetFlow
   • DHTTP, RADIUS, SNMP

   Show answer

   Answer: B

   Next question

3. Question 53 · 107 in bank

   A company is enabling SSL Forward Proxy to inspect encrypted traffic. A security engineer generates a new certificate on the firewall and flags it with the "Forward Trust" certificate property. What is the critical next step that must be performed for decryption to function correctly without causing security warnings for end users?

   • ASet the forward trust certificate as the SSL/TLS Service profile for the management interface.
   • BCreate a Security policy rule that allows traffic from the certificate of the firewall to all the zones.
   • CImport the private key of the forward trust certificate onto the domain controller.
   • DInstall the public portion of the forward trust certificate into the trust store of all client machines.

   Show answer

   Answer: D

   Next question

4. Question 54 · 107 in bank

   Select 2

   A network security engineer is segmenting a single firewall into VSYS-A and VSYS-B. For traffic to flow from VSYS-A to VSYS-B, external zones are required. What are two fundamental properties of the external zones needed for this configuration? (Choose two.)

   • AThey must be linked to the same virtual router as the ingress interface.
   • BThey represent their parent VSYS without being tied to a physical or logical interface.
   • CThey are a security construct belonging to a single VSYS.
   • DThey are automatically created when inter-VSYS routing is enabled.

   Show answer

   Answer: BC

   Next question

5. Question 55 · 107 in bank

   A DevOps team is building a repeatable process for deploying new Palo Alto Networks VM-Series firewalls. The entire infrastructure, including virtual networks, subnets, and the firewalls themselves, must be defined in code to ensure consistency and enable version control. Which tool is primarily used for this type of declarative Infrastructure as Code (IaC) provisioning?

   • ATerraform
   • BAzure DevOps
   • CAnsible
   • DPanorama

   Show answer

   Answer: A

   Next question

6. Question 56 · 107 in bank

   Select 2

   An administrator is configuring a site-to-site IPSec VPN and assigns an IP address to the tunnel interface. Which two abilities are enabled by this specific configuration step? (Choose two.)

   • AConfiguring tunnel monitoring to verify the liveliness of the connection.
   • BFirewall performing NAT traversal.
   • CRunning a dynamic routing protocol like OSPF over the tunnel.
   • DFirewall encrypting and decrypting packet payloads.

   Show answer

   Answer: AC

   Next question

7. Question 57 · 107 in bank

   A network engineer observes a pattern of anomalous traffic hitting an external-facing zone, including a high volume of TCP packets that are not part of a new session handshake (non-SYN), and a large number of ICMP fragments. The engineer decides to apply a Zone Protection profile to mitigate these potential threats. Which protection type within the profile must be configured?

   • AProtocol Protection
   • BFlood Protection
   • CReconnaissance Protection
   • DPacket-Based Attack Protection

   Show answer

   Answer: D

   Next question

8. Question 58 · 107 in bank

   An administrator is configuring a GlobalProtect pre-logon VPN. The administrator has already imported the necessary internal certificate authority (CA) certificates for issuing machine certificates onto the firewall. Which configuration is required on the GlobalProtect Gateway to enable pre-logon using these machine certificates?

   • ACreate a device-based Security policy that allows traffic from the pre-logon user to an internal management zone.
   • BCreate an authentication profile that points to the machine certificate's CA and assign it by using the client authentication settings of the GlobalProtect Portal.
   • CCreate a certificate profile that trusts the machine certificate's CA and assign it within the Gateway Agent --> Client Authentication settings.
   • DConfigure the Gateway Agent --> Tunnel Settings to use IPSec with machine certificate authentication for the pre- logon tunnel.

   Show answer

   Answer: C

   Next question

9. Question 59 · 107 in bank

   A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner's Check Point Security Gateway. The partner has provided a specific list of local and remote IP address subnets that are permitted through the tunnel. The initial tunnel configuration on the PAN-OS firewall fails during the IKE Phase 2 exchange. Which configuration step is essential to ensure compatibility with the policy-based Check Point gateway?

   • ADefine the local and remote subnets provided by the partner in the Proxy ID settings.
   • BCreate individual Security policies for each pair of local and remote subnets.
   • CAssign a specific IP address to the tunnel interface to match the Check Point gateway.
   • DEnable Dead Peer Detection (DPD) in the IKE Gateway configuration.

   Show answer

   Answer: A

   Next question

10. Question 60 · 107 in bank

    Select 2

    A network administrator needs to replace the default self-signed certificate on a firewall with one signed by the company's internal certificate authority (CA). Which two firewall features would require this new certificate to be assigned via an SSL/TLS service profile? (Choose two.)

    • AUser-ID agent redistribution
    • BRADIUS server authentication
    • CAuthentication portal
    • DGlobalProtect gateway

    Show answer

    Answer: CD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 51. 107 questions available.