NGFW-ENGINEER practice questions 61–70

1. Question 61 · 107 in bank

   Which method creates the most reliable user-to-IP mapping due to being based on a direct authentication from the user's device to the firewall?

   • APortal authentication
   • BPAN-OS XML API to push mappings
   • CPolling security event logs with a User-ID agent
   • DAuthentication logs from Syslog receiver

   Show answer

   Answer: A

   Next question

2. Question 62 · 107 in bank

   An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an access route. Users report that public web browsing works, but they cannot resolve the names of internal servers. The administrator determines that all DNS queries are being sent to the public DNS servers configured on the users' endpoints. Which GlobalProtect portal setting should be configured to resolve this issue?

   • ASplit tunneling for DNS and specify the internal corporate domains in the "Domain" list
   • BDNS Proxy feature on the firewall to point clients to the gateway IP for DNS
   • C"DNS Forwarding" option on the gateway's tunnel interface
   • DNAT rule to allow DNS traffic from the GlobalProtect clients to the internal DNS servers

   Show answer

   Answer: A

   Next question

3. Question 63 · 107 in bank

   Which initial action is required to configure logical routers?

   • AChanging the virtual router type from "default" to "advanced"
   • BActivating an advanced routing subscription
   • CCommitting a new advanced routing software module
   • DChecking "advanced routing" in general settings

   Show answer

   Answer: D

   Next question

4. Question 64 · 107 in bank

   A network security engineer at a 24/7 online retailer is upgrading an active/passive high availability (HA) cluster of PAN-OS firewalls. The primary goal is to perform the upgrade with no service interruption to online transactions. The engineer has already downloaded the new software to both devices. Which sequence of actions will meet this requirement?

   • AFrom Panorama, create a scheduled software update job targeting both firewalls in the HA pair to run at the same time, then rely on the HA election process to manage the failover automatically.
   • BUpgrade the passive firewall first while it is still in the passive state. Once it reboots and is operational, suspend the active firewall to fail over to the newly upgraded device. Then, upgrade the remaining firewall.
   • CForce the active firewall into a suspended state to trigger a failover, then upgrade and reboot it. Suspend the currently active firewall to fail traffic back to the upgraded unit. Upgrade the remaining firewall.
   • DDisable HA synchronization on the active firewall, upgrade the passive firewall, and then re-enable synchronization. Once synchronized, repeat the process on the other firewall.

   Show answer

   Answer: C

   Next question

5. Question 65 · 107 in bank

   A government agency needs to ensure that all user web access is explicitly mediated and authenticated. The agency has the following requirements: • Client browsers must be manually configured to send traffic to the firewall's IP address and a specific port. • The firewall must support seamless single sign-on (SSO) with the users' existing Active Directory credentials. Which feature set should the engineer configure to meet the agency's requirements?

   • AWeb proxy in explicit mode with an Authentication policy by using Kerberos
   • BDecryption policy that redirects users to a SAML identity provider for authentication
   • CWeb proxy in transparent mode with an Authentication policy by using multi-factor authentication (MFA)
   • DUser-ID agent integration with Authentication Portal for authentication

   Show answer

   Answer: A

   Next question

6. Question 66 · 107 in bank

   A network security engineer is reviewing the dynamic update settings for a fleet of firewalls in a financial institution that has a policy prioritizing operational stability above all else. The engineer notes that the current content update threshold is set to 24 hours. Following the Palo Alto Networks recommended best practices for mission-critical deployments, which adjustment should be made to the threshold?

   • AChange to "download only" and schedule manual installation.
   • BIncrease to 48 hours.
   • CDecrease to 12 hours.
   • DReset to reconfirm 24 hours.

   Show answer

   Answer: B

   Next question

7. Question 67 · 107 in bank

   What is the correct sequence of evaluation for Security policy rulebases?

   • APanorama Pre-Rules --> Local Firewall Rules --> Panorama Post-Rules
   • BPanorama Post-Rules --> Panorama Pre-Rules --> Local Firewall Rules
   • CPanorama Shared Rules --> Local Firewall Rules --> Device Group Rules
   • DLocal Firewall Rules --> Panorama Pre-Rules --> Panorama Post-Rules

   Show answer

   Answer: A

   Next question

8. Question 68 · 107 in bank

   An administrator needs to ensure that a firewall can download threat prevention and software updates, but the management port is on an isolated network without internet access. Which service must be rerouted through a data plane interface using a service route to allow the firewall to download these updates?

   • AExternal dynamic lists
   • BGlobalProtect Clientless VPN
   • CPalo Alto Networks Services
   • DSyslog

   Show answer

   Answer: C

   Next question

9. Question 69 · 107 in bank

   An organization is adopting an Infrastructure as Code (IaC) approach to manage its entire network environment, including its Palo Alto Networks firewalls. The organization has chosen Ansible as its primary tool for this initiative. How does Ansible enable an IaC model for managing this organization's firewalls?

   • ABy providing real-time threat intelligence feeds directly to the firewalls' data plane
   • BBy providing a graphical user interface that simplifies the creation of security policies through a drag-and-drop interface
   • CBy automatically discovering and mapping all network devices to generate a baseline configuration
   • DBy defining firewall configurations in playbooks that can be version-controlled and executed repeatedly

   Show answer

   Answer: D

   Next question

10. Question 70 · 107 in bank

    A network security engineer wants to create Security policy rules that allow or deny traffic based on a user's department, which corresponds to groups in the company's Active Directory. To achieve this, the firewall needs to retrieve group information from the directory server. Which configuration object must be created first to establish the connection with the Active Directory server?

    • ALDAP server profile
    • BUser-ID agent service account
    • CAuthentication sequence
    • DKerberos server profile

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 61. 107 questions available.