Question 71 · 107 in bank
When an engineer creates a new VSYS on a supported firewall platform, which resource can be explicitly limited in the VSYS configuration to control its capacity?
Show answer
Answer: D
Palo Alto Networks Certified Next-Generation Firewall Engineer107 questions across 11 pages are complete and free, with no account or card.
107 questions in this bank
Free access · progress saved on this device
When an engineer creates a new VSYS on a supported firewall platform, which resource can be explicitly limited in the VSYS configuration to control its capacity?
Answer: D
A large organization has separate production and development environments, each with its own set of firewalls managed by Panorama. The organization uses Cloud Identity Engine (CIE) to consolidate user identities from Active Directory (AD) and Okta. A security mandate requires that development firewalls must only learn about "DEV" and "QA" user groups, while production firewalls should only see "Prod" user groups. How can an administrator enforce this separation using CIE with minimal complexity?
Answer: A
An administrator must perform several actions on a fleet of firewalls from a central Panorama instance. To maintain efficiency, the administrator wants to only perform actions that do not require switching context into each firewall's individual web interface. Which set of actions is available to the administrator directly from the Panorama UI?
Answer: B
A network administrator is configuring an Aggregate Ethernet (AE) interface on an active/passive high availability (HA) pair. To reduce network downtime during a failover, the administrator wants the passive firewall's AE interface to be fully negotiated with the switch before it becomes active. Which Link Aggregation Control Protocol (LACP) setting achieves this administrator's goal?
Answer: B
A firewall administrator needs to configure a new Palo Alto Networks firewall so that its management interface automatically obtains an IP address, netmask, and default gateway from the network. Which command should be executed in the CLI to accomplish this goal?
Answer: C
When multiple routes have the same destination prefix, which attribute does the firewall use first to determine route preference?
Answer: A
An organization must secure its AWS and Azure environments using a managed Palo Alto Networks solution, and all policies must be synchronized from an existing Panorama deployment. The organization wants to insert security with the least possible impact on its application teams and use existing hub-and-spoke network designs. • The AWS environment uses a centralized AWS Transit Gateway (TGW) architecture. • The Azure environment uses a Virtual WAN (vWAN) hub. Which two actions are the most appropriate in this use case? (Choose two.)
Answer: BD
A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit. Which two Security policy requirements must be included in the implementation plan? (Choose two.)
Answer: AC
A network security engineer needs to permit traffic between two distinct VSYS that reside on one Palo Alto Networks firewall. This traffic will not egress the firewall to an external device. Which zone type must be configured to act as the logical source and destination for this traffic flow?
Answer: A
What is the requirement for interface link speeds when configuring a virtual wire on a Palo Alto Networks firewall?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
NGFW-ENGINEER practice, question 71. 107 questions available.
Version 1.0.0. How we source questions