Free Paloalto Networks NGFW-Engineer Practice Exam with Questions & Answers

Basic Concept: In SSL Forward Proxy, the Decryption profile controls certificate validation behavior for server certificates, including revocation checks.

Why C is Correct: The Decryption profile is where OCSP/CRL certificate revocation checking behavior is defined for decrypted outbound sessions.

Why A is Wrong: Certificate revocation checking is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Why B is Wrong: SSL/TLS service profile is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Why D is Wrong: Forward trust certificate is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Basic Concept: Policy-based third-party VPN gateways require matching traffic selectors. PAN-OS represents those selectors as Proxy IDs under the IPSec tunnel configuration.

Why A is Correct: Defining local and remote subnets in Proxy ID settings aligns PAN-OS with the Check Point encryption domain and resolves Phase 2 failures.

Why B is Wrong: Create individual Security policies for each pair of local and remote subnets. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why C is Wrong: Assign a specific IP address to the tunnel interface to match the Check Point gateway. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why D is Wrong: Enable Dead Peer Detection (DPD) in the IKE Gateway configuration. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Basic Concept: VSYS capacity controls include maximum counts for certain policy and object resources. They prevent one VSYS from consuming too much configuration capacity.

Why D is Correct: A maximum number of NAT rules is a valid configurable resource limit from the listed options.

Why A is Wrong: Dedicated data plane memory mentions a VSYS, zone, or routing concept, but it does not satisfy the specific external-zone, visibility, or resource-control requirement for this virtual system design.

Why B is Wrong: Maximum number of admin accounts mentions a VSYS, zone, or routing concept, but it does not satisfy the specific external-zone, visibility, or resource-control requirement for this virtual system design.

Why C is Wrong: Maximum number of log entries mentions a VSYS, zone, or routing concept, but it does not satisfy the specific external-zone, visibility, or resource-control requirement for this virtual system design.

Basic Concept: Panorama supports central configuration tasks without context switch. Operational actions that query live device state or configure local runtime views require firewall context.

Why C is Correct: Editing a post-rule, creating a certificate profile, and configuring hostname are Panorama-managed tasks available from the Panorama UI.

Why A is Wrong: Download and install a new content update. View current firewall session details. Initiate a device reboot. is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Why B is Wrong: Create a new zone. Configure a new virtual router. View the local ACC on the firewall. is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Why D is Wrong: Modify the IP address of a Layer 3 interface. Configure a new local administrator account. Edit a pre-rule. is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Basic Concept: Terraform is normally used for infrastructure provisioning, while Ansible is better suited for post-deployment configuration management.

Why B is Correct: Deploying the VM and network interfaces is the Terraform part of the workflow because it defines cloud or virtualization infrastructure resources.

Why A is Wrong: Pushing threat intelligence updates to the new firewall is an automation or management concept, but it performs a different role than the requested IaC provisioning, playbook configuration, or API object operation.

Why C is Wrong: Storing the credentials needed to access the vSphere environment is an automation or management concept, but it performs a different role than the requested IaC provisioning, playbook configuration, or API object operation.

Why D is Wrong: Applying the detailed Security policies and objects is an automation or management concept, but it performs a different role than the requested IaC provisioning, playbook configuration, or API object operation.

Basic Concept: Layer 2 interfaces in the same VLAN still depend on zone assignment and intrazone/interzone policy. Same-zone traffic is allowed by intrazone-default unless changed.

Why B is Correct: Placing all three Layer 2 interfaces in the same Layer 2 zone allows same-VLAN communication by default.

Why A is Wrong: Create an Aggregate Ethernet (AE) group that includes all three interfaces. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Create an "allow" Security policy with the source and destination VLAN set to "VLAN 20". is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: Create a Layer 3 subinterface for VLAN 20 to enable routing. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Basic Concept: Zone Protection profiles group defenses by attack type. Packet-based attack protection drops malformed packets, spoofing, abnormal TCP handshakes, and other packet-level evasion attempts.

Why C is Correct: Packet-Based Attack Protection is the correct section for spoofed IP packets and split-handshake attempts because these are structural packet/session abuses, not volume floods or scans.

Why A is Wrong: Flood Protection is a Zone Protection category, but it protects a different attack family than the packet-level or flood/reconnaissance behavior described.

Why B is Wrong: Protocol Protection is a Zone Protection category, but it protects a different attack family than the packet-level or flood/reconnaissance behavior described.

Why D is Wrong: Reconnaissance Protection is a Zone Protection category, but it protects a different attack family than the packet-level or flood/reconnaissance behavior described.

Basic Concept: CIE segments provide filtered identity datasets and redistribute them only to selected firewall populations.

Why B is Correct: Segments are designed for this partitioning requirement: internal firewalls receive employee identities and DMZ firewalls receive partner identities.

Why A is Wrong: Panorama templates, which can be used to push different User-ID agent configurations to each firewall group is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.

Why C is Wrong: Multiple tenants, where a separate CIE tenant is required for each user directory to maintain isolation is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.

Why D is Wrong: Directory sync filtering, which is used at the source to prevent specific OUs from being imported into CIE is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.

Basic Concept: Strata Logging Service can receive logs from Panorama-managed firewalls while existing on-premises Panorama log collection is retained. Dual forwarding requires duplicate logging rather than replacing the existing destination.

Why C is Correct: Enable Duplicate Logging is correct because it sends copies to both Strata Logging Service and Panorama/on-premises log collectors instead of moving logs only to the cloud.

Why A is Wrong: Changing Log Forwarding profile match lists is not the required global/template step for preserving both cloud and on-premises log destinations.

Why B is Wrong: The named option is not the duplicate logging control required to send a copy of logs to both locations.

Why D is Wrong: Enable Cloud Logging sends logs to Strata Logging Service, but by itself it does not preserve on-premises Panorama log collector delivery.

Basic Concept: User- and group-based Security policy requires the firewall to retrieve group membership from a directory. The LDAP server profile defines how PAN-OS connects to that directory source.

Why D is Correct: The LDAP Server profile is required first because group mapping and user/group selection depend on a working LDAP connection to the directory.

Why A is Wrong: User Mapping profile is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why B is Wrong: Authentication profile is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Group mapping settings is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.