Free Paloalto Networks NGFW-Engineer Practice Exam with Questions & Answers | Set: 2

Basic Concept: Panorama Log Collector Groups have model and storage design restrictions. Collectors in a single group must be compatible so log distribution and redundancy work predictably.

Why C is Correct: All Log Collectors in one Collector Group must run on the same Panorama model, which prevents mixed-capacity or unsupported collector group designs.

Why A is Wrong: Log redundancy is available only if each Log Collector has the same amount of total disk storage. is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Why B is Wrong: Enabling redundancy increases the log processing traffic in a Collector Group by 50%. is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Why D is Wrong: The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares. is related to management or logging, but it does not provide the required Panorama operation, rule hierarchy behavior, or dual-log forwarding outcome.

Basic Concept: Virtual wire binds two physical interfaces into an inline transparent pair. The two interfaces must have compatible Layer 1 characteristics.

Why C is Correct: Same link speed and transmission mode are required so the virtual wire can bridge traffic correctly between the paired interfaces.

Why A is Wrong: They must be configured with auto-negotiate settings regardless of the port type. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why B is Wrong: They must all be either copper or fiber optic, however they can be different. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: They must be the same media type. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Basic Concept: GlobalProtect pre-logon uses machine identity before user login, while user logon can use SAML/MFA against a cloud IdP.

Why D is Correct: Certificate-based authentication for pre-logon plus SAML for user logon satisfies both endpoint management before login and MFA-protected user authentication.

Why A is Wrong: Cookies can reduce repeated prompts after authentication, but cookie-based authentication does not prove machine identity before user logon or provide cloud IdP MFA for user logon.

Why B is Wrong: SAML is user-centric and requires an interactive identity flow, so it is not appropriate for machine pre-logon before a user session exists.

Why C is Wrong: Kerberos can provide AD-based SSO, but a single Kerberos profile does not meet cloud IdP MFA and machine-certificate pre-logon requirements.

Basic Concept: AI Runtime Security: Network Intercept follows a lifecycle from discovering AI traffic, deploying interception, detecting risks, and preventing unsafe behavior.

Why B is Correct: Discovery, Deployment, Detection, and Prevention match the operational phases of the Palo Alto Networks AI Runtime Security intercept approach.

Why A is Wrong: Scanning, Isolation, Whitelisting, Logging is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Policy Generation, Discovery, Enforcement, Logging is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: Profiling, Policy Generation, Enforcement, Reporting is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Basic Concept: An IPSec VPN on PAN-OS involves two distinct flows: control-plane tunnel negotiation to the firewall and data-plane traffic entering or leaving the tunnel security zone. Both are enforced by Security policy.

Why C and D are Correct: The corrected answer reflects that data traffic initiated in either direction must be permitted by matching zone-based rules, and IKE/IPSec negotiation to the firewall/local zone is not simply allowed by intrazone-default.

Why A is Wrong: PAN-OS is stateful for return traffic, but if both sides must initiate new sessions through the VPN, directional policies are required for each relevant source and destination zone.

Why B is Wrong: IKE and IPSec/ESP negotiation traffic to the firewall is not simply covered by intrazone-default allow. It must match a Security policy between the peer-facing zone and the firewall local endpoint.

Basic Concept: Terraform is designed for declarative Infrastructure as Code. It describes desired infrastructure resources and lets the provider create them repeatedly and predictably.

Why A is Correct: Terraform is correct for defining virtual networks, subnets, and VM-Series instances in code with version-controlled deployment consistency.

Why B is Wrong: Azure DevOps is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Ansible is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: Panorama is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Basic Concept: Azure zone resilience for VM-Series is normally achieved with multiple firewall instances across Availability Zones and Azure load balancing, not PAN-OS HA links across zones.

Why A is Correct: Deploying independent firewalls in different zones behind an Azure Load Balancer keeps traffic available if one zone fails.

Why B is Wrong: Implement a Terraform configuration that automatically redeploys the firewall in a new zone if the original one fails. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.

Why C is Wrong: Use Azure Traffic Manager to direct traffic to a primary VM-Series firewall, with a second firewall in another zone as a failover target. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.

Why D is Wrong: Configure PAN-OS active/passive high availability (HA) between two VM-Series instances in separate Availability Zones using HA links over a VNet peering connection. is a cloud deployment or routing approach, but it does not match the required managed insertion model, resilience pattern, or Panorama-controlled policy design in this scenario.

Basic Concept: Authentication sequences provide ordered fallback across authentication profiles. A new server profile must exist before an authentication profile can reference it.

Why C and D are Correct: Creating the Kerberos authentication profile and placing it first in an authentication sequence before LDAP implements the requested fallback.

Why A is Wrong: Configure a new RADIUS proxy on the firewall to handle authentication requests for both Kerberos and LDAP. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Why B is Wrong: Implement a User-ID Group Mapping policy to link users between the LDAP and Kerberos directories. is associated with authentication, PKI, or TLS configuration, but it is not the object or step that enforces the certificate validation or service identity requirement being tested.

Basic Concept: A tunnel interface IP address enables Layer 3 functions that require the firewall to source or receive traffic over the tunnel itself.

Why A and C are Correct: Tunnel monitoring and dynamic routing require an IP address on the tunnel interface; encryption and NAT traversal do not depend on that address.

Why B is Wrong: Firewall performing NAT traversal. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Why D is Wrong: Firewall encrypting and decrypting packet payloads. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.

Basic Concept: Ansible automates configuration tasks through playbooks. In NGFW environments it is used after infrastructure exists to push policy objects, device settings, and repeatable configuration changes.

Why D is Correct: Playbook-driven policy and configuration updates are the correct Ansible use case; Ansible does not act as log collection, threat database delivery, or a web interface.

Why A is Wrong: It provides a web interface for managing NGFW hardware clusters. is an automation or management concept, but it performs a different role than the requested IaC provisioning, playbook configuration, or API object operation.

Why B is Wrong: It enables centralized log collection and correlation for NGFWs. is an automation or management concept, but it performs a different role than the requested IaC provisioning, playbook configuration, or API object operation.

Why C is Wrong: It facilitates dynamic updates to NGFW threat databases. is an automation or management concept, but it performs a different role than the requested IaC provisioning, playbook configuration, or API object operation.