Free Palo Alto Networks Next-Generation Firewall Engineer Practice Questions

Question 1

To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers. Resources exist on AWS and Azure:

• The AWS deployment is architected with AWS Transit Gateway, to which all resources connect.

• The Azure deployment is architected with each application independently routing traffic.

The engineer deploying Cloud NGFW in these two cloud environments must account for the following:

• Minimize changes to the two cloud environments.

• Scale to the demands of the applications while using the least amount of compute resources.

• Allow the company to unify the Security policies across all protected areas.

Which two implementations will meet these requirements? (Choose two.)

1. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama.
2. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.
3. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules.
4. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.

Question 2

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall.

Which firewall models support this configuration?

1. PA-5280, PA-7080, PA-3250, VM-Series
2. PA-455, VM-Series, PA-1410, PA-5450
3. PA-3260, PA-5410, PA-850, PA-460
4. PA-7050, PA-1420, VM-Series, CN-Series

Question 3

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third-party gateway? (Choose two.)

1. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
2. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
3. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
4. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.

Question 4

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

1. It acts as a logging service for NGFW performance metrics.
2. It orchestrates real-time traffic inspection for network segments.
3. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.
4. It manages threat intelligence data synchronization with NGFWs.

Question 5

By default, which type of traffic is configured by service route configuration to use the management interface?

1. Security zone
2. IPSec tunnel
3. Virtual system (VSYS)
4. Autonomous Digital Experience Manager (ADEM)

Question 6

In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

1. License
2. Plugin
3. Content update
4. General setting

Question 7

Which two zone types are valid when configuring a new security zone? (Choose two.)

1. Tunnel
2. Intrazone
3. Internal
4. Virtual Wire

Question 8

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.

How does the GlobalProtect agent process the authentication flow on Windows endpoints?

1. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
2. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
3. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
4. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.

Question 9

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.

Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

1. Modify all active Log Forwarding profiles to select the “Cloud Logging” option in each profile match list in the appropriate device groups.
2. Enable the “Panorama/Cloud Logging” option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.
3. Select the “Enable Duplicate Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
4. Select the “Enable Cloud Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.

Question 10

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.

Which action taken by the engineer will resolve this issue?

1. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.
2. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
3. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
4. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Question 11

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.

Which of the following actions will resolve this issue?

1. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface.
2. Configure the Proxy IDs to match the Cisco ASA configuration.
3. Check that IPSec is enabled in the management profile on the external interface.
4. Validate the tunnel interface VLAN against the peer’s configuration.

Question 12

When an engineer creates a new VSYS on a supported firewall platform, which resource can be explicitly limited in the VSYS configuration to control its capacity?

1. Dedicated dataplane memory
2. Maximum number of admin accounts
3. Maximum number of log entries
4. Maximum number of NAT rules

Question 13

Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)

1. Select IKE v2, enable the Advanced Options > PQ PPK, then set a 64+ character string for the post-quantum pre shared key.
2. Ensure Authentication is set to “certificate,” then import a post-quantum derived certificate.
3. Select IKE v2 Preferred, enable the Advanced Options > PQ KEM, then add one or more “Rounds.”
4. Select IKE v2, enable the Advanced Options > PQ KEM, then create an IKE Crypto Profile with Advanced Options adding one or more “Rounds.”

Question 14

What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?

1. Scanning, Isolation, Whitelisting, Logging
2. Discovery, Deployment, Detection, Prevention
3. Policy Generation, Discovery, Enforcement, Logging
4. Profiling, Policy Generation, Enforcement, Reporting

Question 15

Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

1. Import the new subordinate CA certificate into the trust stores of all client devices.
2. Set the subordinate CA certificate as the default routing certificate for all network traffic.
3. Configure the subordinate CA to issue certificates with indefinite validity periods.
4. Disable all existing SSL decryption rules until the new certificate is fully propagated.

Question 16

An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS, Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-west traffic within each cluster, maintain consistent Security policies across all environments, and dynamically scale as containerized workloads spin up or down. They also plan to use a centralized Panorama instance for policy management and visibility.

Which approach meets these requirements?

1. Install standalone CN-Series instances in each cluster with local configuration only. Export daily policy configuration snapshots to Panorama for recordkeeping, but do not unify policy enforcement.
2. Configure the CN-Series only in public cloud clusters, and rely on Kubernetes Network Policies for on-premises cluster security. Synchronize partial policy information into Panorama manually as needed.
3. Use Kubernetes-native deployment tools (e.g., Helm) to deploy CN-Series in each cluster, ensuring local insertion into the service mesh or CNI. Manage all CN-Series firewalls centrally from Panorama, applying uniform Security policies across on-premises and cloud clusters.
4. Deploy a single CN-Series firewall in the on-premises data center to process traffic for all clusters, connecting remote clusters via VPN or peering. Manage this single instance through Panorama.

Question 17

Which CLI command is used to configure the management interface as a DHCP client?

1. set network dhcp interface management
2. set network dhcp type management-interface
3. set deviceconfig system type dhcp-client
4. set deviceconfig management type dhcp-client

Question 18

A government agency needs to ensure that all user web access is explicitly mediated and authenticated. The agency has the following requirements:

• Client browsers must be manually configured to send traffic to the firewall's IP address and a specific port.

• The firewall must support seamless single sign-on (SSO) with the users' existing Active Directory credentials.

Which feature set should the engineer configure to meet the agency's requirements?

1. Web proxy in explicit mode with an Authentication policy by using Kerberos
2. Decryption policy that redirects users to a SAML identity provider for authentication
3. Web proxy in transparent mode with an Authentication policy by using multi-factor authentication (MFA)
4. User-ID agent integration with Authentication Portal for authentication

Question 19

A network security engineer is reviewing the dynamic update settings for a fleet of firewalls in a financial institution that has a policy prioritizing operational stability above all else. The engineer notes that the current content update threshold is set to 24 hours.

Following the Palo Alto Networks recommended best practices for mission-critical deployments, which adjustment should be made to the threshold?

1. Change to "download only" and schedule manual installation.
2. Increase to 48 hours.
3. Decrease to 12 hours.
4. Reset to reconfirm 24 hours.

Question 20

Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)

1. NAT tables
2. User Authentication
3. GlobalProtect Gateways
4. GlobalProtect Portal

Question 21

An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned.

The company wants both authentication types to be running in parallel during the transition to SAML.

Which two actions meet the criteria? (Choose two.)

1. Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
2. Create an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.
3. Create and apply an authentication profile with the “SAML Identity Provider” Server Profile.
4. Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.

Question 22

Which networking technology can be configured on Layer 3 interfaces but not on Layer 2 interfaces?

1. DDNS
2. Link Duplex
3. NetFlow
4. LLDP

Question 23

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.

What function do certificate profiles serve in this context?

1. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
2. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
3. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication.
4. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.

Question 24

A network engineer observes a pattern of anomalous traffic hitting an external-facing zone, including a high volume of TCP packets that are not part of a new session handshake (non-SYN), and a large number of ICMP fragments. The engineer decides to apply a Zone Protection profile to mitigate these potential threats.

Which protection type within the profile must be configured?

1. Protocol Protection
2. Flood Protection
3. Reconnaissance Protection
4. Packet-Based Attack Protection

Question 25

In a hybrid cloud deployment, what is the primary function of Ansible in managing Palo Alto Networks NGFWs?

1. It provides a web interface for managing NGFW hardware clusters.
2. It enables centralized log collection and correlation for NGFWs.
3. It facilitates dynamic updates to NGFW threat databases.
4. It automates NGFW policy updates and configurations through playbooks.

Question 26

When deploying Palo Alto Networks NGFWs in a cloud service provider (CSP) environment, which method ensures high availability (HA) across multiple availability zones?

1. Deploying Ansible scripts for zone-specific scaling
2. Implementing Terraform templates for redundancy within one availability zone
3. Using load balancer and health probes
4. Configuring active/active HA

Question 27

What must be configured before a firewall administrator can define policy rules based on users and groups?

1. User Mapping profile
2. Authentication profile
3. Group mapping settings
4. LDAP Server profile

Question 28

Which set of options is available for detailed logs when building a custom report on a Palo Alto Networks NGFW?

1. Traffic, User-ID, URL
2. Traffic, threat, data filtering, User-ID
3. GlobalProtect, traffic, application statistics
4. Threat, GlobalProtect, application statistics, WildFire submissions

Question 29

An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an access route. Users report that public web browsing works, but they cannot resolve the names of internal servers. The administrator determines that all DNS queries are being sent to the public DNS servers configured on the users' endpoints.

Which GlobalProtect portal setting should be configured to resolve this issue?

1. Split tunneling for DNS and specify the internal corporate domains in the "Domain" list
2. DNS Proxy feature on the firewall to point clients to the gateway IP for DNS
3. "DNS Forwarding" option on the gateway's tunnel interface
4. NAT rule to allow DNS traffic from the GlobalProtect clients to the internal DNS servers

Question 30

Which PAN-OS method of mapping users to IP addresses is the most reliable?

1. Port mapping
2. GlobalProtect
3. Syslog
4. Server monitoring

Question 31

What is the purpose of assigning an Admin Role Profile to a user in a Palo Alto Networks NGFW?

1. Allow access to all resources without restrictions.
2. Enable multi-factor authentication (MFA) for administrator access.
3. Define granular permissions for management tasks.
4. Restrict access to sensitive report data.

Question 32

Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?

1. Restarting the local firewall, running a packet capture, accessing the firewall CLI
2. Modification of local security rules, modification of a Layer 3 interface, modification of the firewall device hostname
3. Modification of pre-security rules, modification of a virtual router, modification of an IKE Gateway Network Profile
4. Modification of post NAT rules, creation of new views on the local firewall ACC tab, creation of local custom reports

Question 33

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

1. Flood Protection
2. Protocol Protection
3. Packet-Based Attack Protection
4. Reconnaissance Protection

Question 34

A network administrator is establishing a site-to-site VPN between a Palo Alto Networks firewall and a partner's Check Point Security Gateway.

The partner has provided a specific list of local and remote IP address subnets that are permitted through the tunnel. The initial tunnel configuration on the PAN-OS firewall fails during the IKE Phase 2 exchange.

Which configuration step is essential to ensure compatibility with the policy-based Check Point gateway?

1. Define the local and remote subnets provided by the partner in the Proxy ID settings.
2. Create individual Security policies for each pair of local and remote subnets.
3. Assign a specific IP address to the tunnel interface to match the Check Point gateway.
4. Enable Dead Peer Detection (DPD) in the IKE Gateway configuration.

Question 35

What is the correct sequence of evaluation for Security policy rulebases?

1. Panorama Pre-Rules --> Local Firewall Rules --> Panorama Post-Rules
2. Panorama Post-Rules --> Panorama Pre-Rules --> Local Firewall Rules
3. Panorama Shared Rules --> Local Firewall Rules --> Device Group Rules
4. Local Firewall Rules --> Panorama Pre-Rules --> Panorama Post-Rules

Question 36

An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to transition between zones without leaving the firewall (no external physical connections). The interfaces for each VSYS are assigned to separate virtual routers (VRs), and inter-VR static routes have been configured. An external zone has been created correctly for each VSYS.

Security policies have been added to permit the desired traffic between each zone and its respective external zone. However, the desired traffic is still unable to successfully pass from one VSYS to the other in either direction.

Which additional configuration task is required to resolve this issue?

1. Create a transit VSYS and route all inter-VSYS traffic through it.
2. Add each VSYS to the list of visible virtual systems of the other VSYS.
3. Enable the “allow inter-VSYS traffic” option in both external zone configurations.
4. Create Security policies to allow the traffic between the two external zones.