Free Palo Alto Networks Next-Generation Firewall Engineer practice questions

10 free Palo Alto Networks Next-Generation Firewall Engineer practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 121 questions. Work through them, then open each answer to check your reasoning.

Get all 121 questions (US$39) · Download these 10 as a PDF

Question 1

To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers. Resources exist on AWS and Azure:

The AWS deployment is architected with AWS Transit Gateway, to which all resources connect The Azure deployment is architected with each application independently routing traffic The engineer deploying Cloud NGFW in these two cloud environments must account for the following:

Minimize changes to the two cloud environments Scale to the demands of the applications while using the least amount of compute resources Allow the company to unify the Security policies across all protected areas

Which two implementations will meet these requirements? (Choose two.)

  1. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama.
  2. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.
  3. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules.
  4. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.
Show answer and explanation

Correct answer: B, D

B. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama. D. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama. Option B deploys Cloud NGFW for Azure in vNets with updated routing to path traffic through the NGFWs, managed by Panorama for unified policy, this minimizes cloud environment changes while enabling scaling with centralized management. Option D deploys Cloud NGFW for AWS in a centralized Security VPC with Transit Gateway routing through it, also managed by Panorama, this leverages the existing Transit Gateway architecture with minimal changes while providing centralized policy management across both cloud environments. Both solutions unify security policies through Panorama and avoid major architectural redesigns.

Why the other options are wrong

  • A. VM-Series in each VPC creates deployment overhead per VPC and doesn't minimize changes; IPSec tunneling between clouds is less efficient than native cloud integration.
  • C. Using local rules instead of Panorama prevents unified policy management across all protected areas, violating a core requirement.

Question 2

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall.

Which firewall models support this configuration?

  1. PA-5280, PA-7080, PA-3250, VM-Series
  2. PA-455, VM-Series, PA-1410, PA-5450
  3. PA-3260, PA-5410, PA-850, PA-460
  4. PA-7050, PA-1420, VM-Series, CN-Series
Show answer and explanation

Correct answer: A. PA-5280, PA-7080, PA-3250, VM-Series

The PA-5280, PA-7080, PA-3250, and VM-Series are the firewall models that support Advanced Routing Engine (ARE) configuration. These models provide the necessary computational and architectural capabilities to enable the advanced routing functionality required for sophisticated network infrastructures.

Why the other options are wrong

  • B. PA-455, PA-1410, and PA-5450 do not support ARE; only VM-Series from this option supports it.
  • C. PA-3260, PA-5410, PA-850, and PA-460 lack ARE support across the board.
  • D. PA-7050, PA-1420, and CN-Series do not support ARE; only VM-Series from this option qualifies.

Question 3

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third-party gateway? (Choose two.)

  1. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
  2. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
  3. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
  4. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.
Show answer and explanation

Correct answer: C, D

C. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction. D. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy. Option C correctly states that separate security rules must be created for incoming and outgoing traffic through an IPSec tunnel, as each direction requires distinct rule definitions for proper traffic flow control. Option D correctly identifies that IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy, requiring explicit allow rules to be created for the tunnel to function.

Why the other options are wrong

  • A. Creating separate rules for each direction is not optional, it is mandatory for proper IPSec tunnel operation.
  • B. IKE negotiation and IPSec/ESP packets are not allowed by default; they are subject to the interzone default deny policy and require explicit permission.

Question 4

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

  1. It acts as a logging service for NGFW performance metrics.
  2. It orchestrates real-time traffic inspection for network segments.
  3. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.
  4. It manages threat intelligence data synchronization with NGFWs.
Show answer and explanation

Correct answer: C. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.

NGFW deployment. Terraform functions as an Infrastructure-as-Code (IaC) tool that automates the deployment of Palo Alto Networks NGFWs by codifying infrastructure configurations, enabling repeatable and consistent deployments across cloud environments.

Why the other options are wrong

  • A. Terraform is not a logging service; NGFW performance metrics are handled by native logging and analytics services.
  • B. Terraform does not orchestrate real-time traffic inspection; that is the NGFW's function.
  • D. Terraform does not manage threat intelligence synchronization; that is handled by threat intelligence services and the NGFW itself.

Question 5

By default, which type of traffic is configured by service route configuration to use the management interface?

  1. Security zone
  2. IPSec tunnel
  3. Virtual system (VSYS)
  4. Autonomous Digital Experience Manager (ADEM)
Show answer and explanation

Correct answer: D. Autonomous Digital Experience Manager (ADEM)

By default, service route configuration directs Autonomous Digital Experience Manager (ADEM) traffic to use the management interface, ensuring administrative and monitoring traffic is segregated from data plane traffic.

Why the other options are wrong

  • A. Security zones are traffic classification constructs, not traffic types configured by service routes.
  • B. IPSec tunnel traffic is configured separately through tunnel configurations, not service routes.
  • C. Virtual systems (VSYS) are logical firewall partitions, not a traffic type managed by service routes.

Question 6

In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

  1. License
  2. Plugin
  3. Content update
  4. General setting
Show answer and explanation

Correct answer: A. License

The ARE license must be enabled first before configuring a logical router on a PAN-OS firewall, as this license is the foundational requirement that activates the Advanced Routing Engine feature set.

Why the other options are wrong

  • B. Plugins are not prerequisites for ARE configuration; the license is the primary requirement.
  • C. Content updates support operational security but are not a prerequisite for ARE enablement.
  • D. General settings are configuration details that follow after the license is activated, not a prerequisite.

Question 7

Which two zone types are valid when configuring a new security zone? (Choose two.)

  1. Tunnel
  2. Intrazone
  3. Internal
  4. Virtual Wire
Show answer and explanation

Correct answer: A, D

A. Tunnel D. Virtual Wire Tunnel and Virtual Wire are both valid zone types when configuring a new security zone. Tunnel zones are used for IPSec and other encrypted tunnel traffic, while Virtual Wire zones support transparent firewall modes where the firewall operates as a Layer 2 bridge.

Why the other options are wrong

  • B. Intrazone is not a zone type; it refers to traffic flowing within the same zone.
  • C. Internal is not a valid zone type in Palo Alto Networks security zone configuration.

Question 8

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi- factor authentication (MFA) for user logon.

How does the GlobalProtect agent process the authentication flow on Windows endpoints?

  1. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
  2. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
  3. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
  4. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.
Show answer and explanation

Correct answer: A. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.

to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access. In a hybrid authentication model, the GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel for device identity validation, then prompts the user for SAML- based MFA credentials upon sign-in to validate user identity, ensuring both device and user are authenticated before granting full access.

Why the other options are wrong

  • B. Reusing the machine certificate for user authentication without MFA defeats the purpose of multi-factor authentication and does not meet the hybrid model requirements.
  • C. Windows Credential Provider details cannot substitute for SAML-based MFA; the system must explicitly prompt the user for SAML credentials.
  • D. The pre-logon certificate authentication is not redundant; it establishes device identity before user logon, which is a core component of the hybrid model.

Question 9

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.

Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

  1. Modify all active Log Forwarding profiles to select the “Cloud Logging” option in each profile match list in the appropriate device groups.
  2. Enable the “Panorama/Cloud Logging” option in the Logging and Reporting Settings section under Device –> Setup –> Management in the appropriate templates.
  3. Select the “Enable Duplicate Logging” option in the Cloud Logging section under Device –> Setup –> Management in the appropriate templates.
  4. Select the “Enable Cloud Logging” option in the Cloud Logging section under Device –> Setup –> Management in the appropriate templates.
Show answer and explanation

Correct answer: D. Select the “Enable Cloud Logging” option in the Cloud Logging section under Device –> Setup –> Management in the appropriate templates.

Cloud Logging section under Device –> Setup –> Management in the appropriate templates. To enable logs to be sent to Strata Logging Service while maintaining forwarding to Panorama log collectors, the 'Enable Cloud Logging' option must be selected in the Cloud Logging section under Device –> Setup –> Management in the appropriate templates. This setting activates dual-path logging, allowing simultaneous transmission to both the cloud service and on-premises collectors without requiring modifications to Log Forwarding profiles or duplicate logging flags.

Why the other options are wrong

  • A. Log Forwarding profiles handle local log destinations but do not control cloud logging enablement.
  • B. The 'Panorama/Cloud Logging' option is not the correct setting; cloud logging is enabled through the dedicated Cloud Logging section.
  • C. The 'Enable Duplicate Logging' option is not necessary; standard cloud logging enables dual forwarding automatically.

Question 10

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.

Which action taken by the engineer will resolve this issue?

  1. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.
  2. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
  3. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
  4. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.
Show answer and explanation

Correct answer: B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.

and configure a policy that allows traffic within the VLAN. When multiple Layer 2 interfaces are assigned to the same VLAN but clients cannot communicate, the interfaces must be assigned to the same Layer 2 zone, and a Security policy must be configured to permit traffic within that zone. Layer 2 switching occurs at the zone level, and without an explicit allow policy, traffic between interfaces within the same VLAN is blocked by the firewall's default deny posture.

Why the other options are wrong

  • A. IP routing contradicts Layer 2 switching; Layer 2 interfaces do not require routing, only zone assignment and security policies.
  • C. Configuring policies for interfaces not assigned to the same zone is unnecessary when all interfaces share the same zone and VLAN.
  • D. IP routing is not applicable to Layer 2 interfaces; the issue is resolved through zone assignment and intra-zone security policies.

That was 10 of 121.

The full Palo Alto Networks Next-Generation Firewall Engineer pack has all 121 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack