Palo Alto Networks Certified Next-Generation Firewall Engineer practice questions

1. Question 1 of 25

   Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

   • AIt acts as a logging service for NGFW performance metrics.
   • BIt orchestrates real-time traffic inspection for network segments.
   • CIt provides Infrastructure-as-Code (IaC) to automate NGFW deployment.
   • DIt manages threat intelligence data synchronization with NGFWs.

   Show answer

   Correct answer: C

   How others answered

   • C100%

2. Question 2 of 25

   Select 2

   To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers. Resources exist on AWS and Azure: The AWS deployment is architected with AWS Transit Gateway, to which all resources connect The Azure deployment is architected with each application independently routing traffic The engineer deploying Cloud NGFW in these two cloud environments must account for the following: Minimize changes to the two cloud environments Scale to the demands of the applications while using the least amount of compute resources Allow the company to unify the Security policies across all protected areas Which two implementations will meet these requirements? (Choose two.)

   • ADeploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama.
   • BDeploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.
   • CDeploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules.
   • DDeploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.

   Show answer

   Correct answer: B, D

   How others answered

   • BD100%

3. Question 3 of 25

   Select 2

   Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)

   • AFor incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
   • BThe IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
   • CFor incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
   • DThe IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.

   Show answer

   Correct answer: A, B

   How others answered

   • AB52%
   • CD26%
   • BC13%
   • AC4%
   • BD4%

   Only 52% agreed on this answer — treat it as contested rather than settled.

4. Question 4 of 25

   During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall. Which firewall models support this configuration?

   • APA-5280, PA-7080, PA-3250, VM-Series
   • BPA-455, VM-Series, PA-1410, PA-5450
   • CPA-3260, PA-5410, PA-850, PA-460
   • DPA-7050, PA-1420, VM-Series, CN-Series

   Show answer

   Correct answer: A

   How others answered

   • A45%
   • B29%
   • D23%
   • C3%

   Only 45% agreed on this answer — treat it as contested rather than settled.

5. Question 5 of 25

   By default, which type of traffic is configured by service route configuration to use the management interface?

   • ASecurity zone
   • BIPSec tunnel
   • CVirtual system (VSYS)
   • DAutonomous Digital Experience Manager (ADEM)

   Show answer

   Correct answer: D

   How others answered

   • D100%

6. Question 6 of 25

   In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

   • ALicense
   • BPlugin
   • CContent update
   • DGeneral setting

   Show answer

   Correct answer: D

   How others answered

   • D75%
   • A25%

7. Question 7 of 25

   Select 2

   Which two zone types are valid when configuring a new security zone? (Choose two.)

   • ATunnel
   • BIntrazone
   • CInternal
   • DVirtual Wire

   Show answer

   Correct answer: A, D

   How others answered

   • AD100%

8. Question 8 of 25

   An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon. How does the GlobalProtect agent process the authentication flow on Windows endpoints?

   • AThe GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
   • BThe GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
   • COnce the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
   • DGlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.

   Show answer

   Correct answer: A

   How others answered

   • A100%

9. Question 9 of 25

   An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other. Which action taken by the engineer will resolve this issue?

   • AConfigure each interface to belong to the same Layer 2 zone and enable IP routing between them.
   • BAssign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
   • CAssign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
   • DEnable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

   Show answer

   Correct answer: C

   How others answered

   • C89%
   • A11%

10. Question 10 of 25

    An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service. Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

    • AModify all active Log Forwarding profiles to select the “Cloud Logging” option in each profile match list in the appropriate device groups.
    • BEnable the “Panorama/Cloud Logging” option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.
    • CSelect the “Enable Duplicate Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
    • DSelect the “Enable Cloud Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.

    Show answer

    Correct answer: C

    How others answered

    • C85%
    • A15%

11. Question 11 of 25

    In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured. What function do certificate profiles serve in this context?

    • AThey store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
    • BThey define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
    • CThey allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication.
    • DThey provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.

    Show answer

    Correct answer: B

    How others answered

    • B100%

12. Question 12 of 25

    How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

    • AIt does not accept the configuration.
    • BIt accepts the configuration but throws a warning message.
    • CIt removes the static route because 0 is a NULL value.
    • DIt reinstalls the route into the routing information base (RIB) as soon as the path comes up.

    Show answer

    Correct answer: D

    How others answered

    • D100%

13. Question 13 of 25

    Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

    • ASet Transmission Rate to “fast.”
    • BSet passive link state to “Auto.”
    • CSet “Enable in HA Passive State.”
    • DSet LACP mode to “Active.”

    Show answer

    Correct answer: C

    How others answered

    • C100%

14. Question 14 of 25

    After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish. Which of the following actions will resolve this issue?

    • AEnsure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface.
    • BConfigure the Proxy IDs to match the Cisco ASA configuration.
    • CCheck that IPSec is enabled in the management profile on the external interface.
    • DValidate the tunnel interface VLAN against the peer’s configuration.

    Show answer

    Correct answer: B

    How others answered

    • B100%

15. Question 15 of 25

    When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

    • AService graph
    • BAnsible automation modules
    • CPanorama role-based access control (RBAC)
    • DCN-Series firewalls

    Show answer

    Correct answer: D

    How others answered

    • D100%

16. Question 16 of 25

    When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

    • AFlood Protection
    • BProtocol Protection
    • CPacket-Based Attack Protection
    • DReconnaissance Protection

    Show answer

    Correct answer: C

    How others answered

    • C91%
    • B9%

17. Question 17 of 25

    Select 2

    For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

    • AUse of dynamic routing protocols
    • BTunnel monitoring
    • CUse of peer IP
    • DRedistribution of User-ID

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

18. Question 18 of 25

    Which PAN-OS method of mapping users to IP addresses is the most reliable?

    • APort mapping
    • BGlobalProtect
    • CSyslog
    • DServer monitoring

    Show answer

    Correct answer: B

    How others answered

    • B100%

19. Question 19 of 25

    In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

    • ATo forward packets to the HA peer during session setup and asymmetric traffic flow
    • BTo exchange hellos, heartbeats, HA state information, and management plane synchronization for routing and User-ID information
    • CTo synchronize sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in an HA pair
    • DTo perform session cache synchronization among all HA peers having the same cluster ID

    Show answer

    Correct answer: A

    How others answered

    • A93%
    • C7%

20. Question 20 of 25

    A PA-Series firewall with all licensable features is being installed. The customer’s Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions. Which action meets the requirements in this scenario?

    • ADeploy the transparent proxy with Web Cache Communications Protocol (WCCP).
    • BDeploy the Next-Generation Firewalls as normal and install the User-ID agent.
    • CDeploy the Advanced URL Filtering license and captive portal.
    • DDeploy the explicit proxy with Kerberos authentication scheme.

    Show answer

    Correct answer: D

    How others answered

    • D100%

21. Question 21 of 25

    Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?

    • AWhen a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.
    • BLocal firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.
    • CPanorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.
    • DThe order of policy evaluation can be configured differently in different device groups.

    Show answer

    Correct answer: B

    How others answered

    • B100%

22. Question 22 of 25

    Which networking technology can be configured on Layer 3 interfaces but not on Layer 2 interfaces?

    • ADDNS
    • BLink Duplex
    • CNetFlow
    • DLLDP

    Show answer

    Correct answer: A

    How others answered

    • A100%

23. Question 23 of 25

    What must be configured before a firewall administrator can define policy rules based on users and groups?

    • AUser Mapping profile
    • BAuthentication profile
    • CGroup mapping settings
    • DLDAP Server profile

    Show answer

    Correct answer: C

    How others answered

    • C52%
    • D48%

    Only 52% agreed on this answer — treat it as contested rather than settled.

24. Question 24 of 25

    What is a result of enabling split tunneling in the GlobalProtect portal configuration with the “Both Network Traffic and DNS” option?

    • AIt specifies when the secondary DNS server is used for resolution to allow access to specific domains that are not managed by the VPN.
    • BIt allows users to access internal resources when connected locally and external resources when connected remotely using the same FQDN.
    • CIt allows devices on a local network to access blocked websites by changing which DNS server resolves certain domain names.
    • DIt specifies which domains are resolved by the VPN-assigned DNS servers and which domains are resolved by the local DNS servers.

    Show answer

    Correct answer: D

    How others answered

    • D100%

25. Question 25 of 25

    According to dynamic updates best practices, what is the recommended threshold value for content updates in a mission- critical network?

    • A8 hours
    • B16 hours
    • C32 hours
    • D48 hours

    Show answer

    Correct answer: D

    How others answered

    • D100%

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NGFW-ENGINEER practice, question 1 of 25