Free Palo Alto Networks NGFW-Engineer Exam Questions

Question 1

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other. Which action taken by the engineer will resolve this issue?

A : Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.

B : Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.

C : Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.

D : Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Answer: B

Question 2

An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must be minimized. What is the recommended upgrade process for minimal disruption in this high availability (HA) scenario?

A : Suspend the active firewall to trigger a failover to the passive firewall. With traffic now running on the former passive unit, upgrade the suspended (now passive) firewall and confirm proper operation. Then fail traffic back and upgrade the remaining firewall.

B : Shut down the currently active firewall and upgrade it offline, allowing the passive firewall to handle all traffic. Once the active firewall finishes upgrading, bring it back online and rejoin the HA cluster. Finally, upgrade the passive firewall while the newly upgraded unit remains active

C : Isolate both firewalls from the production environment and upgrade them in a separate, offline setup. Reconnect them only after validating the new software version, resuming HA functionality once both units are fully upgraded and tested.

D : Push the new PAN-OS version simultaneously to both firewalls, having them upgrade and reboot in parallel. Rely on automated HA reconvergence to restore normal operations without manually failing over traffic.

Answer: A

Question 3

Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?

A : When a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.

B : Local firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.

C : Panorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.

D : The order of policy evaluation can be configured differently in different device groups.

Answer: B

Question 4

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other. Which action taken by the engineer will resolve this issue?

A : Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.

B : Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.

C : Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.

D : Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Answer: B

Question 5

An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must be minimized. What is the recommended upgrade process for minimal disruption in this high availability (HA) scenario?

A : Suspend the active firewall to trigger a failover to the passive firewall. With traffic now running on the former passive unit, upgrade the suspended (now passive) firewall and confirm proper operation. Then fail traffic back and upgrade the remaining firewall.

B : Shut down the currently active firewall and upgrade it offline, allowing the passive firewall to handle all traffic. Once the active firewall finishes upgrading, bring it back online and rejoin the HA cluster. Finally, upgrade the passive firewall while the newly upgraded unit remains active

C : Isolate both firewalls from the production environment and upgrade them in a separate, offline setup. Reconnect them only after validating the new software version, resuming HA functionality once both units are fully upgraded and tested.

D : Push the new PAN-OS version simultaneously to both firewalls, having them upgrade and reboot in parallel. Rely on automated HA reconvergence to restore normal operations without manually failing over traffic.

Answer: A