Free Palo Alto Networks NGFW-Engineer Exam Questions

Question 1

A firewall administrator uses Panorama to manage a fleet of firewalls. After successfully onboarding the firewalls to Strata Logging Service and enabling cloud logging via a template, the security operations team reports that they can no longer see new logs on the on-premises Panorama log collectors. Logs are appearing correctly in Strata Logging Service. Which setting was likely missed in the Panorama template configuration?

A : The device certificates for the Panorama log collectors were not renewed after enabling the cloud logging connection.

B : Duplicate logging (cloud and on-premises) is disabled under Device # Setup # Management.

C : The Log Forwarding profile was modified to send logs only to the Strata Logging Service and no longer includes the on-premises Panorama log collectors.

D : The Panorama log collectors were not defined as primary destinations within the collector group configuration for the managed firewalls.

Answer: B

Question 2

A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit. Which two Security policy requirements must be included in the implementation plan? (Choose two answers)

A : The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer.

B : A pair of policies is required to control the flow of data traffic into and out of the security zone assigned to the tunnel interface.

C : A policy must explicitly permit only the IKE application between the external-facing zone and local zone.

D : A policy must explicitly permit the IPSec container application between the external-facing zone and local zone.

Answer: B,D

Question 3

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other. Which action taken by the engineer will resolve this issue?

A : Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.

B : Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.

C : Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.

D : Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Answer: B

Question 4

Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

A : Set Transmission Rate to œfast.

B : Set passive link state to œAuto.

C : Set œEnable in HA Passive State

D : Set LACP mode to œActive.

Answer: C

Question 5

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other. Which action taken by the engineer will resolve this issue?

A : Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.

B : Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.

C : Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.

D : Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Answer: B