Free Palo Alto Networks NGFW-Engineer Exam Questions

Question 1

Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?

A : When a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.

B : Local firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.

C : Panorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.

D : The order of policy evaluation can be configured differently in different device groups.

Answer: B

Question 2

A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit. Which two Security policy requirements must be included in the implementation plan? (Choose two answers)

A : The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer.

B : A pair of policies is required to control the flow of data traffic into and out of the security zone assigned to the tunnel interface.

C : A policy must explicitly permit only the IKE application between the external-facing zone and local zone.

D : A policy must explicitly permit the IPSec container application between the external-facing zone and local zone.

Answer: B,D

Question 3

A network security engineer wants to create Security policy rules that allow or deny traffic based on a user's department, which corresponds to groups in the company's Active Directory. To achieve this, the firewall needs to retrieve group information from the directory server. Which configuration object must be created first to establish the connection with the Active Directory server?

A : LDAP server profile

B : User-ID agent service account

C : Authentication sequence

D : Kerberos server profile

Answer: A

Question 4

A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit. Which two Security policy requirements must be included in the implementation plan? (Choose two answers)

A : The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer.

B : A pair of policies is required to control the flow of data traffic into and out of the security zone assigned to the tunnel interface.

C : A policy must explicitly permit only the IKE application between the external-facing zone and local zone.

D : A policy must explicitly permit the IPSec container application between the external-facing zone and local zone.

Answer: B,D

Question 5

Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

A : Set Transmission Rate to œfast.

B : Set passive link state to œAuto.

C : Set œEnable in HA Passive State

D : Set LACP mode to œActive.

Answer: C