Free Palo Alto Networks NGFW-Engineer Practice Questions & Answers 2026 Part1

Question #1

How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

A. It does not accept the configuration

B. It accepts the configuration but throws a warning message

C. It removes the static route because 0 is a NULL value

D. It reinstalls the route into the routing information base (RIB) as soon as the path comes up

View answer

Correct Answer: D

Question #2

When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

A. Service graph

B. Ansible automation modules

C. Panorama role-based access control (RBAC)

D. CN-Series firewalls

View answer

Correct Answer: D

Question #3

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third - party gateway? (Choose two.)

A. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional

B. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy

C. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction

D. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy

View answer

Correct Answer: CD

Question #4

An organization is securing its cloud workloads using the Palo Alto Networks platform. The goal is to use a fully managed firewall service that integrates with Panorama for consistent policy management. The solution must be scalable and require minimal changes to the existing routing fabric. * The AWS cloud uses a distributed architecture where each application virtual private cloud (VPC) routes internet traffic through its own internet gateway. * The Azure cloud is built around a Virtual WAN (vWAN) hub for centralized connectivity. Which two deployments meet these criteria? (Choose two.)

A. ANative cloud provider firewalls in both cloud environments and connected to Panorama for management

B. BCloud NGFW in each spoke VNet with User-Defined Routes (UDRs) to redirect traffic bypassing the vWAN hub

C. CCloud NGFW endpoints in each application VPC, updating the VPC route tables to direct traffic through the endpoints

D. DCloud NGFW as a security partner in the vWAN hub with routing configured to send traffic through the NGFW

View answer

Correct Answer: CD

Question #5

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.Which of the following actions will resolve this issue?

A. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface

B. Configure the Proxy IDs to match the Cisco ASA configuration

C. Check that IPSec is enabled in the management profile on the external interface

D. Validate the tunnel interface VLAN against the peer's configuration

View answer

Correct Answer: B

Question #6

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

A. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups

B. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device -- > Setup --> Management in the appropriate templates

C. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

D. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

View answer

Correct Answer: D

Question #7

An engineer is configuring a GlobalProtect portal and wants to enable split tunneling. The requirement is to route DNS queries for "https://www.google.com/search?q=corp.internal.com" to the DNS servers assigned by the VPN, while allowing all other DNS queries to be resolved by the client's locally configured DNS.What is the effect of configuring this split DNS policy?

A. It provides selective DNS resolution, with specified domains resolved through the tunnel, optimizing performance for other lookups

B. It blocks access to all domains that are not explicitly listed in the split tunnel configuration

C. It forces all applications to use the corporate DNS servers, regardless of the split tunnel settings for IP traffic

D. It creates a DNS proxy on the client endpoint that forwards all queries to the firewall for inspection

View answer

Correct Answer: A

Question #8

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.Which action taken by the engineer will resolve this issue?

A. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them

B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN

C. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone

D. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN

View answer

Correct Answer: B

Question #9

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)

A. or incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional

B. he IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy

C. or incoming and outgoing traffic through the tunnel, separate rules must be created for each direction

D. he IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy

View answer

Correct Answer: AB

Question #10

Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)

A. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional

B. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy

C. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction

D. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy

View answer

Correct Answer: CD

Question #11

How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

A. It does not accept the configuration

B. It accepts the configuration but throws a warning message

C. It removes the static route because 0 is a NULL value

D. It reinstalls the route into the routing information base (RIB) as soon as the path comes up

View answer

Correct Answer: D

Question #12

Which CLI command is used to configure the management interface as a DHCP client?

A. set network dhcp interface management

B. set network dhcp type management-interface

C. set deviceconfig system type dhcp-client

D. set deviceconfig management type dhcp-client

View answer

Correct Answer: D

Question #13

In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

A. License

B. Plugin

C. Content update

D. General setting

View answer

Correct Answer: D

Question #14

When creating a Log Forwarding profile on a PAN-OS firewall to direct logs to various external and internal systems, which set of methods is available?

A. Syslog, Panorama, SD-WAN

B. Panorama/Cloud logging, email, Syslog

C. Email, Syslog, NetFlow

D. HTTP, RADIUS, SNMP

View answer

Correct Answer: B

Question #15

Which two zone types are valid when configuring a new security zone? (Choose two.)

A. Tunnel

B. Intrazone

C. Internal

D. Virtual Wire

View answer

Correct Answer: AD

Question #16

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall.Which firewall models support this configuration?

A. PA-5280, PA-7080, PA-3250, VM-Series

B. PA-455, VM-Series, PA-1410, PA-5450

C. PA-3260, PA-5410, PA-850, PA-460

D. PA-7050, PA-1420, VM-Series, CN-Series

View answer

Correct Answer: A

Question #17

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

A. It acts as a logging service for NGFW performance metrics

B. It orchestrates real-time traffic inspection for network segments

C. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment

D. It manages threat intelligence data synchronization with NGFWs

View answer

Correct Answer: C

Question #18

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.Which of the following actions will resolve this issue?

A. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface

B. Configure the Proxy IDs to match the Cisco ASA configuration

C. Check that IPSec is enabled in the management profile on the external interface

D. Validate the tunnel interface VLAN against the peer's configuration

View answer

Correct Answer: B

Question #19

By default, which type of traffic is configured by service route configuration to use the management interface?

A. irtual system (VSYS)

B. PSec tunnel

C. utonomous Digital Experience Manager (ADEM)

D. ecurity zone

View answer

Correct Answer: C

Question #20

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.What function do certificate profiles serve in this context?

A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication

B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e

C. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication

D. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods

View answer

Correct Answer: B

Question #21

How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

A. It does not accept the configuration

B. It accepts the configuration but throws a warning message

C. It removes the static route because 0 is a NULL value

D. It reinstalls the route into the routing information base (RIB) as soon as the path comes up

View answer

Correct Answer: D

Question #22

Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

A. Set Transmission Rate to "fast

B. Set passive link state to "Auto

C. Set "Enable in HA Passive State

D. Set LACP mode to "Active

View answer

Correct Answer: C

Question #23

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.What function do certificate profiles serve in this context?

A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication

B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e

C. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication

D. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods

View answer

Correct Answer: B

Question #24

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

A. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups

B. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device -- > Setup --> Management in the appropriate templates

C. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

D. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

View answer

Correct Answer: D

Question #25

Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

A. Set Transmission Rate to "fast

B. Set passive link state to "Auto

C. Set "Enable in HA Passive State

D. Set LACP mode to "Active

View answer

Correct Answer: C

Question #26

To comply with new directives mandating the use of quantum-resistant cryptography for all data-in-transit a network engineer is tasked with reconfiguring existing IKEv2 VPN tunnels between PA-Series firewalls to meet this requirement. Which two actions should the engineer take to ensure compliance? (Choose two.)

A. AConfigure an IKE Crypto profile with one or more post-quantum rounds selected and apply it to an IKE Gateway configured for the post-quantum key exchange mechanism

B. BEstablish a shared secret of at least 64 characters and configure it as a post-quantum pre-shared key (PPK) within an IKEv2-only IKE Gateway

C. CGenerate a post-quantum pre-shared key (PPK) and apply it within the IPSec tunnel configuration's advanced settings

D. DEnable GlobalProtect with quantum-resistant tunneling and apply the profile to the IKE Gateway

View answer

Correct Answer: AB

Question #27

An administrator is configuring a site-to-site IPSec VPN and assigns an IP address to the tunnel interface. Which two abilities are enabled by this specific configuration step? (Choose two.)

A. AConfiguring tunnel monitoring to verify the liveliness of the connection

B. BFirewall performing NAT traversal

C. CRunning a dynamic routing protocol like OSPF over the tunnel

D. DFirewall encrypting and decrypting packet payloads

View answer

Correct Answer: AC

Question #28

An administrator must perform several actions on a fleet of firewalls from a central Panorama instance. To maintain efficiency, the administrator wants to only perform actions that do not require switching context into each firewall's individual web interface.Which set of actions is available to the administrator directly from the Panorama UI?

A. Creating a new VLAN -Assigning an interface to the new VLANConfiguring a new DHCP server on the firewall

B. Modifying a pre-rule -Editing a shared service object -Creating a new certificate profile

C. Accessing the CLI -Restarting the device -Installing the latest content and software versions

D. Configuring a new IPSec tunnel -Modifying the IKE gateway -Changing the DNS server settings of the firewall

View answer

Correct Answer: B

Question #29

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.How does the GlobalProtect agent process the authentication flow on Windows endpoints?

A. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access

B. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA

C. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user

D. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant

View answer

Correct Answer: A

Question #30

An administrator is configuring a GlobalProtect pre-logon VPN. The administrator has already imported the necessary internal certificate authority (CA) certificates for issuing machine certificates onto the firewall.Which configuration is required on the GlobalProtect Gateway to enable pre-logon using these machine certificates?

A. onfigure the Gateway Agent -- > Tunnel Settings to use IPSec with machine certificate authentication for the pre- logon tunnel

B. reate an authentication profile that points to the machine certificate's CA and assign it by using the client authentication settings of the GlobalProtect Portal

C. reate a certificate profile that trusts the machine certificate's CA and assign it within the Gateway Agent -- > Client Authentication settings

D. reate a device-based Security policy that allows traffic from the pre-logon user to an internal management zone

View answer

Correct Answer: C

Question #31

When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

A. Service graph

B. Ansible automation modules

C. Panorama role-based access control (RBAC)

D. CN-Series firewalls

View answer

Correct Answer: D

Question #32

What is the purpose of assigning an Admin Role Profile to a user in a Palo Alto Networks NGFW?

A. Allow access to all resources without restrictions

B. Enable multi-factor authentication (MFA) for administrator access

C. Define granular permissions for management tasks

D. Restrict access to sensitive report data

View answer

Correct Answer: C

Question #33

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.Which action taken by the engineer will resolve this issue?

A. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them

B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN

C. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone

D. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN

View answer

Correct Answer: C

Question #34

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall. Which firewall models support this configuration?

A. PA - 5280, PA - 7080, PA - 3250, VM - Series

B. PA - 455, VM - Series, PA - 1410, PA - 5450

C. PA - 3260, PA - 5410, PA - 850, PA - 460

D. PA - 7050, PA - 1420, VM - Series, CN - Series

View answer

Correct Answer: C

Question #35

A DevOps team is building a repeatable process for deploying new Palo Alto Networks VM-Series firewalls. The entire infrastructure, including virtual networks, subnets, and the firewalls themselves, must be defined in code to ensure consistency and enable version control.Which tool is primarily used for this type of declarative Infrastructure as Code (IaC) provisioning?

A. Terraform

B. Azure DevOps

C. Ansible

D. Panorama

View answer

Correct Answer: A

Question #36

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.What function do certificate profiles serve in this context?

A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication

B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e

C. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication

D. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods

View answer

Correct Answer: B

Question #37

A cloud security team wants to extend its existing Palo Alto Networks Security policies into the organization's Kubernetes environments. The team requires an NGFW solution that can be deployed natively as a container and managed by Panorama.Which firewall form factor meets these requirements?

A. Cloud NGFW

B. PA-5400 Series

C. VM-Series

D. CN-Series

View answer

Correct Answer: D

Question #38

Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

A. Set Transmission Rate to "fast

B. Set passive link state to "Auto

C. Set "Enable in HA Passive State

D. Set LACP mode to "Active

View answer

Correct Answer: C

Question #39

What is the primary use case for the CN-Series NGFW?

A. ecuring traffic in and out of a public cloud VPC or VNet (north-south)

B. nforcing Security policies between pods in a Kubernetes environment (east-west)

C. rotecting mobile users and remote branch offices (east-west)

D. roviding security for physical data center perimeters (north-south)

View answer

Correct Answer: B

Question #40

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.What function do certificate profiles serve in this context?

A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication

B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e

C. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication

D. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods

View answer

Correct Answer: B

Question #41

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

A. It acts as a logging service for NGFW performance metrics

B. It orchestrates real - time traffic inspection for network segments

C. It provides Infrastructure - as - Code (IaC) to automate NGFW deployment

D. It manages threat intelligence data synchronization with NGFWs

View answer

Correct Answer: C

Question #42

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.What function do certificate profiles serve in this context?

A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication

B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e

C. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication

D. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods

View answer

Correct Answer: B

Question #43

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

A. It acts as a logging service for NGFW performance metrics

B. It orchestrates real-time traffic inspection for network segments

C. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment

D. It manages threat intelligence data synchronization with NGFWs

View answer

Correct Answer: C

Question #44

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

A. Flood Protection

B. Protocol Protection

C. Packet-Based Attack Protection

D. Reconnaissance Protection

View answer

Correct Answer: B

Question #45

An organization must secure its AWS and Azure environments using a managed Palo Alto Networks solution, and all policies must be synchronized from an existing Panorama deployment. The organization wants to insert security with the least possible impact on its application teams and use existing hub-and-spoke network designs. * The AWS environment uses a centralized AWS Transit Gateway (TGW) architecture. * The Azure environment uses a Virtual WAN (vWAN) hub. Which two actions are the most appropriate in this use case? (Choose two.)

A. ADeploy Cloud NGFW endpoints in every application virtual private cloud (VPC), ignoring the TGW

B. BDeploy Cloud NGFW into the vWAN hub as a trusted security partner, and update routing policies to secure traffic

C. CDeploy individual VM-Series firewalls in each spoke virtual network (VNet) and manage them as a device group in Panorama

D. DDeploy Cloud NGFW endpoints into a security virtual private cloud (VPC), and adjust the TGW route tables to inspect traffic flowing though the hub

View answer

Correct Answer: BD

Question #46

To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers. Resources exist on AWS and Azure:The AWS deployment is architected with AWS Transit Gateway, to which all resources connectThe Azure deployment is architected with each application independently routing trafficThe engineer deploying Cloud NGFW in these two cloud environments must account for the following:Minimize changes to the two cloud environmentsScale to the demands of the applications while using the least amount of compute resourcesAllow the company to unify the Security policies across all protected areasWhich two implementations will meet these requirements? (Choose two.)

A. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama

B. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama

C. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules

D. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama

View answer

Correct Answer: BD

Question #47

Which two zone types are valid when configuring a new security zone? (Choose two.)

A. Tunnel

B. Intrazone

C. Internal

D. Virtual Wire

View answer

Correct Answer: AD

Question #48

How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

A. It does not accept the configuration

B. It accepts the configuration but throws a warning message

C. It removes the static route because 0 is a NULL value

D. It reinstalls the route into the routing information base (RIB) as soon as the path comes up

View answer

Correct Answer: D

Question #49

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.What function do certificate profiles serve in this context?

A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication

B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e

C. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication

D. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods

View answer

Correct Answer: B

Question #50

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.How does the GlobalProtect agent process the authentication flow on Windows endpoints?

A. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access

B. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA

C. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user

D. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant

View answer

Correct Answer: A

Question #51

Which CLI command is used to configure the management interface as a DHCP client?

A. set network dhcp interface management

B. set network dhcp type management-interface

C. set deviceconfig system type dhcp-client

D. set deviceconfig management type dhcp-client

View answer

Correct Answer: D

Question #52

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.Which action taken by the engineer will resolve this issue?

A. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them

B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN

C. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone

D. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN

View answer

Correct Answer: B

Question #53

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.Which of the following actions will resolve this issue?

A. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface

B. Configure the Proxy IDs to match the Cisco ASA configuration

C. Check that IPSec is enabled in the management profile on the external interface

D. Validate the tunnel interface VLAN against the peer's configuration

View answer

Correct Answer: B

Question #54

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.Which action taken by the engineer will resolve this issue?

A. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them

B. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN

C. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone

D. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN

View answer

Correct Answer: B

Question #55

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

A. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups

B. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device -- > Setup --> Management in the appropriate templates

C. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

D. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

View answer

Correct Answer: D

Question #56

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

A. Flood Protection

B. Protocol Protection

C. Packet-Based Attack Protection

D. Reconnaissance Protection

View answer

Correct Answer: B

Question #57

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

A. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups

B. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device -- > Setup --> Management in the appropriate templates

C. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

D. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

View answer

Correct Answer: D

Question #58

During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall.Which firewall models support this configuration?

A. PA-5280, PA-7080, PA-3250, VM-Series

B. PA-455, VM-Series, PA-1410, PA-5450

C. PA-3260, PA-5410, PA-850, PA-460

D. PA-7050, PA-1420, VM-Series, CN-Series

View answer

Correct Answer: C

Question #59

After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.Which of the following actions will resolve this issue?

A. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface

B. Configure the Proxy IDs to match the Cisco ASA configuration

C. Check that IPSec is enabled in the management profile on the external interface

D. Validate the tunnel interface VLAN against the peer's configuration

View answer

Correct Answer: B

Question #60

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

A. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups

B. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device -- > Setup --> Management in the appropriate templates

C. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

D. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free Palo Alto Networks NGFW-Engineer Practice Questions & Answers 2026 Part1

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free Palo Alto Networks NGFW-Engineer Practice Questions & Answers 2026 Part1

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now