Palo Alto Networks Next-Generation Firewall Engineer - NGFW-Engineer Exam Practice Test

Question 1

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

A. It acts as a logging service for NGFW performance metrics.

B. It orchestrates real-time traffic inspection for network segments.

C. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.

D. It manages threat intelligence data synchronization with NGFWs.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

A. Service graph

B. Panorama role-based access control (RBAC)

C. Ansible automation modules

D. CN-Series firewalls

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

To maintain security efficacy of its public cloud resources by using native tools, a company purchases Cloud NGFW credits to replicate the Panorama, PA-Series, and VM-Series devices used in physical data centers.
Resources exist on AWS and Azure:
The AWS deployment is architected with AWS Transit Gateway, to which all resources connect The Azure deployment is architected with each application independently routing traffic The engineer deploying Cloud NGFW in these two cloud environments must account for the following:
Minimize changes to the two cloud environments
Scale to the demands of the applications while using the least amount of compute resources Allow the company to unify the Security policies across all protected areas Which two implementations will meet these requirements? (Choose two.)

A. Deploy Cloud NGFW for AWS in a centralized Security VPC, update the Transit Gateway to route all appropriate traffic through the Security VPC, and manage the policy with Panorama.

B. Deploy a VM-Series firewall in AWS in each VPC, create an IPSec tunnel between AWS and Azure, and manage the policy with Panorama.

C. Deploy Cloud NGFW for Azure in vNET/s, update the vNET/s routing to path traffic through the deployed NGFWs, and manage the policy with Panorama.

D. Deploy Cloud NGFW for Azure in vWAN, create a vWAN to route all appropriate traffic to the Cloud NGFW attached to the vWAN, and manage the policy with local rules.

Correct Answer: A,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

An administrator is configuring firewalls via a Panorama template to forward logs to a newly provisioned Strata Logging Service instance. The operational requirement is to maintain existing logging to on-premises Panorama log collectors for immediate, low-latency queries while also forwarding logs to Strata Logging Service for long-term archival. The administrator has already configured and enabled cloud logging connectivity.
Which additional step is necessary to meet the operational requirement?

A. Enable log syncing and commit the template changes to both the on-premises and cloud collectors.

B. In the collector group settings, add the Strata Logging Service as a secondary destination for the on- premises collector.

C. Enable duplicate logging (cloud and on-premises) under Device - > Setup - > Management in the appropriate templates.

D. Add the Panorama log collector and Strata Logging Service IP addresses to the cloud logging service routes to ensure dual-path cloud and on-premises reachability.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

What is the correct sequence of evaluation for Security policy rulebases?

A. Panorama Post-Rules -- > Panorama Pre-Rules -- > Local Firewall Rules

B. Panorama Pre-Rules -- > Local Firewall Rules -- > Panorama Post-Rules

C. Panorama Shared Rules -- > Local Firewall Rules -- > Device Group Rules

D. Local Firewall Rules -- > Panorama Pre-Rules -- > Panorama Post-Rules

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

An engineer at a managed services provider is updating an application that allows its customers to request firewall changes to also manage SD-WAN. The application will be able to make any approved changes directly to devices via API.
What is a requirement for the application to create SD-WAN interfaces?

A. XML API's "sdwanprofiles/interfaces" parameter on a Panorama device

B. REST API's "sdwanInterfaceprofiles" parameter on a Panorama device

C. REST API's "sdwanInterfaces" parameter on a firewall device

D. XML API's "InterfaceProfiles/sdwan" parameter on a firewall device

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

An organization is adopting an Infrastructure as Code (IaC) approach to manage its entire network environment, including its Palo Alto Networks firewalls. The organization has chosen Ansible as its primary tool for this initiative.
How does Ansible enable an IaC model for managing this organization's firewalls?

A. By providing a graphical user interface that simplifies the creation of security policies through a drag- and-drop interface

B. By automatically discovering and mapping all network devices to generate a baseline configuration

C. By providing real-time threat intelligence feeds directly to the firewalls' data plane

D. By defining firewall configurations in playbooks that can be version-controlled and executed repeatedly

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Which zone type allows traffic between zones in different virtual systems (VSYS), without the traffic leaving the firewall?

A. External

B. Internal

C. Transient

D. Isolated

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

A PA-Series firewall with all licensable features is being installed. The customer's Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions.
Which action meets the requirements in this scenario?

A. Deploy the Advanced URL Filtering license and captive portal.

B. Deploy the Next-Generation Firewalls as normal and install the User-ID agent.

C. Deploy the transparent proxy with Web Cache Communications Protocol (WCCP).

D. Deploy the explicit proxy with Kerberos authentication scheme.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

A network security engineer is segmenting a single firewall into VSYS-A and VSYS-B. For traffic to flow from VSYS-A to VSYS-B, external zones are required.
What are two fundamental properties of the external zones needed for this configuration? (Choose two.)

A. They represent their parent VSYS without being tied to a physical or logical interface.

B. They must be linked to the same virtual router as the ingress interface.

C. They are a security construct belonging to a single VSYS.

D. They are automatically created when inter-VSYS routing is enabled.

Correct Answer: A,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Palo Alto Networks Next-Generation Firewall Engineer - NGFW-Engineer Exam Practice Test

Latest Update

Useful Links

Contact Us