Palo Alto Networks NGFW-Engineer Exam Practice Questions (P. 2)
- Full Access (50 questions)
- Six months of Premium Access
- Access to one million comments
- Seamless ChatGPT Integration
- Ability to download PDF files
- Anki Flashcard files for revision
- No Captcha & No AdSense
- Advanced Exam Configuration
Question #6
In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?
send
light_mode
delete
Question #7
Which two zone types are valid when configuring a new security zone? (Choose two.)
send
light_mode
delete
Question #8
An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.
How does the GlobalProtect agent process the authentication flow on Windows endpoints?
How does the GlobalProtect agent process the authentication flow on Windows endpoints?
- AThe GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
- BThe GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
- COnce the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
- DGlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.
send
light_mode
delete
Question #9
An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?
- AModify all active Log Forwarding profiles to select the “Cloud Logging” option in each profile match list in the appropriate device groups.
- BEnable the “Panorama/Cloud Logging” option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.
- CSelect the “Enable Duplicate Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
- DSelect the “Enable Cloud Logging” option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
send
light_mode
delete
Question #10
An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.
Which action taken by the engineer will resolve this issue?
Which action taken by the engineer will resolve this issue?
- AConfigure each interface to belong to the same Layer 2 zone and enable IP routing between them.
- BAssign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
- CAssign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
- DEnable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.
send
light_mode
delete
All Pages