NGFW-ENGINEER Sample Questions & Answers

A company has deployed CN-Series firewalls to secure its Kubernetes cluster. The DevOps team wants to ensure that security policies are automatically applied to new application pods based on Kubernetes labels without manual intervention. Which TWO components are essential for this integration? (Choose TWO).

An engineer is troubleshooting a BGP peering issue between a Palo Alto Networks firewall and a Cisco router. The firewall's system logs show the BGP state is stuck in 'Active'. What is the most likely cause of this issue from the perspective of the Palo Alto Networks firewall?

A hospital is using a PA-3220 firewall to segment its network. They have created a custom application signature for their Electronic Health Record (EHR) system. The security policy must allow access to the EHR system only for users in the 'Clinical-Staff' Active Directory group. All other access attempts to the EHR servers must be blocked and logged. Which two security policy rules, in the correct order, are required to implement this? (Choose two.)

An organization wants to provide remote access to its developers. The requirements are:

• All developer traffic must be routed through the corporate firewall for inspection.
• Developers should NOT be able to access their local network resources while connected to the VPN.
• The solution must be centrally managed via Panorama.

Which GlobalProtect configuration on the Gateway will enforce these requirements?

A company is using Terraform to manage its Cloud NGFW for AWS deployment. The lead engineer needs to define a ruleset that will be applied to multiple firewall resources. Which Terraform resource should be used to define a reusable collection of security rules?

A university has implemented a multi-VSYS environment on a PA-7050 to provide distinct virtual firewalls for its 'Academics', 'Administration', and 'Research' departments. The Research department requires direct, high-speed access to a shared supercomputing resource located in the Administration network. A standard inter-VSYS L3 interface is causing performance bottlenecks due to packet processing overhead. What is the most efficient method to connect the Research VSYS to the Administration VSYS to maximize throughput?

An administrator is setting up a site-to-site IPSec VPN tunnel and wants to ensure the tunnel is re-established automatically if it goes down. They have configured Dead Peer Detection (DPD) on the Palo Alto Networks firewall. If the firewall sends a DPD probe and does not receive a response, what is its immediate next action?

A security engineer has configured SSL Forward Proxy decryption. Users report that they can no longer access an internal business application that requires mutual authentication using client certificates. The security policy already excludes this application's destination from decryption. What is the most likely remaining misconfiguration causing this issue?

An administrator is creating custom reports in Panorama to track bandwidth usage for specific applications. They want to generate a weekly report that is automatically emailed to department heads. What are the key components that must be configured in Panorama to achieve this? (Select THREE).

A network engineer needs to configure an Aggregate Ethernet (AE) interface group on a PA-5260 firewall to connect to a switch stack. The goal is to maximize throughput and provide redundancy. The switch stack is configured for dynamic link aggregation. Which LACP mode should be configured on the firewall's AE interface?