Palo Alto Networks PAN-NGFE Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-NGFE Online Questions & Answers

• Question 1:

  In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

  A. License
  B. Plugin
  C. Content update
  D. General setting
  A. License

• Question 2:

  Which PAN-OS method of mapping users to IP addresses is the most reliable?

  A. Port mapping
  B. GlobalProtect
  C. Syslog
  D. Server monitoring
  D. Server monitoring

• Question 3:

  Which protection mechanism helps defend against malformed packets and protocol anomalies?

  A. Flood protection
  B. Reconnaissance protection
  C. Protocol protection
  D. Zone protection
  C. Protocol protection

• Question 4:

  Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third-party gateway? (Choose two.)

  A. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
  B. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
  C. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
  D. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.
  C. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
  D. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.

• Question 5:

  Which feature ensures that users authenticate transparently when accessing web resources through a firewall acting as a proxy?

  A. Captive portal
  B. Explicit proxy with Kerberos
  C. URL filtering
  D. SSL decryption
  B. Explicit proxy with Kerberos

• Question 6:

  The UDP-4501 protocol-port is used between which two GlobalProtect components?

  A. GlobalProtect app and GlobalProtect satellite
  B. GlobalProtect app and GlobalProtect gateway
  C. GlobalProtect portal and GlobalProtect gateway
  D. GlobalProtect app and GlobalProtect portal
  B. GlobalProtect app and GlobalProtect gateway

• Question 7:

  A PA-Series firewall with all licensable features is being installed. The customer's Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions.

  Which action meets the requirements in this scenario?

  A. Deploy the transparent proxy with Web Cache Communications Protocol (WCCP).
  B. Deploy the Next-Generation Firewalls as normal and install the User-ID agent.
  C. Deploy the Advanced URL Filtering license and captive portal.
  D. Deploy the explicit proxy with Kerberos authentication scheme.
  D. Deploy the explicit proxy with Kerberos authentication scheme.

• Question 8:

  When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

  A. Flood Protection
  B. Protocol Protection
  C. Packet-Based Attack Protection
  D. Reconnaissance Protection
  B. Protocol Protection

• Question 9:

  A firewall administrator is configuring an IPSec tunnel between a company's HQ and a remote location. On the HQ firewall, the interface used to terminate the IPSec tunnel has a static IP. At the remote location, the interface used to terminate the IPSec tunnel has a DHCP assigned IP address.

  Which two actions are required for this scenario to work? (Choose two.)

  A. On the HQ firewall select peer IP address type FQDN
  B. On the remote location firewall select peer IP address type Dynamic
  C. On the HQ firewall enable DDNS under the interface used for the IPSec tunnel
  D. On the remote location firewall enable DDNS under the interface used for the IPSec tunnel
  A. On the HQ firewall select peer IP address type FQDN
  C. On the HQ firewall enable DDNS under the interface used for the IPSec tunnel

• Question 10:

  Which statement applies to Log Collector Groups?

  A. Log redundancy is available only if each Log Collector has the same amount of total disk storage.
  B. Enabling redundancy increases the log processing traffic in a Collector Group by 50%.
  C. In any single Collector Group, all the Log Collectors must run on the same Panorama model.
  D. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.
  D. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.