Free NGFW-ENGINEER sample questions
Real questions from the Next-Generation Firewall Engineer practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
A consultant is designing a network with a PA-850 firewall that must inspect traffic between two switch ports in a strictly transparent mode without participating in spanning-tree. The firewall should not perform any routing or NAT and must be invisible to the connected devices. Which interface type configuration meets all these requirements?
True or False: When configuring a PAN-OS firewall as an explicit web proxy, the firewall must have a Layer 3 interface configured in the same security zone as the clients to intercept the proxy requests.
A company has deployed CN-Series firewalls to secure its Kubernetes cluster. The DevOps team wants to ensure that security policies are automatically applied to new application pods based on Kubernetes labels without manual intervention. Which TWO components are essential for this integration? (Choose TWO).
An engineer is troubleshooting a BGP peering issue between a Palo Alto Networks firewall and a Cisco router. The firewall's system logs show the BGP state is stuck in 'Active'. What is the most likely cause of this issue from the perspective of the Palo Alto Networks firewall?
A hospital is using a PA-3220 firewall to segment its network. They have created a custom application signature for their Electronic Health Record (EHR) system. The security policy must allow access to the EHR system only for users in the 'Clinical-Staff' Active Directory group. All other access attempts to the EHR servers must be blocked and logged. Which two security policy rules, in the correct order, are required to implement this? (Choose two.)
An organization wants to provide remote access to its developers. The requirements are: - All developer traffic must be routed through the corporate firewall for inspection. - Developers should NOT be able to access their local network resources while connected to the VPN. - The solution must be centrally managed via Panorama. Which GlobalProtect configuration on the Gateway will enforce these requirements?
A company is using Terraform to manage its Cloud NGFW for AWS deployment. The lead engineer needs to define a ruleset that will be applied to multiple firewall resources. Which Terraform resource should be used to define a reusable collection of security rules?
A university has implemented a multi-VSYS environment on a PA-7050 to provide distinct virtual firewalls for its 'Academics', 'Administration', and 'Research' departments. The Research department requires direct, high-speed access to a shared supercomputing resource located in the Administration network. A standard inter-VSYS L3 interface is causing performance bottlenecks due to packet processing overhead. What is the most efficient method to connect the Research VSYS to the Administration VSYS to maximize throughput?
An administrator is setting up a site-to-site IPSec VPN tunnel and wants to ensure the tunnel is re-established automatically if it goes down. They have configured Dead Peer Detection (DPD) on the Palo Alto Networks firewall. If the firewall sends a DPD probe and does not receive a response, what is its immediate next action?
10 more free samples are waiting
Create a free account to unlock the whole NGFW-ENGINEER sample bank, or get full access to all 228 practice questions in the simulator.