Palo Alto Networks Next-Generation Firewall Engineer NGFW-Engineer Dumps in PDF

Free Palo Alto Networks NGFW-Engineer Real Questions (page: 2)

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.

Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

  1. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups.
  2. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device -- > Setup --> Management in the appropriate templates.
  3. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
  4. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.

Answer(s): D

Explanation:

To begin sending logs to Strata Logging Service while continuing to forward them to Panorama log collectors, the necessary configuration is to enable Cloud Logging. This option is configured in the Cloud Logging section under Device Setup Management in the appropriate templates. Once enabled, this ensures that logs are directed both to the Strata Logging Service (cloud) and to the Panorama log collectors.



An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.

Which action taken by the engineer will resolve this issue?

  1. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.
  2. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
  3. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
  4. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Answer(s): B

Explanation:

In a Layer 2 configuration, interfaces are typically grouped into the same Layer 2 zone.
When the interfaces are assigned to the same VLAN, the firewall will treat them as part of the same broadcast domain.
In a Layer 2 setup, interfaces must be in the same Layer 2 zone to allow the traffic within the same VLAN to pass. Additionally, a security policy must be configured to allow traffic within this VLAN or zone. This will resolve the issue by ensuring that traffic is permitted between clients behind different interfaces assigned to the same VLAN.



In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.

What function do certificate profiles serve in this context?

  1. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
  2. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
  3. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication.
  4. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.

Answer(s): B

Explanation:

In the context of GlobalProtect with certificate-based authentication, certificate profiles are used to ensure proper validation of the certificates. They perform the following functions:
Define trust anchors, which are the root and intermediate Certificate Authorities (CAs) that the firewall trusts to authenticate certificates.
Specify revocation checks, such as CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol), to ensure that the certificates being used have not been revoked.
Map certificate attributes, such as the Common Name (CN), which helps in authenticating users and devices based on their certificates.



How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?

  1. It does not accept the configuration.
  2. It accepts the configuration but throws a warning message.
  3. It removes the static route because 0 is a NULL value.
  4. It reinstalls the route into the routing information base (RIB) as soon as the path comes up.

Answer(s): D

Explanation:

When the preemptive hold time is set to 0 minutes in route monitoring, the firewall is configured to immediately reinstall the route into the Routing Information Base (RIB) as soon as the monitored path comes up. This essentially means that the firewall will not wait for any predefined hold time before reestablishing the route once the monitoring condition is met, ensuring a faster recovery of the route.



After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.

Which of the following actions will resolve this issue?

  1. Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface.
  2. Configure the Proxy IDs to match the Cisco ASA configuration.
  3. Check that IPSec is enabled in the management profile on the external interface.
  4. Validate the tunnel interface VLAN against the peer's configuration.

Answer(s): B

Explanation:

The Proxy IDs (or Traffic Selectors) define the local and remote subnets that are allowed to communicate over the IPSec tunnel. If the Proxy IDs on the Palo Alto Networks firewall do not match the configuration on the Cisco ASA, the tunnel will fail to establish because the firewalls won't agree on which traffic to encrypt.
Ensuring that the Proxy IDs match between the Palo Alto Networks firewall and the Cisco ASA will resolve the issue.



Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

  1. Set Transmission Rate to "fast."
  2. Set passive link state to "Auto."
  3. Set "Enable in HA Passive State."
  4. Set LACP mode to "Active."

Answer(s): C

Explanation:

In a High Availability (HA) active/passive pair configuration, when setting up an Aggregate Ethernet (AE) interface, enabling the "Enable in HA Passive State" option allows the interface to participate in LACP (Link Aggregation Control Protocol) even when the system is in the passive state. This ensures that the pre-negotiation of the LACP link occurs, allowing the link aggregation to be ready as soon as the firewall becomes active.



When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?

  1. Service graph
  2. Ansible automation modules
  3. Panorama role-based access control (RBAC)
  4. CN-Series firewalls

Answer(s): D

Explanation:

When integrating Kubernetes with Palo Alto Networks NGFWs, the CN-Series firewalls are specifically designed to secure traffic between microservices in containerized environments. These firewalls provide advanced security features like Application Identification (App-ID), URL filtering, and Threat Prevention to secure communication between containers and microservices within a Kubernetes environment.



When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

  1. Flood Protection
  2. Protocol Protection
  3. Packet-Based Attack Protection
  4. Reconnaissance Protection

Answer(s): B

Explanation:

In the context of a Zone Protection profile, Protocol Protection is the section used to configure protections against activities such as spoofed IP addresses and split handshake session establishment attempts.
These types of attacks typically involve manipulating protocol behaviors, such as IP address spoofing or session hijacking, and are mitigated by the Protocol Protection settings.



Share your comments for Palo Alto Networks NGFW-Engineer exam with other users:

A
AD
10/22/2023 9:08:00 AM

3rd so far, need to cover more

M
Matt
11/18/2023 2:32:00 AM

aligns with the pecd notes

S
Sri
10/15/2023 4:38:00 PM

question 4: b securityadmin is the correct answer. https://docs.snowflake.com/en/user-guide/security-access-control-overview#access-control-framework

H
H.T.M. D
6/25/2023 2:55:00 PM

kindly please share dumps

S
Satish
11/6/2023 4:27:00 AM

it is very useful, thank you

C
Chinna
7/30/2023 8:37:00 AM

need safe rte dumps

1
1234
6/30/2023 3:40:00 AM

can you upload the cis - cpg dumps

D
Did
1/12/2024 3:01:00 AM

q6 = 1. download odt application 2. create a configuration file (xml) 3. setup.exe /download to download the installation files 4. setup.exe /configure to deploy the application

J
John
10/12/2023 12:30:00 PM

great material

D
Dinesh
8/1/2023 2:26:00 PM

could you please upload sap c_arsor_2302 questions? it will be very much helpful.

L
LBert
6/19/2023 10:23:00 AM

vraag 20c: rsa veilig voor symmtrische cryptografie? antwoord c is toch fout. rsa is voor asymmetrische cryptogafie??

G
g
12/22/2023 1:51:00 PM

so far good

M
Milos
8/4/2023 9:33:00 AM

question 31 has obviously wrong answers. tls and ssl are used to encrypt data at transit, not at rest.

D
Diksha
9/25/2023 2:32:00 AM

pls provide dump for 1z0-1080-23 planning exams

H
H
7/17/2023 4:28:00 AM

could you please upload the exam?

A
Anonymous
9/14/2023 4:47:00 AM

please upload this

N
Naveena
1/13/2024 9:55:00 AM

good material

W
WildWilly
1/19/2024 10:43:00 AM

lets see if this is good stuff...

L
Lavanya
11/2/2023 1:53:00 AM

useful information

M
Moussa
12/12/2023 5:52:00 AM

intéressant

M
Madan
6/22/2023 9:22:00 AM

thank you for making the interactive questions

V
Vavz
11/2/2023 6:51:00 AM

questions are accurate

S
Su
11/23/2023 4:34:00 AM

i need questions/dumps for this exam.

L
LuvSN
7/16/2023 11:19:00 AM

i need this exam, when will it be uploaded

M
Mihai
7/19/2023 12:03:00 PM

i need the dumps !

W
Wafa
11/13/2023 3:06:00 AM

very helpful

A
Alokit
7/3/2023 2:13:00 PM

good source

S
Show-Stopper
7/27/2022 11:19:00 PM

my 3rd test and passed on first try. hats off to this brain dumps site.

M
Michelle
6/23/2023 4:06:00 AM

please upload it

L
Lele
11/20/2023 11:55:00 AM

does anybody know if are these real exam questions?

G
Girish Jain
10/9/2023 12:01:00 PM

are these questions similar to actual questions in the exam? because they seem to be too easy

P
Phil
12/8/2022 11:16:00 PM

i have a lot of experience but what comes in the exam is totally different from the practical day to day tasks. so i thought i would rather rely on these brain dumps rather failing the exam.

B
BV
6/8/2023 4:35:00 AM

good questions

K
krishna
12/19/2023 2:05:00 AM

valied exam dumps. they were very helpful and i got a pretty good score. i am very grateful for this service and exam questions

AI Tutor 👋 I’m here to help!