NGFW-Engineer Exam Questions and Answers

QUESTION: 6

In regard to the Advanced Routing Engine (ARE), what must be enabled first when configuring a logical router on a PAN-OS firewall?

License
Plugin
Content update
General setting

Answer(s): A

Explanation:

To enable the Advanced Routing Engine (ARE) on a Palo Alto Networks firewall, the license for the ARE must be applied first. Without the proper license, the firewall cannot activate and use the advanced routing features provided by ARE, such as support for more complex routing protocols (e.g., BGP, OSPF, etc.).

Once the license is applied and validated, the routing engine can be configured, allowing the creation of logical routers and routing policies.

Reveal Solution Next Question

QUESTION: 7

Which two zone types are valid when configuring a new security zone? (Choose two.)

Tunnel
Intrazone
Internal
Virtual Wire

Answer(s): A,D

Explanation:

When configuring a new security zone on a Palo Alto Networks firewall, the two valid zone types are:
Tunnel: A Tunnel zone is used for traffic that is associated with a VPN tunnel, such as IPSec tunnels. Traffic passing through a tunnel interface is classified into this zone. Virtual Wire: A Virtual Wire zone is used when a firewall operates in transparent mode (also known as Layer 2 mode). In this configuration, the firewall can inspect traffic without modifying the IP address structure of the network.

Reveal Solution Next Question

QUESTION: 8

An organization has configured GlobalProtect in a hybrid authentication model using both certificate- based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.
How does the GlobalProtect agent process the authentication flow on Windows endpoints?

The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.
The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.
Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.
GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre- logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.

Answer(s): A

Explanation:

In a hybrid authentication model with both certificate-based authentication for pre-logon and SAML- based multi-factor authentication (MFA) for user logon, the GlobalProtect agent processes the flow as follows:
During the pre-logon stage, the agent uses the machine certificate to authenticate and establish the initial VPN tunnel.
Once the user logs in (after the machine is connected), the agent then triggers SAML-based MFA to ensure the user is authenticated with multi-factor authentication, validating both the device and the user identity before granting full access.
This method ensures that both the device and user are properly authenticated and validated in the hybrid authentication model.

Reveal Solution Next Question

QUESTION: 9

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups.
Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.
Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup - -> Management in the appropriate templates.
Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.

Answer(s): D

Explanation:

To begin sending logs to Strata Logging Service while continuing to forward them to Panorama log collectors, the necessary configuration is to enable Cloud Logging. This option is configured in the Cloud Logging section under Device Setup Management in the appropriate templates. Once enabled, this ensures that logs are directed both to the Strata Logging Service (cloud) and to the Panorama log collectors.

Reveal Solution Next Question

QUESTION: 10

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.
Which action taken by the engineer will resolve this issue?

Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.
Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

Answer(s): B

Explanation:

In a Layer 2 configuration, interfaces are typically grouped into the same Layer 2 zone.
When the interfaces are assigned to the same VLAN, the firewall will treat them as part of the same broadcast domain.

In a Layer 2 setup, interfaces must be in the same Layer 2 zone to allow the traffic within the same VLAN to pass. Additionally, a security policy must be configured to allow traffic within this VLAN or zone. This will resolve the issue by ensuring that traffic is permitted between clients behind different interfaces assigned to the same VLAN.

Reveal Solution Next Question

Palo Alto Networks NGFW-Engineer Exam (page: 2) Palo Alto Networks Next-Generation Firewall Engineer Updated on: 25-Dec-2025

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

QUESTION: 8

Explanation:

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

Palo Alto Networks NGFW-Engineer Exam (page: 2)
Palo Alto Networks Next-Generation Firewall Engineer
Updated on: 25-Dec-2025