Palo Alto Networks NGFW-Engineer Practice Test 10
Question 90
In a controlled network review, the reported condition is: A daily configuration job creates duplicate tags because its logic appends instead of reconciling existing objects. The team needs to apply repeatable configuration changes without duplicate definitions. What diagnostic should precede a change request?
- Inspect terraform plan output for creates, updates, replacements and policy drift.
- Inspect inventory targeting, playbook scope, module compatibility and intended diffs.
- Inspect the XML API request type and expected operational response structure.
- Inspect the prior object state and compare desired versus actual configurations.
Explanation
Correct Answer
D:Inspect the prior object state and compare desired versus actual configurations. Idempotent automation converges to a desired state rather than duplicating resources on retries. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect terraform plan output for creates, updates, replacements and policy drift. That check is directed at terraform plan review, a different failure mechanism. It does not isolate the reported automation idempotent object creation dependency, which must be examined before a remedy is selected.
B:Inspect inventory targeting, playbook scope, module compatibility and intended diffs. That check is directed at ansible repeatable pan-os configuration, a different failure mechanism. It does not isolate the reported automation idempotent object creation dependency, which must be examined before a remedy is selected.
C:Inspect the XML API request type and expected operational response structure. That check is directed at pan-os xml api operational query, a different failure mechanism. It does not isolate the reported automation idempotent object creation dependency, which must be examined before a remedy is selected.
Question 91
An engineer is troubleshooting terraform plan review. The observed condition is: A Terraform job for new cloud firewalls would replace production resources, but nobody reviews the generated plan. Which evidence-gathering action best establishes how to review infrastructure changes before mutating the deployed security environment?
- Inspect inventory targeting, playbook scope, module compatibility and intended diffs.
- Inspect target PAN-OS version, supported REST endpoint and request schema.
- Inspect terraform plan output for creates, updates, replacements and policy drift.
- Inspect runner secret storage, key ownership, permissions and credential lifetime.
Explanation
Correct Answer
C:Inspect terraform plan output for creates, updates, replacements and policy drift. A plan review exposes proposed infrastructure changes before execution. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect inventory targeting, playbook scope, module compatibility and intended diffs. That check is directed at ansible repeatable pan-os configuration, a different failure mechanism. It does not isolate the reported terraform plan review dependency, which must be examined before a remedy is selected.
B:Inspect target PAN-OS version, supported REST endpoint and request schema. That check is directed at pan-os rest api object change, a different failure mechanism. It does not isolate the reported terraform plan review dependency, which must be examined before a remedy is selected.
D:Inspect runner secret storage, key ownership, permissions and credential lifetime. That check is directed at api access authentication, a different failure mechanism. It does not isolate the reported terraform plan review dependency, which must be examined before a remedy is selected.
Question 92
A security operations change cannot proceed until the cause is clear. The report states: A team repeatedly configures the same approved policy by hand across branch firewalls and changes drift. Which first check best supports the requirement to apply versioned and repeatable configuration through supported automation?
- Inspect target PAN-OS version, supported REST endpoint and request schema.
- Inspect inventory targeting, playbook scope, module compatibility and intended diffs.
- Inspect the XML API request type and expected operational response structure.
- Inspect the prior object state and compare desired versus actual configurations.
Explanation
Correct Answer
B:Inspect inventory targeting, playbook scope, module compatibility and intended diffs. Ansible can standardize declared firewall changes when inventory and modules are compatible. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect target PAN-OS version, supported REST endpoint and request schema. That check is directed at pan-os rest api object change, a different failure mechanism. It does not isolate the reported ansible repeatable pan-os configuration dependency, which must be examined before a remedy is selected.
C:Inspect the XML API request type and expected operational response structure. That check is directed at pan-os xml api operational query, a different failure mechanism. It does not isolate the reported ansible repeatable pan-os configuration dependency, which must be examined before a remedy is selected.
D:Inspect the prior object state and compare desired versus actual configurations. That check is directed at automation idempotent object creation, a different failure mechanism. It does not isolate the reported ansible repeatable pan-os configuration dependency, which must be examined before a remedy is selected.
Question 93
A firewall engineering team reports the following: A site policy accidentally applies to every firewall because engineers created it in a shared scope. The operational requirement is to scope policy to the intended managed-firewall population. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Inspect the rule's shared or device-group location and target firewall membership.
- Inspect the ordered templates in the stack and duplicate setting values.
- Inspect inherited pre-rules, local rule order and the first matched policy.
- Check Panorama committed configuration, push job status and managed-firewall config sync.
Explanation
Correct Answer
A:Inspect the rule's shared or device-group location and target firewall membership. Device groups control centrally managed policy scope, while shared settings reach broadly. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Inspect the ordered templates in the stack and duplicate setting values. That check is directed at panorama template stack precedence, a different failure mechanism. It does not isolate the reported panorama device group policy scope dependency, which must be examined before a remedy is selected.
C:Inspect inherited pre-rules, local rule order and the first matched policy. That check is directed at panorama pre-rule enforcement order, a different failure mechanism. It does not isolate the reported panorama device group policy scope dependency, which must be examined before a remedy is selected.
D:Check Panorama committed configuration, push job status and managed-firewall config sync. That check is directed at panorama commit and push sequence, a different failure mechanism. It does not isolate the reported panorama device group policy scope dependency, which must be examined before a remedy is selected.
Question 94
In a controlled network review, the reported condition is: Two templates in one stack define different DNS servers and managed firewalls receive the wrong value. The team needs to apply the intended device-network setting according to stack precedence. What diagnostic should precede a change request?
- Inspect inherited pre-rules, local rule order and the first matched policy.
- Inspect the effective hierarchy including local and device-group post-rules.
- Inspect Panorama HA peer state, synchronization and management reachability.
- Inspect the ordered templates in the stack and duplicate setting values.
Explanation
Correct Answer
D:Inspect the ordered templates in the stack and duplicate setting values. Higher templates in a stack take precedence when they define the same setting. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect inherited pre-rules, local rule order and the first matched policy. That check is directed at panorama pre-rule enforcement order, a different failure mechanism. It does not isolate the reported panorama template stack precedence dependency, which must be examined before a remedy is selected.
B:Inspect the effective hierarchy including local and device-group post-rules. That check is directed at panorama post-rule fallback, a different failure mechanism. It does not isolate the reported panorama template stack precedence dependency, which must be examined before a remedy is selected.
C:Inspect Panorama HA peer state, synchronization and management reachability. That check is directed at panorama ha management continuity, a different failure mechanism. It does not isolate the reported panorama template stack precedence dependency, which must be examined before a remedy is selected.
Question 95
An engineer is troubleshooting panorama pre-rule enforcement order. The observed condition is: A mandatory organization-wide block is bypassed by a more permissive local firewall rule. Which evidence-gathering action best establishes how to enforce the shared security restriction before local rules are evaluated?
- Inspect the effective hierarchy including local and device-group post-rules.
- Check Panorama committed configuration, push job status and managed-firewall config sync.
- Inspect inherited pre-rules, local rule order and the first matched policy.
- Inspect available ACC data sources, filters and application risk categories.
Explanation
Correct Answer
C:Inspect inherited pre-rules, local rule order and the first matched policy. Panorama pre-rules are evaluated before local firewall rules in their effective hierarchy. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the effective hierarchy including local and device-group post-rules. That check is directed at panorama post-rule fallback, a different failure mechanism. It does not isolate the reported panorama pre-rule enforcement order dependency, which must be examined before a remedy is selected.
B:Check Panorama committed configuration, push job status and managed-firewall config sync. That check is directed at panorama commit and push sequence, a different failure mechanism. It does not isolate the reported panorama pre-rule enforcement order dependency, which must be examined before a remedy is selected.
D:Inspect available ACC data sources, filters and application risk categories. That check is directed at acc dashboard traffic visibility, a different failure mechanism. It does not isolate the reported panorama pre-rule enforcement order dependency, which must be examined before a remedy is selected.
Question 96
A security operations change cannot proceed until the cause is clear. The report states: The organization needs a catch-all restriction evaluated after site-specific local exceptions. Which first check best supports the requirement to enforce the residual restriction after permitted local rules?
- Check Panorama committed configuration, push job status and managed-firewall config sync.
- Inspect the effective hierarchy including local and device-group post-rules.
- Inspect Panorama HA peer state, synchronization and management reachability.
- Inspect report query filters, data availability and the intended schedule.
Explanation
Correct Answer
B:Inspect the effective hierarchy including local and device-group post-rules. Panorama post-rules follow local rules and can provide centralized fallback enforcement. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Check Panorama committed configuration, push job status and managed-firewall config sync. That check is directed at panorama commit and push sequence, a different failure mechanism. It does not isolate the reported panorama post-rule fallback dependency, which must be examined before a remedy is selected.
C:Inspect Panorama HA peer state, synchronization and management reachability. That check is directed at panorama ha management continuity, a different failure mechanism. It does not isolate the reported panorama post-rule fallback dependency, which must be examined before a remedy is selected.
D:Inspect report query filters, data availability and the intended schedule. That check is directed at scheduled custom management reports, a different failure mechanism. It does not isolate the reported panorama post-rule fallback dependency, which must be examined before a remedy is selected.
Question 97
A firewall engineering team reports the following: A security rule is committed in Panorama but the managed firewall still uses an older configuration. The operational requirement is to activate the intended centralized change on the target firewall. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Check Panorama committed configuration, push job status and managed-firewall config sync.
- Inspect Panorama HA peer state, synchronization and management reachability.
- Inspect available ACC data sources, filters and application risk categories.
- Inspect the rule's shared or device-group location and target firewall membership.
Explanation
Correct Answer
A:Check Panorama committed configuration, push job status and managed-firewall config sync. Committing Panorama settings alone does not automatically push their running configuration to managed firewalls. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Inspect Panorama HA peer state, synchronization and management reachability. That check is directed at panorama ha management continuity, a different failure mechanism. It does not isolate the reported panorama commit and push sequence dependency, which must be examined before a remedy is selected.
C:Inspect available ACC data sources, filters and application risk categories. That check is directed at acc dashboard traffic visibility, a different failure mechanism. It does not isolate the reported panorama commit and push sequence dependency, which must be examined before a remedy is selected.
D:Inspect the rule's shared or device-group location and target firewall membership. That check is directed at panorama device group policy scope, a different failure mechanism. It does not isolate the reported panorama commit and push sequence dependency, which must be examined before a remedy is selected.
Question 98
In a controlled network review, the reported condition is: The primary Panorama appliance becomes unreachable and staff lose management visibility despite having a standby. The team needs to maintain centralized management availability during node failure. What diagnostic should precede a change request?
- Inspect available ACC data sources, filters and application risk categories.
- Inspect report query filters, data availability and the intended schedule.
- Inspect the ordered templates in the stack and duplicate setting values.
- Inspect Panorama HA peer state, synchronization and management reachability.
Explanation
Correct Answer
D:Inspect Panorama HA peer state, synchronization and management reachability. Management high availability requires supported peer synchronization and a tested recovery path. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect available ACC data sources, filters and application risk categories. That check is directed at acc dashboard traffic visibility, a different failure mechanism. It does not isolate the reported panorama ha management continuity dependency, which must be examined before a remedy is selected.
B:Inspect report query filters, data availability and the intended schedule. That check is directed at scheduled custom management reports, a different failure mechanism. It does not isolate the reported panorama ha management continuity dependency, which must be examined before a remedy is selected.
C:Inspect the ordered templates in the stack and duplicate setting values. That check is directed at panorama template stack precedence, a different failure mechanism. It does not isolate the reported panorama ha management continuity dependency, which must be examined before a remedy is selected.
Question 99
An engineer is troubleshooting acc dashboard traffic visibility. The observed condition is: The SOC sees raw traffic records but cannot quickly distinguish application risk patterns by business segment. Which evidence-gathering action best establishes how to present a useful Application Command Center view for triage?
- Inspect report query filters, data availability and the intended schedule.
- Inspect the rule's shared or device-group location and target firewall membership.
- Inspect available ACC data sources, filters and application risk categories.
- Inspect inherited pre-rules, local rule order and the first matched policy.
Explanation
Correct Answer
C:Inspect available ACC data sources, filters and application risk categories. ACC combines application-aware firewall telemetry into investigation views. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect report query filters, data availability and the intended schedule. That check is directed at scheduled custom management reports, a different failure mechanism. It does not isolate the reported acc dashboard traffic visibility dependency, which must be examined before a remedy is selected.
B:Inspect the rule's shared or device-group location and target firewall membership. That check is directed at panorama device group policy scope, a different failure mechanism. It does not isolate the reported acc dashboard traffic visibility dependency, which must be examined before a remedy is selected.
D:Inspect inherited pre-rules, local rule order and the first matched policy. That check is directed at panorama pre-rule enforcement order, a different failure mechanism. It does not isolate the reported acc dashboard traffic visibility dependency, which must be examined before a remedy is selected.
Question 100
A security operations change cannot proceed until the cause is clear. The report states: Regional managers need recurring security summaries but receive manual screenshots with inconsistent filters. Which first check best supports the requirement to deliver repeatable scoped reports from firewall or Panorama data?
- Inspect the rule's shared or device-group location and target firewall membership.
- Inspect report query filters, data availability and the intended schedule.
- Inspect the ordered templates in the stack and duplicate setting values.
- Inspect the effective hierarchy including local and device-group post-rules.
Explanation
Correct Answer
B:Inspect report query filters, data availability and the intended schedule. Custom reports require stable data filters, schedule and distribution scope. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the rule's shared or device-group location and target firewall membership. That check is directed at panorama device group policy scope, a different failure mechanism. It does not isolate the reported scheduled custom management reports dependency, which must be examined before a remedy is selected.
C:Inspect the ordered templates in the stack and duplicate setting values. That check is directed at panorama template stack precedence, a different failure mechanism. It does not isolate the reported scheduled custom management reports dependency, which must be examined before a remedy is selected.
D:Inspect the effective hierarchy including local and device-group post-rules. That check is directed at panorama post-rule fallback, a different failure mechanism. It does not isolate the reported scheduled custom management reports dependency, which must be examined before a remedy is selected.
