Palo Alto Networks NGFW-Engineer Practice Test 11
Question 100
A security operations change cannot proceed until the cause is clear. The report states: Regional managers need recurring security summaries but receive manual screenshots with inconsistent filters. Which first check best supports the requirement to deliver repeatable scoped reports from firewall or Panorama data?
- Inspect the rule's shared or device-group location and target firewall membership.
- Inspect report query filters, data availability and the intended schedule.
- Inspect the ordered templates in the stack and duplicate setting values.
- Inspect the effective hierarchy including local and device-group post-rules.
Explanation
Correct Answer
B:Inspect report query filters, data availability and the intended schedule. Custom reports require stable data filters, schedule and distribution scope. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the rule's shared or device-group location and target firewall membership. That check is directed at panorama device group policy scope, a different failure mechanism. It does not isolate the reported scheduled custom management reports dependency, which must be examined before a remedy is selected.
C:Inspect the ordered templates in the stack and duplicate setting values. That check is directed at panorama template stack precedence, a different failure mechanism. It does not isolate the reported scheduled custom management reports dependency, which must be examined before a remedy is selected.
D:Inspect the effective hierarchy including local and device-group post-rules. That check is directed at panorama post-rule fallback, a different failure mechanism. It does not isolate the reported scheduled custom management reports dependency, which must be examined before a remedy is selected.
Question 101
An approved design change is required after engineers establish: A newly connected campus uplink has an IP address, but the firewall cannot route client packets through it. Which control directly enables the organization to forward client traffic through the assigned Layer 3 routing context?
- Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router.
- Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration.
- Pair the ports in a virtual-wire object and assign the intended inspection zones.
- Align LACP configuration and compatible interface membership on the firewall and adjacent switch.
Explanation
Correct Answer
A:Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router. Layer 3 forwarding needs an interface address and a routing context; a cable link alone is not a route. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration. This configuration is intended to preserve same-subnet bridging while enforcing the intended security zones, not to forward client traffic through the assigned Layer 3 routing context. Changing this adjacent capability would leave the stated layer 3 interface membership requirement unresolved.
C:Pair the ports in a virtual-wire object and assign the intended inspection zones. This configuration is intended to inspect packets without inserting a new routed address, not to forward client traffic through the assigned Layer 3 routing context. Changing this adjacent capability would leave the stated layer 3 interface membership requirement unresolved.
D:Align LACP configuration and compatible interface membership on the firewall and adjacent switch. This configuration is intended to establish a negotiated, consistent multi-link aggregate, not to forward client traffic through the assigned Layer 3 routing context. Changing this adjacent capability would leave the stated layer 3 interface membership requirement unresolved.
Question 102
A validated firewall incident has this root condition: A legacy finance VLAN must cross two firewall ports without changing the subnet gateway. Which targeted PAN-OS configuration directly addresses the requirement to preserve same-subnet bridging while enforcing the intended security zones?
- Pair the ports in a virtual-wire object and assign the intended inspection zones.
- Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration.
- Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership.
- Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration.
Explanation
Correct Answer
D:Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration. Layer 2 interfaces bridge Ethernet frames within a VLAN instead of creating a routed next hop. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Pair the ports in a virtual-wire object and assign the intended inspection zones. This configuration is intended to inspect packets without inserting a new routed address, not to preserve same-subnet bridging while enforcing the intended security zones. Changing this adjacent capability would leave the stated layer 2 vlan bridging requirement unresolved.
B:Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration. This configuration is intended to provide resilient aggregate connectivity without a mismatched member, not to preserve same-subnet bridging while enforcing the intended security zones. Changing this adjacent capability would leave the stated layer 2 vlan bridging requirement unresolved.
C:Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership. This configuration is intended to make encrypted branch traffic traverse an intended logical tunnel interface, not to preserve same-subnet bridging while enforcing the intended security zones. Changing this adjacent capability would leave the stated layer 2 vlan bridging requirement unresolved.
Question 103
The team has confirmed its virtual wire inline inspection fault: An existing routed circuit needs inline inspection while upstream and downstream device IP addresses must remain unchanged. What configuration should it select to inspect packets without inserting a new routed address?
- Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration.
- Align LACP configuration and compatible interface membership on the firewall and adjacent switch.
- Pair the ports in a virtual-wire object and assign the intended inspection zones.
- Use dedicated management connectivity and allow administration only from approved management sources.
Explanation
Correct Answer
C:Pair the ports in a virtual-wire object and assign the intended inspection zones. Virtual wire is an inline transparent forwarding arrangement, not a replacement IP gateway. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration. This configuration is intended to provide resilient aggregate connectivity without a mismatched member, not to inspect packets without inserting a new routed address. Changing this adjacent capability would leave the stated virtual wire inline inspection requirement unresolved.
B:Align LACP configuration and compatible interface membership on the firewall and adjacent switch. This configuration is intended to establish a negotiated, consistent multi-link aggregate, not to inspect packets without inserting a new routed address. Changing this adjacent capability would leave the stated virtual wire inline inspection requirement unresolved.
D:Use dedicated management connectivity and allow administration only from approved management sources. This configuration is intended to separate administrative access from ordinary production forwarding, not to inspect packets without inserting a new routed address. Changing this adjacent capability would leave the stated virtual wire inline inspection requirement unresolved.
Question 104
The engineer has finished diagnosis and must choose an enforceable change. Two data-center firewall uplinks must operate as one logical aggregate but only one is forwarding. Which implementation best meets the need to provide resilient aggregate connectivity without a mismatched member?
- Align LACP configuration and compatible interface membership on the firewall and adjacent switch.
- Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration.
- Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership.
- Configure matching tagged subinterfaces and bind each to its correct zone and routing context.
Explanation
Correct Answer
B:Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration. An AE interface binds multiple eligible physical links into one logical attachment. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Align LACP configuration and compatible interface membership on the firewall and adjacent switch. This configuration is intended to establish a negotiated, consistent multi-link aggregate, not to provide resilient aggregate connectivity without a mismatched member. Changing this adjacent capability would leave the stated aggregate ethernet member consistency requirement unresolved.
C:Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership. This configuration is intended to make encrypted branch traffic traverse an intended logical tunnel interface, not to provide resilient aggregate connectivity without a mismatched member. Changing this adjacent capability would leave the stated aggregate ethernet member consistency requirement unresolved.
D:Configure matching tagged subinterfaces and bind each to its correct zone and routing context. This configuration is intended to map each tagged tenant network to the intended security boundary, not to provide resilient aggregate connectivity without a mismatched member. Changing this adjacent capability would leave the stated aggregate ethernet member consistency requirement unresolved.
Question 105
An approved design change is required after engineers establish: A switch expects LACP on an aggregate uplink, but the firewall peer was left in an incompatible aggregation mode. Which control directly enables the organization to establish a negotiated, consistent multi-link aggregate?
- Align LACP configuration and compatible interface membership on the firewall and adjacent switch.
- Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership.
- Use dedicated management connectivity and allow administration only from approved management sources.
- Apply a narrowly scoped interface management profile exposing only approved tests.
Explanation
Correct Answer
A:Align LACP configuration and compatible interface membership on the firewall and adjacent switch. Aggregation negotiation fails when endpoints use incompatible link-grouping behavior. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership. This configuration is intended to make encrypted branch traffic traverse an intended logical tunnel interface, not to establish a negotiated, consistent multi-link aggregate. Changing this adjacent capability would leave the stated lacp negotiation mismatch requirement unresolved.
C:Use dedicated management connectivity and allow administration only from approved management sources. This configuration is intended to separate administrative access from ordinary production forwarding, not to establish a negotiated, consistent multi-link aggregate. Changing this adjacent capability would leave the stated lacp negotiation mismatch requirement unresolved.
D:Apply a narrowly scoped interface management profile exposing only approved tests. This configuration is intended to permit only required diagnostic traffic on that interface, not to establish a negotiated, consistent multi-link aggregate. Changing this adjacent capability would leave the stated lacp negotiation mismatch requirement unresolved.
Question 106
A validated firewall incident has this root condition: A branch IPsec tunnel shows IKE negotiation but payload traffic has no usable routed tunnel attachment. Which targeted PAN-OS configuration directly addresses the requirement to make encrypted branch traffic traverse an intended logical tunnel interface?
- Use dedicated management connectivity and allow administration only from approved management sources.
- Configure matching tagged subinterfaces and bind each to its correct zone and routing context.
- Move the contractor interface into its intended zone and narrow the matching security policy.
- Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership.
Explanation
Correct Answer
D:Bind the IPsec tunnel to a tunnel interface with the correct zone and routing membership. IKE negotiation alone does not connect the tunnel into the security and routing path. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Use dedicated management connectivity and allow administration only from approved management sources. This configuration is intended to separate administrative access from ordinary production forwarding, not to make encrypted branch traffic traverse an intended logical tunnel interface. Changing this adjacent capability would leave the stated ipsec tunnel interface binding requirement unresolved.
B:Configure matching tagged subinterfaces and bind each to its correct zone and routing context. This configuration is intended to map each tagged tenant network to the intended security boundary, not to make encrypted branch traffic traverse an intended logical tunnel interface. Changing this adjacent capability would leave the stated ipsec tunnel interface binding requirement unresolved.
C:Move the contractor interface into its intended zone and narrow the matching security policy. This configuration is intended to isolate contractor traffic in the proper source zone and policy scope, not to make encrypted branch traffic traverse an intended logical tunnel interface. Changing this adjacent capability would leave the stated ipsec tunnel interface binding requirement unresolved.
Question 107
The team has confirmed its management interface separation fault: Administrators accidentally connected the firewall management plane to a shared user transit network. What configuration should it select to separate administrative access from ordinary production forwarding?
- Configure matching tagged subinterfaces and bind each to its correct zone and routing context.
- Apply a narrowly scoped interface management profile exposing only approved tests.
- Use dedicated management connectivity and allow administration only from approved management sources.
- Create a precise interzone security policy rule for the approved application and destination.
Explanation
Correct Answer
C:Use dedicated management connectivity and allow administration only from approved management sources. A dedicated management plane narrows the administrative attack surface independently of transit interfaces. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure matching tagged subinterfaces and bind each to its correct zone and routing context. This configuration is intended to map each tagged tenant network to the intended security boundary, not to separate administrative access from ordinary production forwarding. Changing this adjacent capability would leave the stated management interface separation requirement unresolved.
B:Apply a narrowly scoped interface management profile exposing only approved tests. This configuration is intended to permit only required diagnostic traffic on that interface, not to separate administrative access from ordinary production forwarding. Changing this adjacent capability would leave the stated management interface separation requirement unresolved.
D:Create a precise interzone security policy rule for the approved application and destination. This configuration is intended to authorize only specified partner applications across the two zones, not to separate administrative access from ordinary production forwarding. Changing this adjacent capability would leave the stated management interface separation requirement unresolved.
Question 108
The engineer has finished diagnosis and must choose an enforceable change. A trunk carries three tenant VLANs, but traffic for one VLAN appears in the wrong security zone. Which implementation best meets the need to map each tagged tenant network to the intended security boundary?
- Apply a narrowly scoped interface management profile exposing only approved tests.
- Configure matching tagged subinterfaces and bind each to its correct zone and routing context.
- Move the contractor interface into its intended zone and narrow the matching security policy.
- Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance.
Explanation
Correct Answer
B:Configure matching tagged subinterfaces and bind each to its correct zone and routing context. 802.1Q tags identify logical subinterfaces; the correct zone and router still need explicit assignment. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Apply a narrowly scoped interface management profile exposing only approved tests. This configuration is intended to permit only required diagnostic traffic on that interface, not to map each tagged tenant network to the intended security boundary. Changing this adjacent capability would leave the stated tagged subinterface assignment requirement unresolved.
C:Move the contractor interface into its intended zone and narrow the matching security policy. This configuration is intended to isolate contractor traffic in the proper source zone and policy scope, not to map each tagged tenant network to the intended security boundary. Changing this adjacent capability would leave the stated tagged subinterface assignment requirement unresolved.
D:Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance. This configuration is intended to make same-zone restrictions explicit where the policy requires them, not to map each tagged tenant network to the intended security boundary. Changing this adjacent capability would leave the stated tagged subinterface assignment requirement unresolved.
Question 109
An approved design change is required after engineers establish: An engineer enabled ping tests on a data interface, but management protocols became reachable from an untrusted segment. Which control directly enables the organization to permit only required diagnostic traffic on that interface?
- Apply a narrowly scoped interface management profile exposing only approved tests.
- Move the contractor interface into its intended zone and narrow the matching security policy.
- Create a precise interzone security policy rule for the approved application and destination.
- Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router.
Explanation
Correct Answer
A:Apply a narrowly scoped interface management profile exposing only approved tests. Management profiles gate device services on data interfaces and should not expose unrestricted administration. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Move the contractor interface into its intended zone and narrow the matching security policy. This configuration is intended to isolate contractor traffic in the proper source zone and policy scope, not to permit only required diagnostic traffic on that interface. Changing this adjacent capability would leave the stated interface management profile access requirement unresolved.
C:Create a precise interzone security policy rule for the approved application and destination. This configuration is intended to authorize only specified partner applications across the two zones, not to permit only required diagnostic traffic on that interface. Changing this adjacent capability would leave the stated interface management profile access requirement unresolved.
D:Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router. This configuration is intended to forward client traffic through the assigned Layer 3 routing context, not to permit only required diagnostic traffic on that interface. Changing this adjacent capability would leave the stated interface management profile access requirement unresolved.
Question 110
A validated firewall incident has this root condition: Traffic from a contractor VLAN unexpectedly matches a broad internal allow rule. Which targeted PAN-OS configuration directly addresses the requirement to isolate contractor traffic in the proper source zone and policy scope?
- Create a precise interzone security policy rule for the approved application and destination.
- Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance.
- Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration.
- Move the contractor interface into its intended zone and narrow the matching security policy.
Explanation
Correct Answer
D:Move the contractor interface into its intended zone and narrow the matching security policy. Security policies evaluate zones derived from interfaces along with application, addresses and other attributes. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Create a precise interzone security policy rule for the approved application and destination. This configuration is intended to authorize only specified partner applications across the two zones, not to isolate contractor traffic in the proper source zone and policy scope. Changing this adjacent capability would leave the stated security-zone based rule matching requirement unresolved.
B:Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance. This configuration is intended to make same-zone restrictions explicit where the policy requires them, not to isolate contractor traffic in the proper source zone and policy scope. Changing this adjacent capability would leave the stated security-zone based rule matching requirement unresolved.
C:Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration. This configuration is intended to preserve same-subnet bridging while enforcing the intended security zones, not to isolate contractor traffic in the proper source zone and policy scope. Changing this adjacent capability would leave the stated security-zone based rule matching requirement unresolved.
