Palo Alto Networks NGFW-Engineer Practice Test 12
Question 110
A validated firewall incident has this root condition: Traffic from a contractor VLAN unexpectedly matches a broad internal allow rule. Which targeted PAN-OS configuration directly addresses the requirement to isolate contractor traffic in the proper source zone and policy scope?
- Create a precise interzone security policy rule for the approved application and destination.
- Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance.
- Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration.
- Move the contractor interface into its intended zone and narrow the matching security policy.
Explanation
Correct Answer
D:Move the contractor interface into its intended zone and narrow the matching security policy. Security policies evaluate zones derived from interfaces along with application, addresses and other attributes. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Create a precise interzone security policy rule for the approved application and destination. This configuration is intended to authorize only specified partner applications across the two zones, not to isolate contractor traffic in the proper source zone and policy scope. Changing this adjacent capability would leave the stated security-zone based rule matching requirement unresolved.
B:Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance. This configuration is intended to make same-zone restrictions explicit where the policy requires them, not to isolate contractor traffic in the proper source zone and policy scope. Changing this adjacent capability would leave the stated security-zone based rule matching requirement unresolved.
C:Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration. This configuration is intended to preserve same-subnet bridging while enforcing the intended security zones, not to isolate contractor traffic in the proper source zone and policy scope. Changing this adjacent capability would leave the stated security-zone based rule matching requirement unresolved.
Question 111
The team has confirmed its interzone default policy handling fault: A newly routed partner segment has reachability but its cross-zone application sessions are denied. What configuration should it select to authorize only specified partner applications across the two zones?
- Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance.
- Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router.
- Create a precise interzone security policy rule for the approved application and destination.
- Pair the ports in a virtual-wire object and assign the intended inspection zones.
Explanation
Correct Answer
C:Create a precise interzone security policy rule for the approved application and destination. Routing reachability does not imply interzone security-policy permission. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance. This configuration is intended to make same-zone restrictions explicit where the policy requires them, not to authorize only specified partner applications across the two zones. Changing this adjacent capability would leave the stated interzone default policy handling requirement unresolved.
B:Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router. This configuration is intended to forward client traffic through the assigned Layer 3 routing context, not to authorize only specified partner applications across the two zones. Changing this adjacent capability would leave the stated interzone default policy handling requirement unresolved.
D:Pair the ports in a virtual-wire object and assign the intended inspection zones. This configuration is intended to inspect packets without inserting a new routed address, not to authorize only specified partner applications across the two zones. Changing this adjacent capability would leave the stated interzone default policy handling requirement unresolved.
Question 112
The engineer has finished diagnosis and must choose an enforceable change. Two hosts in the same security zone communicate despite a team assuming all internal flows are blocked by default. Which implementation best meets the need to make same-zone restrictions explicit where the policy requires them?
- Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router.
- Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance.
- Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration.
- Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration.
Explanation
Correct Answer
B:Introduce a deliberate intrazone security rule matching the prohibited flow ahead of default allowance. Intra-zone traffic can be allowed by a default rule unless a more specific security policy intervenes. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure the Ethernet port as Layer 3 and bind it to the intended zone and virtual router. This configuration is intended to forward client traffic through the assigned Layer 3 routing context, not to make same-zone restrictions explicit where the policy requires them. Changing this adjacent capability would leave the stated intrazone traffic policy behavior requirement unresolved.
C:Set the relevant ports to Layer 2 mode and add them to the appropriate VLAN configuration. This configuration is intended to preserve same-subnet bridging while enforcing the intended security zones, not to make same-zone restrictions explicit where the policy requires them. Changing this adjacent capability would leave the stated intrazone traffic policy behavior requirement unresolved.
D:Attach compatible physical ports to the same aggregate Ethernet interface with matching peer configuration. This configuration is intended to provide resilient aggregate connectivity without a mismatched member, not to make same-zone restrictions explicit where the policy requires them. Changing this adjacent capability would leave the stated intrazone traffic policy behavior requirement unresolved.
Question 113
An approved design change is required after engineers establish: An active/passive pair forms a peer relationship but sessions fail during a controlled failover. Which control directly enables the organization to retain compatible configuration and session behavior across HA peers?
- Configure HA control and state-synchronization links with the necessary peer parameters.
- Configure active/passive HA and appropriate election priorities on the matched peers.
- Enable link monitoring on critical links with a failover action appropriate to the design.
- Configure active/active HA with a suitable session ownership and forwarding design.
Explanation
Correct Answer
A:Configure HA control and state-synchronization links with the necessary peer parameters. HA1 carries control communication while HA2 supports data-plane state synchronization as supported. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure active/passive HA and appropriate election priorities on the matched peers. This configuration is intended to establish the intended single-active failover model, not to retain compatible configuration and session behavior across HA peers. Changing this adjacent capability would leave the stated ha control and data synchronization requirement unresolved.
C:Enable link monitoring on critical links with a failover action appropriate to the design. This configuration is intended to cause failover when designated critical data links fail, not to retain compatible configuration and session behavior across HA peers. Changing this adjacent capability would leave the stated ha control and data synchronization requirement unresolved.
D:Configure active/active HA with a suitable session ownership and forwarding design. This configuration is intended to account for session owner and setup semantics in the active/active design, not to retain compatible configuration and session behavior across HA peers. Changing this adjacent capability would leave the stated ha control and data synchronization requirement unresolved.
Question 114
A validated firewall incident has this root condition: A firewall pair should have one normal traffic-forwarding member and one ready standby but both attempt active forwarding. Which targeted PAN-OS configuration directly addresses the requirement to establish the intended single-active failover model?
- Enable link monitoring on critical links with a failover action appropriate to the design.
- Set HA path monitoring for representative critical routed destinations.
- Align supported software and relevant HA peer settings before production pairing.
- Configure active/passive HA and appropriate election priorities on the matched peers.
Explanation
Correct Answer
D:Configure active/passive HA and appropriate election priorities on the matched peers. Active/passive HA uses one forwarding peer at a time under normal conditions. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Enable link monitoring on critical links with a failover action appropriate to the design. This configuration is intended to cause failover when designated critical data links fail, not to establish the intended single-active failover model. Changing this adjacent capability would leave the stated active/passive ha role placement requirement unresolved.
B:Set HA path monitoring for representative critical routed destinations. This configuration is intended to make HA respond to loss of a required upstream path, not to establish the intended single-active failover model. Changing this adjacent capability would leave the stated active/passive ha role placement requirement unresolved.
C:Align supported software and relevant HA peer settings before production pairing. This configuration is intended to prepare compatible peers before enabling production failover, not to establish the intended single-active failover model. Changing this adjacent capability would leave the stated active/passive ha role placement requirement unresolved.
Question 115
The team has confirmed its ha link monitoring fault: A production port fails on the active firewall while its HA heartbeat remains healthy. What configuration should it select to cause failover when designated critical data links fail?
- Set HA path monitoring for representative critical routed destinations.
- Configure active/active HA with a suitable session ownership and forwarding design.
- Enable link monitoring on critical links with a failover action appropriate to the design.
- Choose preemption behavior and priorities to match the change-control requirement.
Explanation
Correct Answer
C:Enable link monitoring on critical links with a failover action appropriate to the design. Link monitoring triggers HA action from port failure independently of HA heartbeat health. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Set HA path monitoring for representative critical routed destinations. This configuration is intended to make HA respond to loss of a required upstream path, not to cause failover when designated critical data links fail. Changing this adjacent capability would leave the stated ha link monitoring requirement unresolved.
B:Configure active/active HA with a suitable session ownership and forwarding design. This configuration is intended to account for session owner and setup semantics in the active/active design, not to cause failover when designated critical data links fail. Changing this adjacent capability would leave the stated ha link monitoring requirement unresolved.
D:Choose preemption behavior and priorities to match the change-control requirement. This configuration is intended to avoid unnecessary traffic disruption from automatic role preemption, not to cause failover when designated critical data links fail. Changing this adjacent capability would leave the stated ha link monitoring requirement unresolved.
Question 116
The engineer has finished diagnosis and must choose an enforceable change. A routed upstream next hop becomes unreachable even though the firewall Ethernet link stays up. Which implementation best meets the need to make HA respond to loss of a required upstream path?
- Configure active/active HA with a suitable session ownership and forwarding design.
- Set HA path monitoring for representative critical routed destinations.
- Align supported software and relevant HA peer settings before production pairing.
- Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair.
Explanation
Correct Answer
B:Set HA path monitoring for representative critical routed destinations. Path monitoring detects reachability failure beyond a locally operational interface. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure active/active HA with a suitable session ownership and forwarding design. This configuration is intended to account for session owner and setup semantics in the active/active design, not to make HA respond to loss of a required upstream path. Changing this adjacent capability would leave the stated ha path monitoring requirement unresolved.
C:Align supported software and relevant HA peer settings before production pairing. This configuration is intended to prepare compatible peers before enabling production failover, not to make HA respond to loss of a required upstream path. Changing this adjacent capability would leave the stated ha path monitoring requirement unresolved.
D:Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair. This configuration is intended to limit simultaneous-forwarding risk under control-link failure, not to make HA respond to loss of a required upstream path. Changing this adjacent capability would leave the stated ha path monitoring requirement unresolved.
Question 117
An approved design change is required after engineers establish: An active/active pair handles traffic asymmetrically and engineers must identify which peer owns a session. Which control directly enables the organization to account for session owner and setup semantics in the active/active design?
- Configure active/active HA with a suitable session ownership and forwarding design.
- Align supported software and relevant HA peer settings before production pairing.
- Choose preemption behavior and priorities to match the change-control requirement.
- Configure HA control and state-synchronization links with the necessary peer parameters.
Explanation
Correct Answer
A:Configure active/active HA with a suitable session ownership and forwarding design. Active/active HA requires explicit treatment of session handling across concurrently forwarding peers. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Align supported software and relevant HA peer settings before production pairing. This configuration is intended to prepare compatible peers before enabling production failover, not to account for session owner and setup semantics in the active/active design. Changing this adjacent capability would leave the stated active/active ha session ownership requirement unresolved.
C:Choose preemption behavior and priorities to match the change-control requirement. This configuration is intended to avoid unnecessary traffic disruption from automatic role preemption, not to account for session owner and setup semantics in the active/active design. Changing this adjacent capability would leave the stated active/active ha session ownership requirement unresolved.
D:Configure HA control and state-synchronization links with the necessary peer parameters. This configuration is intended to retain compatible configuration and session behavior across HA peers, not to account for session owner and setup semantics in the active/active design. Changing this adjacent capability would leave the stated active/active ha session ownership requirement unresolved.
Question 118
A validated firewall incident has this root condition: Two prospective HA peers run incompatible configurations and never become a stable synchronized pair. Which targeted PAN-OS configuration directly addresses the requirement to prepare compatible peers before enabling production failover?
- Choose preemption behavior and priorities to match the change-control requirement.
- Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair.
- Configure active/passive HA and appropriate election priorities on the matched peers.
- Align supported software and relevant HA peer settings before production pairing.
Explanation
Correct Answer
D:Align supported software and relevant HA peer settings before production pairing. HA peers need supported compatibility and matched synchronization settings before resilience testing. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Choose preemption behavior and priorities to match the change-control requirement. This configuration is intended to avoid unnecessary traffic disruption from automatic role preemption, not to prepare compatible peers before enabling production failover. Changing this adjacent capability would leave the stated ha configuration compatibility requirement unresolved.
B:Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair. This configuration is intended to limit simultaneous-forwarding risk under control-link failure, not to prepare compatible peers before enabling production failover. Changing this adjacent capability would leave the stated ha configuration compatibility requirement unresolved.
C:Configure active/passive HA and appropriate election priorities on the matched peers. This configuration is intended to establish the intended single-active failover model, not to prepare compatible peers before enabling production failover. Changing this adjacent capability would leave the stated ha configuration compatibility requirement unresolved.
Question 119
The team has confirmed its ha election preemption fault: An HA pair unexpectedly switches back to its preferred node as soon as that node returns from maintenance. What configuration should it select to avoid unnecessary traffic disruption from automatic role preemption?
- Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair.
- Configure HA control and state-synchronization links with the necessary peer parameters.
- Choose preemption behavior and priorities to match the change-control requirement.
- Enable link monitoring on critical links with a failover action appropriate to the design.
Explanation
Correct Answer
C:Choose preemption behavior and priorities to match the change-control requirement. Preemption policy affects whether the preferred HA peer reclaims active status automatically. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair. This configuration is intended to limit simultaneous-forwarding risk under control-link failure, not to avoid unnecessary traffic disruption from automatic role preemption. Changing this adjacent capability would leave the stated ha election preemption requirement unresolved.
B:Configure HA control and state-synchronization links with the necessary peer parameters. This configuration is intended to retain compatible configuration and session behavior across HA peers, not to avoid unnecessary traffic disruption from automatic role preemption. Changing this adjacent capability would leave the stated ha election preemption requirement unresolved.
D:Enable link monitoring on critical links with a failover action appropriate to the design. This configuration is intended to cause failover when designated critical data links fail, not to avoid unnecessary traffic disruption from automatic role preemption. Changing this adjacent capability would leave the stated ha election preemption requirement unresolved.
Question 120
The engineer has finished diagnosis and must choose an enforceable change. Two HA nodes lose control-plane contact while each has live data links to the protected networks. Which implementation best meets the need to limit simultaneous-forwarding risk under control-link failure?
- Configure HA control and state-synchronization links with the necessary peer parameters.
- Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair.
- Configure active/passive HA and appropriate election priorities on the matched peers.
- Set HA path monitoring for representative critical routed destinations.
Explanation
Correct Answer
B:Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair. Loss of peer control connectivity needs deliberate design to reduce dual-active failures. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure HA control and state-synchronization links with the necessary peer parameters. This configuration is intended to retain compatible configuration and session behavior across HA peers, not to limit simultaneous-forwarding risk under control-link failure. Changing this adjacent capability would leave the stated ha split-brain recovery requirement unresolved.
C:Configure active/passive HA and appropriate election priorities on the matched peers. This configuration is intended to establish the intended single-active failover model, not to limit simultaneous-forwarding risk under control-link failure. Changing this adjacent capability would leave the stated ha split-brain recovery requirement unresolved.
D:Set HA path monitoring for representative critical routed destinations. This configuration is intended to make HA respond to loss of a required upstream path, not to limit simultaneous-forwarding risk under control-link failure. Changing this adjacent capability would leave the stated ha split-brain recovery requirement unresolved.
