Palo Alto Networks NGFW-Engineer Practice Test 13
Question 120
The engineer has finished diagnosis and must choose an enforceable change. Two HA nodes lose control-plane contact while each has live data links to the protected networks. Which implementation best meets the need to limit simultaneous-forwarding risk under control-link failure?
- Configure HA control and state-synchronization links with the necessary peer parameters.
- Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair.
- Configure active/passive HA and appropriate election priorities on the matched peers.
- Set HA path monitoring for representative critical routed destinations.
Explanation
Correct Answer
B:Add supported HA heartbeat resiliency and appropriate fail-safe design to the pair. Loss of peer control connectivity needs deliberate design to reduce dual-active failures. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure HA control and state-synchronization links with the necessary peer parameters. This configuration is intended to retain compatible configuration and session behavior across HA peers, not to limit simultaneous-forwarding risk under control-link failure. Changing this adjacent capability would leave the stated ha split-brain recovery requirement unresolved.
C:Configure active/passive HA and appropriate election priorities on the matched peers. This configuration is intended to establish the intended single-active failover model, not to limit simultaneous-forwarding risk under control-link failure. Changing this adjacent capability would leave the stated ha split-brain recovery requirement unresolved.
D:Set HA path monitoring for representative critical routed destinations. This configuration is intended to make HA respond to loss of a required upstream path, not to limit simultaneous-forwarding risk under control-link failure. Changing this adjacent capability would leave the stated ha split-brain recovery requirement unresolved.
Question 121
An approved design change is required after engineers establish: A migration introduces logical routers, but a new uplink is still attached to an old forwarding context. Which control directly enables the organization to place each routed interface into the intended Advanced Routing Engine logical router?
- Assign the Layer 3 interface and required routes to the correct logical router.
- Create a static route for the supplier prefix with the appropriate interface and next hop.
- Configure the correct BGP neighbor, peer AS and permitted session parameters.
- Apply restrictive redistribution rules matching just the approved static prefixes.
Explanation
Correct Answer
A:Assign the Layer 3 interface and required routes to the correct logical router. An IP interface must be associated with the routing instance that makes forwarding decisions. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Create a static route for the supplier prefix with the appropriate interface and next hop. This configuration is intended to install a precise next hop for the supplier destination, not to place each routed interface into the intended Advanced Routing Engine logical router. Changing this adjacent capability would leave the stated advanced routing engine logical routers requirement unresolved.
C:Configure the correct BGP neighbor, peer AS and permitted session parameters. This configuration is intended to exchange routing information with the authorized external neighbor, not to place each routed interface into the intended Advanced Routing Engine logical router. Changing this adjacent capability would leave the stated advanced routing engine logical routers requirement unresolved.
D:Apply restrictive redistribution rules matching just the approved static prefixes. This configuration is intended to export only approved network routes to the neighboring protocol domain, not to place each routed interface into the intended Advanced Routing Engine logical router. Changing this adjacent capability would leave the stated advanced routing engine logical routers requirement unresolved.
Question 122
A validated firewall incident has this root condition: A firewall has a connected path to its ISP but no route toward a remote supplier prefix. Which targeted PAN-OS configuration directly addresses the requirement to install a precise next hop for the supplier destination?
- Configure the correct BGP neighbor, peer AS and permitted session parameters.
- Align compatible OSPF area and interface parameters between adjacent routers.
- Configure route monitoring and appropriate alternative default-route preference.
- Create a static route for the supplier prefix with the appropriate interface and next hop.
Explanation
Correct Answer
D:Create a static route for the supplier prefix with the appropriate interface and next hop. A specific static destination route must identify how packets leave the router. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure the correct BGP neighbor, peer AS and permitted session parameters. This configuration is intended to exchange routing information with the authorized external neighbor, not to install a precise next hop for the supplier destination. Changing this adjacent capability would leave the stated static route next hop requirement unresolved.
B:Align compatible OSPF area and interface parameters between adjacent routers. This configuration is intended to form a stable adjacency in the intended area, not to install a precise next hop for the supplier destination. Changing this adjacent capability would leave the stated static route next hop requirement unresolved.
C:Configure route monitoring and appropriate alternative default-route preference. This configuration is intended to withdraw an unusable primary route and use a valid backup path, not to install a precise next hop for the supplier destination. Changing this adjacent capability would leave the stated static route next hop requirement unresolved.
Question 123
The team has confirmed its bgp peer establishment fault: A new transit peer never reaches established BGP state despite a functioning physical circuit. What configuration should it select to exchange routing information with the authorized external neighbor?
- Align compatible OSPF area and interface parameters between adjacent routers.
- Apply restrictive redistribution rules matching just the approved static prefixes.
- Configure the correct BGP neighbor, peer AS and permitted session parameters.
- Configure supported equal-cost multipath routing consistent with the session design.
Explanation
Correct Answer
C:Configure the correct BGP neighbor, peer AS and permitted session parameters. A BGP adjacency requires compatible peer parameters and transport reachability before routes can exchange. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Align compatible OSPF area and interface parameters between adjacent routers. This configuration is intended to form a stable adjacency in the intended area, not to exchange routing information with the authorized external neighbor. Changing this adjacent capability would leave the stated bgp peer establishment requirement unresolved.
B:Apply restrictive redistribution rules matching just the approved static prefixes. This configuration is intended to export only approved network routes to the neighboring protocol domain, not to exchange routing information with the authorized external neighbor. Changing this adjacent capability would leave the stated bgp peer establishment requirement unresolved.
D:Configure supported equal-cost multipath routing consistent with the session design. This configuration is intended to use supported multipath forwarding without breaking stateful inspection, not to exchange routing information with the authorized external neighbor. Changing this adjacent capability would leave the stated bgp peer establishment requirement unresolved.
Question 124
The engineer has finished diagnosis and must choose an enforceable change. A campus OSPF neighbor is stuck below full adjacency after a router migration. Which implementation best meets the need to form a stable adjacency in the intended area?
- Apply restrictive redistribution rules matching just the approved static prefixes.
- Align compatible OSPF area and interface parameters between adjacent routers.
- Configure route monitoring and appropriate alternative default-route preference.
- Install the intended more-specific destination prefix with a valid next hop.
Explanation
Correct Answer
B:Align compatible OSPF area and interface parameters between adjacent routers. OSPF peers must agree on key adjacency parameters to share link-state information. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Apply restrictive redistribution rules matching just the approved static prefixes. This configuration is intended to export only approved network routes to the neighboring protocol domain, not to form a stable adjacency in the intended area. Changing this adjacent capability would leave the stated ospf area adjacency requirement unresolved.
C:Configure route monitoring and appropriate alternative default-route preference. This configuration is intended to withdraw an unusable primary route and use a valid backup path, not to form a stable adjacency in the intended area. Changing this adjacent capability would leave the stated ospf area adjacency requirement unresolved.
D:Install the intended more-specific destination prefix with a valid next hop. This configuration is intended to select the most specific eligible destination route, not to form a stable adjacency in the intended area. Changing this adjacent capability would leave the stated ospf area adjacency requirement unresolved.
Question 125
An approved design change is required after engineers establish: A branch advertises too many internal prefixes after adding redistribution from a static table. Which control directly enables the organization to export only approved network routes to the neighboring protocol domain?
- Apply restrictive redistribution rules matching just the approved static prefixes.
- Configure route monitoring and appropriate alternative default-route preference.
- Configure supported equal-cost multipath routing consistent with the session design.
- Assign the Layer 3 interface and required routes to the correct logical router.
Explanation
Correct Answer
A:Apply restrictive redistribution rules matching just the approved static prefixes. Redistribution policy should limit route propagation rather than import an entire source table. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure route monitoring and appropriate alternative default-route preference. This configuration is intended to withdraw an unusable primary route and use a valid backup path, not to export only approved network routes to the neighboring protocol domain. Changing this adjacent capability would leave the stated route redistribution control requirement unresolved.
C:Configure supported equal-cost multipath routing consistent with the session design. This configuration is intended to use supported multipath forwarding without breaking stateful inspection, not to export only approved network routes to the neighboring protocol domain. Changing this adjacent capability would leave the stated route redistribution control requirement unresolved.
D:Assign the Layer 3 interface and required routes to the correct logical router. This configuration is intended to place each routed interface into the intended Advanced Routing Engine logical router, not to export only approved network routes to the neighboring protocol domain. Changing this adjacent capability would leave the stated route redistribution control requirement unresolved.
Question 126
A validated firewall incident has this root condition: A static ISP default route stays installed even after the upstream connection beyond its first hop fails. Which targeted PAN-OS configuration directly addresses the requirement to withdraw an unusable primary route and use a valid backup path?
- Configure supported equal-cost multipath routing consistent with the session design.
- Install the intended more-specific destination prefix with a valid next hop.
- Create a static route for the supplier prefix with the appropriate interface and next hop.
- Configure route monitoring and appropriate alternative default-route preference.
Explanation
Correct Answer
D:Configure route monitoring and appropriate alternative default-route preference. Route monitoring can detect remote unreachability despite an operational local interface. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure supported equal-cost multipath routing consistent with the session design. This configuration is intended to use supported multipath forwarding without breaking stateful inspection, not to withdraw an unusable primary route and use a valid backup path. Changing this adjacent capability would leave the stated monitored default route requirement unresolved.
B:Install the intended more-specific destination prefix with a valid next hop. This configuration is intended to select the most specific eligible destination route, not to withdraw an unusable primary route and use a valid backup path. Changing this adjacent capability would leave the stated monitored default route requirement unresolved.
C:Create a static route for the supplier prefix with the appropriate interface and next hop. This configuration is intended to install a precise next hop for the supplier destination, not to withdraw an unusable primary route and use a valid backup path. Changing this adjacent capability would leave the stated monitored default route requirement unresolved.
Question 127
The team has confirmed its equal-cost forwarding design fault: A data center introduces two equal-cost WAN paths but the traffic distribution differs from the routing team's expectation. What configuration should it select to use supported multipath forwarding without breaking stateful inspection?
- Install the intended more-specific destination prefix with a valid next hop.
- Assign the Layer 3 interface and required routes to the correct logical router.
- Configure supported equal-cost multipath routing consistent with the session design.
- Configure the correct BGP neighbor, peer AS and permitted session parameters.
Explanation
Correct Answer
C:Configure supported equal-cost multipath routing consistent with the session design. ECMP distributes selected flows over eligible next hops and needs a compatible bidirectional design. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Install the intended more-specific destination prefix with a valid next hop. This configuration is intended to select the most specific eligible destination route, not to use supported multipath forwarding without breaking stateful inspection. Changing this adjacent capability would leave the stated equal-cost forwarding design requirement unresolved.
B:Assign the Layer 3 interface and required routes to the correct logical router. This configuration is intended to place each routed interface into the intended Advanced Routing Engine logical router, not to use supported multipath forwarding without breaking stateful inspection. Changing this adjacent capability would leave the stated equal-cost forwarding design requirement unresolved.
D:Configure the correct BGP neighbor, peer AS and permitted session parameters. This configuration is intended to exchange routing information with the authorized external neighbor, not to use supported multipath forwarding without breaking stateful inspection. Changing this adjacent capability would leave the stated equal-cost forwarding design requirement unresolved.
Question 128
The engineer has finished diagnosis and must choose an enforceable change. Traffic for a specific partner subnet incorrectly follows a broader default route. Which implementation best meets the need to select the most specific eligible destination route?
- Assign the Layer 3 interface and required routes to the correct logical router.
- Install the intended more-specific destination prefix with a valid next hop.
- Create a static route for the supplier prefix with the appropriate interface and next hop.
- Align compatible OSPF area and interface parameters between adjacent routers.
Explanation
Correct Answer
B:Install the intended more-specific destination prefix with a valid next hop. Longest-prefix matching selects the most specific applicable destination route. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Assign the Layer 3 interface and required routes to the correct logical router. This configuration is intended to place each routed interface into the intended Advanced Routing Engine logical router, not to select the most specific eligible destination route. Changing this adjacent capability would leave the stated route selection and specificity requirement unresolved.
C:Create a static route for the supplier prefix with the appropriate interface and next hop. This configuration is intended to install a precise next hop for the supplier destination, not to select the most specific eligible destination route. Changing this adjacent capability would leave the stated route selection and specificity requirement unresolved.
D:Align compatible OSPF area and interface parameters between adjacent routers. This configuration is intended to form a stable adjacency in the intended area, not to select the most specific eligible destination route. Changing this adjacent capability would leave the stated route selection and specificity requirement unresolved.
Question 129
An approved design change is required after engineers establish: Remote employees receive portal settings but no stable list of appropriate VPN gateways. Which control directly enables the organization to deliver the intended agent and gateway configuration to remote clients?
- Configure the GlobalProtect portal with the required agent profile and approved gateways.
- Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users.
- Bind the correct contractor authentication profile and permitted identity method.
- Install the correct server certificate and complete trusted issuer chain on the gateway.
Explanation
Correct Answer
A:Configure the GlobalProtect portal with the required agent profile and approved gateways. A GlobalProtect portal distributes client configuration and gateway selection information. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users. This configuration is intended to terminate an authenticated remote VPN connection at the intended gateway, not to deliver the intended agent and gateway configuration to remote clients. Changing this adjacent capability would leave the stated globalprotect portal configuration requirement unresolved.
C:Bind the correct contractor authentication profile and permitted identity method. This configuration is intended to enforce the required external identity realm for contractor access, not to deliver the intended agent and gateway configuration to remote clients. Changing this adjacent capability would leave the stated globalprotect portal configuration requirement unresolved.
D:Install the correct server certificate and complete trusted issuer chain on the gateway. This configuration is intended to restore trusted gateway identity without bypassing TLS verification, not to deliver the intended agent and gateway configuration to remote clients. Changing this adjacent capability would leave the stated globalprotect portal configuration requirement unresolved.
Question 130
A validated firewall incident has this root condition: A client retrieves portal configuration but cannot establish its secured remote access tunnel. Which targeted PAN-OS configuration directly addresses the requirement to terminate an authenticated remote VPN connection at the intended gateway?
- Bind the correct contractor authentication profile and permitted identity method.
- Configure split-tunneling entries that match the approved enterprise networks.
- Configure supported internal host detection with a reachable corporate-specific target.
- Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users.
Explanation
Correct Answer
D:Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users. A GlobalProtect gateway authenticates and terminates the remote access connection. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Bind the correct contractor authentication profile and permitted identity method. This configuration is intended to enforce the required external identity realm for contractor access, not to terminate an authenticated remote VPN connection at the intended gateway. Changing this adjacent capability would leave the stated globalprotect gateway connectivity requirement unresolved.
B:Configure split-tunneling entries that match the approved enterprise networks. This configuration is intended to route only approved enterprise destinations through the VPN while keeping local traffic direct, not to terminate an authenticated remote VPN connection at the intended gateway. Changing this adjacent capability would leave the stated globalprotect gateway connectivity requirement unresolved.
C:Configure supported internal host detection with a reachable corporate-specific target. This configuration is intended to distinguish internal from external locations for the GlobalProtect agent, not to terminate an authenticated remote VPN connection at the intended gateway. Changing this adjacent capability would leave the stated globalprotect gateway connectivity requirement unresolved.
