Palo Alto Networks NGFW-Engineer Practice Test 14
Question 130
A validated firewall incident has this root condition: A client retrieves portal configuration but cannot establish its secured remote access tunnel. Which targeted PAN-OS configuration directly addresses the requirement to terminate an authenticated remote VPN connection at the intended gateway?
- Bind the correct contractor authentication profile and permitted identity method.
- Configure split-tunneling entries that match the approved enterprise networks.
- Configure supported internal host detection with a reachable corporate-specific target.
- Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users.
Explanation
Correct Answer
D:Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users. A GlobalProtect gateway authenticates and terminates the remote access connection. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Bind the correct contractor authentication profile and permitted identity method. This configuration is intended to enforce the required external identity realm for contractor access, not to terminate an authenticated remote VPN connection at the intended gateway. Changing this adjacent capability would leave the stated globalprotect gateway connectivity requirement unresolved.
B:Configure split-tunneling entries that match the approved enterprise networks. This configuration is intended to route only approved enterprise destinations through the VPN while keeping local traffic direct, not to terminate an authenticated remote VPN connection at the intended gateway. Changing this adjacent capability would leave the stated globalprotect gateway connectivity requirement unresolved.
C:Configure supported internal host detection with a reachable corporate-specific target. This configuration is intended to distinguish internal from external locations for the GlobalProtect agent, not to terminate an authenticated remote VPN connection at the intended gateway. Changing this adjacent capability would leave the stated globalprotect gateway connectivity requirement unresolved.
Question 131
The team has confirmed its globalprotect authentication profile fault: Contractors authenticate to the wrong identity source when they connect to remote VPN. What configuration should it select to enforce the required external identity realm for contractor access?
- Configure split-tunneling entries that match the approved enterprise networks.
- Install the correct server certificate and complete trusted issuer chain on the gateway.
- Bind the correct contractor authentication profile and permitted identity method.
- Configure the GlobalProtect portal with the required agent profile and approved gateways.
Explanation
Correct Answer
C:Bind the correct contractor authentication profile and permitted identity method. Portal and gateway authentication rules control which principal may establish a session. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure split-tunneling entries that match the approved enterprise networks. This configuration is intended to route only approved enterprise destinations through the VPN while keeping local traffic direct, not to enforce the required external identity realm for contractor access. Changing this adjacent capability would leave the stated globalprotect authentication profile requirement unresolved.
B:Install the correct server certificate and complete trusted issuer chain on the gateway. This configuration is intended to restore trusted gateway identity without bypassing TLS verification, not to enforce the required external identity realm for contractor access. Changing this adjacent capability would leave the stated globalprotect authentication profile requirement unresolved.
D:Configure the GlobalProtect portal with the required agent profile and approved gateways. This configuration is intended to deliver the intended agent and gateway configuration to remote clients, not to enforce the required external identity realm for contractor access. Changing this adjacent capability would leave the stated globalprotect authentication profile requirement unresolved.
Question 132
The engineer has finished diagnosis and must choose an enforceable change. Remote users report that local video meetings unnecessarily traverse corporate VPN. Which implementation best meets the need to route only approved enterprise destinations through the VPN while keeping local traffic direct?
- Install the correct server certificate and complete trusted issuer chain on the gateway.
- Configure split-tunneling entries that match the approved enterprise networks.
- Configure supported internal host detection with a reachable corporate-specific target.
- Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users.
Explanation
Correct Answer
B:Configure split-tunneling entries that match the approved enterprise networks. Split tunneling determines which client destinations enter the VPN instead of every local flow. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Install the correct server certificate and complete trusted issuer chain on the gateway. This configuration is intended to restore trusted gateway identity without bypassing TLS verification, not to route only approved enterprise destinations through the VPN while keeping local traffic direct. Changing this adjacent capability would leave the stated globalprotect split-tunnel routes requirement unresolved.
C:Configure supported internal host detection with a reachable corporate-specific target. This configuration is intended to distinguish internal from external locations for the GlobalProtect agent, not to route only approved enterprise destinations through the VPN while keeping local traffic direct. Changing this adjacent capability would leave the stated globalprotect split-tunnel routes requirement unresolved.
D:Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users. This configuration is intended to terminate an authenticated remote VPN connection at the intended gateway, not to route only approved enterprise destinations through the VPN while keeping local traffic direct. Changing this adjacent capability would leave the stated globalprotect split-tunnel routes requirement unresolved.
Question 133
An approved design change is required after engineers establish: Mobile users reject the gateway certificate after an uncoordinated renewal. Which control directly enables the organization to restore trusted gateway identity without bypassing TLS verification?
- Install the correct server certificate and complete trusted issuer chain on the gateway.
- Configure supported internal host detection with a reachable corporate-specific target.
- Configure the GlobalProtect portal with the required agent profile and approved gateways.
- Bind the correct contractor authentication profile and permitted identity method.
Explanation
Correct Answer
A:Install the correct server certificate and complete trusted issuer chain on the gateway. Client trust requires a valid gateway certificate chain matching its identity. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure supported internal host detection with a reachable corporate-specific target. This configuration is intended to distinguish internal from external locations for the GlobalProtect agent, not to restore trusted gateway identity without bypassing TLS verification. Changing this adjacent capability would leave the stated globalprotect certificate trust requirement unresolved.
C:Configure the GlobalProtect portal with the required agent profile and approved gateways. This configuration is intended to deliver the intended agent and gateway configuration to remote clients, not to restore trusted gateway identity without bypassing TLS verification. Changing this adjacent capability would leave the stated globalprotect certificate trust requirement unresolved.
D:Bind the correct contractor authentication profile and permitted identity method. This configuration is intended to enforce the required external identity realm for contractor access, not to restore trusted gateway identity without bypassing TLS verification. Changing this adjacent capability would leave the stated globalprotect certificate trust requirement unresolved.
Question 134
A validated firewall incident has this root condition: Office laptops repeatedly start an external VPN despite being on the approved corporate LAN. Which targeted PAN-OS configuration directly addresses the requirement to distinguish internal from external locations for the GlobalProtect agent?
- Configure the GlobalProtect portal with the required agent profile and approved gateways.
- Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users.
- Configure split-tunneling entries that match the approved enterprise networks.
- Configure supported internal host detection with a reachable corporate-specific target.
Explanation
Correct Answer
D:Configure supported internal host detection with a reachable corporate-specific target. Internal host detection helps the agent select appropriate internal or external behavior. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure the GlobalProtect portal with the required agent profile and approved gateways. This configuration is intended to deliver the intended agent and gateway configuration to remote clients, not to distinguish internal from external locations for the GlobalProtect agent. Changing this adjacent capability would leave the stated globalprotect internal gateway recognition requirement unresolved.
B:Configure the appropriate GlobalProtect gateway and tunnel attachment for approved users. This configuration is intended to terminate an authenticated remote VPN connection at the intended gateway, not to distinguish internal from external locations for the GlobalProtect agent. Changing this adjacent capability would leave the stated globalprotect internal gateway recognition requirement unresolved.
C:Configure split-tunneling entries that match the approved enterprise networks. This configuration is intended to route only approved enterprise destinations through the VPN while keeping local traffic direct, not to distinguish internal from external locations for the GlobalProtect agent. Changing this adjacent capability would leave the stated globalprotect internal gateway recognition requirement unresolved.
Question 135
The team has confirmed its ipsec ike proposal compatibility fault: Two branch firewalls cannot bring up an IKE security association after their cipher suites diverge. What configuration should it select to negotiate a supported and mutually permitted IKE security association?
- Align the required protected subnet selectors on both sides of the tunnel.
- Enable suitable tunnel monitoring to a reachable protected destination.
- Align the approved IKE crypto parameters and peer identities on both ends.
- Enable the agreed PFS group on matching IPsec crypto profiles.
Explanation
Correct Answer
C:Align the approved IKE crypto parameters and peer identities on both ends. IKE negotiation requires peers to agree on algorithms and identity parameters. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Align the required protected subnet selectors on both sides of the tunnel. This configuration is intended to include the authorized local and remote subnets in tunnel negotiation, not to negotiate a supported and mutually permitted IKE security association. Changing this adjacent capability would leave the stated ipsec ike proposal compatibility requirement unresolved.
B:Enable suitable tunnel monitoring to a reachable protected destination. This configuration is intended to detect forwarding failure beyond tunnel negotiation, not to negotiate a supported and mutually permitted IKE security association. Changing this adjacent capability would leave the stated ipsec ike proposal compatibility requirement unresolved.
D:Enable the agreed PFS group on matching IPsec crypto profiles. This configuration is intended to apply mutually supported PFS parameters for protected sessions, not to negotiate a supported and mutually permitted IKE security association. Changing this adjacent capability would leave the stated ipsec ike proposal compatibility requirement unresolved.
Question 136
The engineer has finished diagnosis and must choose an enforceable change. An IPsec tunnel comes up but a newly added branch subnet is missing from the encrypted traffic selectors. Which implementation best meets the need to include the authorized local and remote subnets in tunnel negotiation?
- Enable suitable tunnel monitoring to a reachable protected destination.
- Align the required protected subnet selectors on both sides of the tunnel.
- Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface.
- Design a staged supported hybrid key-exchange upgrade across compatible endpoints.
Explanation
Correct Answer
B:Align the required protected subnet selectors on both sides of the tunnel. Peer traffic selectors must describe compatible protected network traffic. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Enable suitable tunnel monitoring to a reachable protected destination. This configuration is intended to detect forwarding failure beyond tunnel negotiation, not to include the authorized local and remote subnets in tunnel negotiation. Changing this adjacent capability would leave the stated ipsec traffic selectors requirement unresolved.
C:Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface. This configuration is intended to carry the specified routed traffic in a GRE tunnel with correct peer endpoints, not to include the authorized local and remote subnets in tunnel negotiation. Changing this adjacent capability would leave the stated ipsec traffic selectors requirement unresolved.
D:Design a staged supported hybrid key-exchange upgrade across compatible endpoints. This configuration is intended to deploy only mutually supported quantum-resistant protection without breaking current tunnels, not to include the authorized local and remote subnets in tunnel negotiation. Changing this adjacent capability would leave the stated ipsec traffic selectors requirement unresolved.
Question 137
An approved design change is required after engineers establish: A branch tunnel is established but stops passing application packets after an upstream route changes. Which control directly enables the organization to detect forwarding failure beyond tunnel negotiation?
- Enable suitable tunnel monitoring to a reachable protected destination.
- Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface.
- Enable the agreed PFS group on matching IPsec crypto profiles.
- Align the approved IKE crypto parameters and peer identities on both ends.
Explanation
Correct Answer
A:Enable suitable tunnel monitoring to a reachable protected destination. IKE and IPsec states do not alone prove end-to-end data forwarding. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface. This configuration is intended to carry the specified routed traffic in a GRE tunnel with correct peer endpoints, not to detect forwarding failure beyond tunnel negotiation. Changing this adjacent capability would leave the stated ipsec tunnel monitoring requirement unresolved.
C:Enable the agreed PFS group on matching IPsec crypto profiles. This configuration is intended to apply mutually supported PFS parameters for protected sessions, not to detect forwarding failure beyond tunnel negotiation. Changing this adjacent capability would leave the stated ipsec tunnel monitoring requirement unresolved.
D:Align the approved IKE crypto parameters and peer identities on both ends. This configuration is intended to negotiate a supported and mutually permitted IKE security association, not to detect forwarding failure beyond tunnel negotiation. Changing this adjacent capability would leave the stated ipsec tunnel monitoring requirement unresolved.
Question 138
A validated firewall incident has this root condition: A partner requests GRE encapsulation across a routed transport but no encryption is required by that transport contract. Which targeted PAN-OS configuration directly addresses the requirement to carry the specified routed traffic in a GRE tunnel with correct peer endpoints?
- Enable the agreed PFS group on matching IPsec crypto profiles.
- Design a staged supported hybrid key-exchange upgrade across compatible endpoints.
- Align the required protected subnet selectors on both sides of the tunnel.
- Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface.
Explanation
Correct Answer
D:Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface. GRE is an encapsulation mechanism and does not by itself provide encrypted confidentiality. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Enable the agreed PFS group on matching IPsec crypto profiles. This configuration is intended to apply mutually supported PFS parameters for protected sessions, not to carry the specified routed traffic in a GRE tunnel with correct peer endpoints. Changing this adjacent capability would leave the stated gre tunnel encapsulation requirement unresolved.
B:Design a staged supported hybrid key-exchange upgrade across compatible endpoints. This configuration is intended to deploy only mutually supported quantum-resistant protection without breaking current tunnels, not to carry the specified routed traffic in a GRE tunnel with correct peer endpoints. Changing this adjacent capability would leave the stated gre tunnel encapsulation requirement unresolved.
C:Align the required protected subnet selectors on both sides of the tunnel. This configuration is intended to include the authorized local and remote subnets in tunnel negotiation, not to carry the specified routed traffic in a GRE tunnel with correct peer endpoints. Changing this adjacent capability would leave the stated gre tunnel encapsulation requirement unresolved.
Question 139
The team has confirmed its ipsec perfect forward secrecy fault: A security design requires fresh key agreement for subsequent IPsec child security associations. What configuration should it select to apply mutually supported PFS parameters for protected sessions?
- Design a staged supported hybrid key-exchange upgrade across compatible endpoints.
- Align the approved IKE crypto parameters and peer identities on both ends.
- Enable the agreed PFS group on matching IPsec crypto profiles.
- Enable suitable tunnel monitoring to a reachable protected destination.
Explanation
Correct Answer
C:Enable the agreed PFS group on matching IPsec crypto profiles. PFS requires compatible key-exchange settings during the relevant SA negotiation. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Design a staged supported hybrid key-exchange upgrade across compatible endpoints. This configuration is intended to deploy only mutually supported quantum-resistant protection without breaking current tunnels, not to apply mutually supported PFS parameters for protected sessions. Changing this adjacent capability would leave the stated ipsec perfect forward secrecy requirement unresolved.
B:Align the approved IKE crypto parameters and peer identities on both ends. This configuration is intended to negotiate a supported and mutually permitted IKE security association, not to apply mutually supported PFS parameters for protected sessions. Changing this adjacent capability would leave the stated ipsec perfect forward secrecy requirement unresolved.
D:Enable suitable tunnel monitoring to a reachable protected destination. This configuration is intended to detect forwarding failure beyond tunnel negotiation, not to apply mutually supported PFS parameters for protected sessions. Changing this adjacent capability would leave the stated ipsec perfect forward secrecy requirement unresolved.
Question 140
The engineer has finished diagnosis and must choose an enforceable change. A regulated organization evaluates a hybrid post-quantum VPN exchange but peers have different supported features. Which implementation best meets the need to deploy only mutually supported quantum-resistant protection without breaking current tunnels?
- Align the approved IKE crypto parameters and peer identities on both ends.
- Design a staged supported hybrid key-exchange upgrade across compatible endpoints.
- Align the required protected subnet selectors on both sides of the tunnel.
- Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface.
Explanation
Correct Answer
B:Design a staged supported hybrid key-exchange upgrade across compatible endpoints. Hybrid quantum-resistant deployment depends on actual peer capability and approved interoperability. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Align the approved IKE crypto parameters and peer identities on both ends. This configuration is intended to negotiate a supported and mutually permitted IKE security association, not to deploy only mutually supported quantum-resistant protection without breaking current tunnels. Changing this adjacent capability would leave the stated quantum-resistant ike planning requirement unresolved.
C:Align the required protected subnet selectors on both sides of the tunnel. This configuration is intended to include the authorized local and remote subnets in tunnel negotiation, not to deploy only mutually supported quantum-resistant protection without breaking current tunnels. Changing this adjacent capability would leave the stated quantum-resistant ike planning requirement unresolved.
D:Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface. This configuration is intended to carry the specified routed traffic in a GRE tunnel with correct peer endpoints, not to deploy only mutually supported quantum-resistant protection without breaking current tunnels. Changing this adjacent capability would leave the stated quantum-resistant ike planning requirement unresolved.
