Palo Alto Networks NGFW-Engineer Practice Test 15
Question 140
The engineer has finished diagnosis and must choose an enforceable change. A regulated organization evaluates a hybrid post-quantum VPN exchange but peers have different supported features. Which implementation best meets the need to deploy only mutually supported quantum-resistant protection without breaking current tunnels?
- Align the approved IKE crypto parameters and peer identities on both ends.
- Design a staged supported hybrid key-exchange upgrade across compatible endpoints.
- Align the required protected subnet selectors on both sides of the tunnel.
- Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface.
Explanation
Correct Answer
B:Design a staged supported hybrid key-exchange upgrade across compatible endpoints. Hybrid quantum-resistant deployment depends on actual peer capability and approved interoperability. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Align the approved IKE crypto parameters and peer identities on both ends. This configuration is intended to negotiate a supported and mutually permitted IKE security association, not to deploy only mutually supported quantum-resistant protection without breaking current tunnels. Changing this adjacent capability would leave the stated quantum-resistant ike planning requirement unresolved.
C:Align the required protected subnet selectors on both sides of the tunnel. This configuration is intended to include the authorized local and remote subnets in tunnel negotiation, not to deploy only mutually supported quantum-resistant protection without breaking current tunnels. Changing this adjacent capability would leave the stated quantum-resistant ike planning requirement unresolved.
D:Configure the GRE tunnel endpoints and route selected traffic through the tunnel interface. This configuration is intended to carry the specified routed traffic in a GRE tunnel with correct peer endpoints, not to deploy only mutually supported quantum-resistant protection without breaking current tunnels. Changing this adjacent capability would leave the stated quantum-resistant ike planning requirement unresolved.
Question 141
An approved design change is required after engineers establish: A firewall admin must authenticate through an external RADIUS service, but the login page still accepts only local users. Which control directly enables the organization to authenticate administrators through the approved external identity provider?
- Create the external authentication profile and assign it to the intended administrators.
- Create or assign a read-oriented admin role with only the required monitoring privileges.
- Configure a supported sequence of approved authentication profiles in the intended order.
- Apply an admin role and VSYS scope restricted to the assigned tenant.
Explanation
Correct Answer
A:Create the external authentication profile and assign it to the intended administrators. An admin account's authentication profile determines the external verification path. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Create or assign a read-oriented admin role with only the required monitoring privileges. This configuration is intended to grant administrative tasks at least privilege rather than full device control, not to authenticate administrators through the approved external identity provider. Changing this adjacent capability would leave the stated administrative authentication profile requirement unresolved.
C:Configure a supported sequence of approved authentication profiles in the intended order. This configuration is intended to use a planned authentication sequence with approved fallback behavior, not to authenticate administrators through the approved external identity provider. Changing this adjacent capability would leave the stated administrative authentication profile requirement unresolved.
D:Apply an admin role and VSYS scope restricted to the assigned tenant. This configuration is intended to scope administrators to the virtual systems for which they are responsible, not to authenticate administrators through the approved external identity provider. Changing this adjacent capability would leave the stated administrative authentication profile requirement unresolved.
Question 142
A validated firewall incident has this root condition: A monitoring operator can currently edit security policy although the job only requires viewing alarms. Which targeted PAN-OS configuration directly addresses the requirement to grant administrative tasks at least privilege rather than full device control?
- Configure a supported sequence of approved authentication profiles in the intended order.
- Limit the emergency account, store its credential under controlled access and use named admins normally.
- Attach a log-forwarding profile with the approved external destination to relevant rules.
- Create or assign a read-oriented admin role with only the required monitoring privileges.
Explanation
Correct Answer
D:Create or assign a read-oriented admin role with only the required monitoring privileges. A PAN-OS admin role controls accessible management actions independently of the user's identity. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure a supported sequence of approved authentication profiles in the intended order. This configuration is intended to use a planned authentication sequence with approved fallback behavior, not to grant administrative tasks at least privilege rather than full device control. Changing this adjacent capability would leave the stated administrator role restrictions requirement unresolved.
B:Limit the emergency account, store its credential under controlled access and use named admins normally. This configuration is intended to restrict emergency admin access and retain individual accountability, not to grant administrative tasks at least privilege rather than full device control. Changing this adjacent capability would leave the stated administrator role restrictions requirement unresolved.
C:Attach a log-forwarding profile with the approved external destination to relevant rules. This configuration is intended to forward required traffic records to the selected external receiver, not to grant administrative tasks at least privilege rather than full device control. Changing this adjacent capability would leave the stated administrator role restrictions requirement unresolved.
Question 143
The team has confirmed its authentication profile sequence fallback fault: A team relies on two supported external authentication providers but a temporary outage breaks all admin access. What configuration should it select to use a planned authentication sequence with approved fallback behavior?
- Limit the emergency account, store its credential under controlled access and use named admins normally.
- Create the external authentication profile and assign it to the intended administrators.
- Configure a supported sequence of approved authentication profiles in the intended order.
- Configure the approved syslog server profile and a reachable source interface or service route.
Explanation
Correct Answer
C:Configure a supported sequence of approved authentication profiles in the intended order. An authentication sequence determines which configured profiles are attempted and in what order. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Limit the emergency account, store its credential under controlled access and use named admins normally. This configuration is intended to restrict emergency admin access and retain individual accountability, not to use a planned authentication sequence with approved fallback behavior. Changing this adjacent capability would leave the stated authentication profile sequence fallback requirement unresolved.
B:Create the external authentication profile and assign it to the intended administrators. This configuration is intended to authenticate administrators through the approved external identity provider, not to use a planned authentication sequence with approved fallback behavior. Changing this adjacent capability would leave the stated authentication profile sequence fallback requirement unresolved.
D:Configure the approved syslog server profile and a reachable source interface or service route. This configuration is intended to deliver audit events through the configured service route and transport, not to use a planned authentication sequence with approved fallback behavior. Changing this adjacent capability would leave the stated authentication profile sequence fallback requirement unresolved.
Question 144
The engineer has finished diagnosis and must choose an enforceable change. A break-glass local account must remain available but ordinary operators have begun using it daily. Which implementation best meets the need to restrict emergency admin access and retain individual accountability?
- Create the external authentication profile and assign it to the intended administrators.
- Limit the emergency account, store its credential under controlled access and use named admins normally.
- Create or assign a read-oriented admin role with only the required monitoring privileges.
- Complete supported Strata Logging Service onboarding and enable appropriate forwarding.
Explanation
Correct Answer
B:Limit the emergency account, store its credential under controlled access and use named admins normally. Local break-glass access should not replace accountable routine admin authentication. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Create the external authentication profile and assign it to the intended administrators. This configuration is intended to authenticate administrators through the approved external identity provider, not to restrict emergency admin access and retain individual accountability. Changing this adjacent capability would leave the stated emergency local administrator governance requirement unresolved.
C:Create or assign a read-oriented admin role with only the required monitoring privileges. This configuration is intended to grant administrative tasks at least privilege rather than full device control, not to restrict emergency admin access and retain individual accountability. Changing this adjacent capability would leave the stated emergency local administrator governance requirement unresolved.
D:Complete supported Strata Logging Service onboarding and enable appropriate forwarding. This configuration is intended to send the subscribed event categories to the intended cloud logging service, not to restrict emergency admin access and retain individual accountability. Changing this adjacent capability would leave the stated emergency local administrator governance requirement unresolved.
Question 145
An approved design change is required after engineers establish: One firewall hosts separate tenants but a new port was accidentally assigned to the wrong virtual system. Which control directly enables the organization to keep each tenant's interfaces inside its intended VSYS boundary?
- Assign the new interface to the correct virtual system and intended zone.
- Configure a supported shared-gateway or inter-VSYS connectivity design with scoped security policy.
- Bind the tenant interface and routes to the appropriate virtual router.
- Assign compatible managed firewalls to the intended log collector group and commit the configuration.
Explanation
Correct Answer
A:Assign the new interface to the correct virtual system and intended zone. VSYS boundaries partition supported device configurations across separate logical administrative contexts. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure a supported shared-gateway or inter-VSYS connectivity design with scoped security policy. This configuration is intended to forward only explicitly approved inter-VSYS traffic under policy, not to keep each tenant's interfaces inside its intended VSYS boundary. Changing this adjacent capability would leave the stated vsys interface ownership requirement unresolved.
C:Bind the tenant interface and routes to the appropriate virtual router. This configuration is intended to separate tenant routing decisions within the intended virtual system, not to keep each tenant's interfaces inside its intended VSYS boundary. Changing this adjacent capability would leave the stated vsys interface ownership requirement unresolved.
D:Assign compatible managed firewalls to the intended log collector group and commit the configuration. This configuration is intended to use an appropriate log collector group for centralized ingestion, not to keep each tenant's interfaces inside its intended VSYS boundary. Changing this adjacent capability would leave the stated vsys interface ownership requirement unresolved.
Question 146
A validated firewall incident has this root condition: Two virtual systems on one device need approved service connectivity without merging all their zones. Which targeted PAN-OS configuration directly addresses the requirement to forward only explicitly approved inter-VSYS traffic under policy?
- Bind the tenant interface and routes to the appropriate virtual router.
- Apply an admin role and VSYS scope restricted to the assigned tenant.
- Enable log at session end for the relevant rule and retain the required fields.
- Configure a supported shared-gateway or inter-VSYS connectivity design with scoped security policy.
Explanation
Correct Answer
D:Configure a supported shared-gateway or inter-VSYS connectivity design with scoped security policy. Inter-VSYS communication requires a defined traffic path and explicit policy, not automatic trust. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Bind the tenant interface and routes to the appropriate virtual router. This configuration is intended to separate tenant routing decisions within the intended virtual system, not to forward only explicitly approved inter-VSYS traffic under policy. Changing this adjacent capability would leave the stated inter-vsys transit policy requirement unresolved.
B:Apply an admin role and VSYS scope restricted to the assigned tenant. This configuration is intended to scope administrators to the virtual systems for which they are responsible, not to forward only explicitly approved inter-VSYS traffic under policy. Changing this adjacent capability would leave the stated inter-vsys transit policy requirement unresolved.
C:Enable log at session end for the relevant rule and retain the required fields. This configuration is intended to record meaningful session completion details for the protected rule, not to forward only explicitly approved inter-VSYS traffic under policy. Changing this adjacent capability would leave the stated inter-vsys transit policy requirement unresolved.
Question 147
The team has confirmed its vsys virtual router association fault: A tenant's subnet uses the wrong routing table because the interface belongs to an unrelated virtual router. What configuration should it select to separate tenant routing decisions within the intended virtual system?
- Apply an admin role and VSYS scope restricted to the assigned tenant.
- Assign the new interface to the correct virtual system and intended zone.
- Bind the tenant interface and routes to the appropriate virtual router.
- Constrain forwarding matches to the approved log types and severity criteria.
Explanation
Correct Answer
C:Bind the tenant interface and routes to the appropriate virtual router. An interface routes according to its assigned router or supported logical routing context. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Apply an admin role and VSYS scope restricted to the assigned tenant. This configuration is intended to scope administrators to the virtual systems for which they are responsible, not to separate tenant routing decisions within the intended virtual system. Changing this adjacent capability would leave the stated vsys virtual router association requirement unresolved.
B:Assign the new interface to the correct virtual system and intended zone. This configuration is intended to keep each tenant's interfaces inside its intended VSYS boundary, not to separate tenant routing decisions within the intended virtual system. Changing this adjacent capability would leave the stated vsys virtual router association requirement unresolved.
D:Constrain forwarding matches to the approved log types and severity criteria. This configuration is intended to forward priority security events without dropping required evidence, not to separate tenant routing decisions within the intended virtual system. Changing this adjacent capability would leave the stated vsys virtual router association requirement unresolved.
Question 148
The engineer has finished diagnosis and must choose an enforceable change. A service provider's tenant admin can see settings belonging to another tenant on a shared firewall. Which implementation best meets the need to scope administrators to the virtual systems for which they are responsible?
- Assign the new interface to the correct virtual system and intended zone.
- Apply an admin role and VSYS scope restricted to the assigned tenant.
- Configure a supported shared-gateway or inter-VSYS connectivity design with scoped security policy.
- Schedule the supported upgrade sequence and capture a restorable configuration snapshot.
Explanation
Correct Answer
B:Apply an admin role and VSYS scope restricted to the assigned tenant. Role and virtual-system scoping jointly protect tenant administration boundaries. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Assign the new interface to the correct virtual system and intended zone. This configuration is intended to keep each tenant's interfaces inside its intended VSYS boundary, not to scope administrators to the virtual systems for which they are responsible. Changing this adjacent capability would leave the stated delegated vsys administration requirement unresolved.
C:Configure a supported shared-gateway or inter-VSYS connectivity design with scoped security policy. This configuration is intended to forward only explicitly approved inter-VSYS traffic under policy, not to scope administrators to the virtual systems for which they are responsible. Changing this adjacent capability would leave the stated delegated vsys administration requirement unresolved.
D:Schedule the supported upgrade sequence and capture a restorable configuration snapshot. This configuration is intended to follow a supported upgrade path while preserving recovery options, not to scope administrators to the virtual systems for which they are responsible. Changing this adjacent capability would leave the stated delegated vsys administration requirement unresolved.
Question 149
An approved design change is required after engineers establish: Security sessions generate local logs but nothing arrives in the central event analytics service. Which control directly enables the organization to forward required traffic records to the selected external receiver?
- Attach a log-forwarding profile with the approved external destination to relevant rules.
- Configure the approved syslog server profile and a reachable source interface or service route.
- Complete supported Strata Logging Service onboarding and enable appropriate forwarding.
- Enable log at session end for the relevant rule and retain the required fields.
Explanation
Correct Answer
A:Attach a log-forwarding profile with the approved external destination to relevant rules. Local log generation and external forwarding require distinct configuration steps. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure the approved syslog server profile and a reachable source interface or service route. This configuration is intended to deliver audit events through the configured service route and transport, not to forward required traffic records to the selected external receiver. Changing this adjacent capability would leave the stated traffic log forwarding profile requirement unresolved.
C:Complete supported Strata Logging Service onboarding and enable appropriate forwarding. This configuration is intended to send the subscribed event categories to the intended cloud logging service, not to forward required traffic records to the selected external receiver. Changing this adjacent capability would leave the stated traffic log forwarding profile requirement unresolved.
D:Enable log at session end for the relevant rule and retain the required fields. This configuration is intended to record meaningful session completion details for the protected rule, not to forward required traffic records to the selected external receiver. Changing this adjacent capability would leave the stated traffic log forwarding profile requirement unresolved.
Question 150
A validated firewall incident has this root condition: A firewall has a syslog profile, but management-plane connectivity to the collector is blocked. Which targeted PAN-OS configuration directly addresses the requirement to deliver audit events through the configured service route and transport?
- Complete supported Strata Logging Service onboarding and enable appropriate forwarding.
- Assign compatible managed firewalls to the intended log collector group and commit the configuration.
- Constrain forwarding matches to the approved log types and severity criteria.
- Configure the approved syslog server profile and a reachable source interface or service route.
Explanation
Correct Answer
D:Configure the approved syslog server profile and a reachable source interface or service route. External logging depends on both a valid destination profile and a working forwarding path. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Complete supported Strata Logging Service onboarding and enable appropriate forwarding. This configuration is intended to send the subscribed event categories to the intended cloud logging service, not to deliver audit events through the configured service route and transport. Changing this adjacent capability would leave the stated syslog destination service routing requirement unresolved.
B:Assign compatible managed firewalls to the intended log collector group and commit the configuration. This configuration is intended to use an appropriate log collector group for centralized ingestion, not to deliver audit events through the configured service route and transport. Changing this adjacent capability would leave the stated syslog destination service routing requirement unresolved.
C:Constrain forwarding matches to the approved log types and severity criteria. This configuration is intended to forward priority security events without dropping required evidence, not to deliver audit events through the configured service route and transport. Changing this adjacent capability would leave the stated syslog destination service routing requirement unresolved.
