Palo Alto Networks NGFW-Engineer Practice Test 16
Question 150
A validated firewall incident has this root condition: A firewall has a syslog profile, but management-plane connectivity to the collector is blocked. Which targeted PAN-OS configuration directly addresses the requirement to deliver audit events through the configured service route and transport?
- Complete supported Strata Logging Service onboarding and enable appropriate forwarding.
- Assign compatible managed firewalls to the intended log collector group and commit the configuration.
- Constrain forwarding matches to the approved log types and severity criteria.
- Configure the approved syslog server profile and a reachable source interface or service route.
Explanation
Correct Answer
D:Configure the approved syslog server profile and a reachable source interface or service route. External logging depends on both a valid destination profile and a working forwarding path. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Complete supported Strata Logging Service onboarding and enable appropriate forwarding. This configuration is intended to send the subscribed event categories to the intended cloud logging service, not to deliver audit events through the configured service route and transport. Changing this adjacent capability would leave the stated syslog destination service routing requirement unresolved.
B:Assign compatible managed firewalls to the intended log collector group and commit the configuration. This configuration is intended to use an appropriate log collector group for centralized ingestion, not to deliver audit events through the configured service route and transport. Changing this adjacent capability would leave the stated syslog destination service routing requirement unresolved.
C:Constrain forwarding matches to the approved log types and severity criteria. This configuration is intended to forward priority security events without dropping required evidence, not to deliver audit events through the configured service route and transport. Changing this adjacent capability would leave the stated syslog destination service routing requirement unresolved.
Question 151
The team has confirmed its strata logging service enablement fault: A tenant expects cloud-managed log retention but its firewalls are not associated with the logging service. What configuration should it select to send the subscribed event categories to the intended cloud logging service?
- Assign compatible managed firewalls to the intended log collector group and commit the configuration.
- Enable log at session end for the relevant rule and retain the required fields.
- Complete supported Strata Logging Service onboarding and enable appropriate forwarding.
- Attach a log-forwarding profile with the approved external destination to relevant rules.
Explanation
Correct Answer
C:Complete supported Strata Logging Service onboarding and enable appropriate forwarding. Cloud logging needs entitlement, device association and successful delivery, not just local records. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Assign compatible managed firewalls to the intended log collector group and commit the configuration. This configuration is intended to use an appropriate log collector group for centralized ingestion, not to send the subscribed event categories to the intended cloud logging service. Changing this adjacent capability would leave the stated strata logging service enablement requirement unresolved.
B:Enable log at session end for the relevant rule and retain the required fields. This configuration is intended to record meaningful session completion details for the protected rule, not to send the subscribed event categories to the intended cloud logging service. Changing this adjacent capability would leave the stated strata logging service enablement requirement unresolved.
D:Attach a log-forwarding profile with the approved external destination to relevant rules. This configuration is intended to forward required traffic records to the selected external receiver, not to send the subscribed event categories to the intended cloud logging service. Changing this adjacent capability would leave the stated strata logging service enablement requirement unresolved.
Question 152
The engineer has finished diagnosis and must choose an enforceable change. Several firewalls forward data to Panorama-managed collectors but capacity is unbalanced. Which implementation best meets the need to use an appropriate log collector group for centralized ingestion?
- Enable log at session end for the relevant rule and retain the required fields.
- Assign compatible managed firewalls to the intended log collector group and commit the configuration.
- Constrain forwarding matches to the approved log types and severity criteria.
- Configure the approved syslog server profile and a reachable source interface or service route.
Explanation
Correct Answer
B:Assign compatible managed firewalls to the intended log collector group and commit the configuration. Log collector groups coordinate the configured collection services for managed firewalls. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Enable log at session end for the relevant rule and retain the required fields. This configuration is intended to record meaningful session completion details for the protected rule, not to use an appropriate log collector group for centralized ingestion. Changing this adjacent capability would leave the stated panorama log collector group requirement unresolved.
C:Constrain forwarding matches to the approved log types and severity criteria. This configuration is intended to forward priority security events without dropping required evidence, not to use an appropriate log collector group for centralized ingestion. Changing this adjacent capability would leave the stated panorama log collector group requirement unresolved.
D:Configure the approved syslog server profile and a reachable source interface or service route. This configuration is intended to deliver audit events through the configured service route and transport, not to use an appropriate log collector group for centralized ingestion. Changing this adjacent capability would leave the stated panorama log collector group requirement unresolved.
Question 153
An approved design change is required after engineers establish: Investigators see connection starts but cannot establish session duration or bytes transferred. Which control directly enables the organization to record meaningful session completion details for the protected rule?
- Enable log at session end for the relevant rule and retain the required fields.
- Constrain forwarding matches to the approved log types and severity criteria.
- Attach a log-forwarding profile with the approved external destination to relevant rules.
- Complete supported Strata Logging Service onboarding and enable appropriate forwarding.
Explanation
Correct Answer
A:Enable log at session end for the relevant rule and retain the required fields. Session-end records provide observed completion information unavailable from start-only events. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Constrain forwarding matches to the approved log types and severity criteria. This configuration is intended to forward priority security events without dropping required evidence, not to record meaningful session completion details for the protected rule. Changing this adjacent capability would leave the stated traffic session end logging requirement unresolved.
C:Attach a log-forwarding profile with the approved external destination to relevant rules. This configuration is intended to forward required traffic records to the selected external receiver, not to record meaningful session completion details for the protected rule. Changing this adjacent capability would leave the stated traffic session end logging requirement unresolved.
D:Complete supported Strata Logging Service onboarding and enable appropriate forwarding. This configuration is intended to send the subscribed event categories to the intended cloud logging service, not to record meaningful session completion details for the protected rule. Changing this adjacent capability would leave the stated traffic session end logging requirement unresolved.
Question 154
A validated firewall incident has this root condition: A broad forwarding profile overwhelms an event receiver with routine low-risk records. Which targeted PAN-OS configuration directly addresses the requirement to forward priority security events without dropping required evidence?
- Attach a log-forwarding profile with the approved external destination to relevant rules.
- Configure the approved syslog server profile and a reachable source interface or service route.
- Assign compatible managed firewalls to the intended log collector group and commit the configuration.
- Constrain forwarding matches to the approved log types and severity criteria.
Explanation
Correct Answer
D:Constrain forwarding matches to the approved log types and severity criteria. Match lists select which event categories and severities leave the firewall. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Attach a log-forwarding profile with the approved external destination to relevant rules. This configuration is intended to forward required traffic records to the selected external receiver, not to forward priority security events without dropping required evidence. Changing this adjacent capability would leave the stated log forwarding filter precision requirement unresolved.
B:Configure the approved syslog server profile and a reachable source interface or service route. This configuration is intended to deliver audit events through the configured service route and transport, not to forward priority security events without dropping required evidence. Changing this adjacent capability would leave the stated log forwarding filter precision requirement unresolved.
C:Assign compatible managed firewalls to the intended log collector group and commit the configuration. This configuration is intended to use an appropriate log collector group for centralized ingestion, not to forward priority security events without dropping required evidence. Changing this adjacent capability would leave the stated log forwarding filter precision requirement unresolved.
Question 155
The team has confirmed its pan-os upgrade path prerequisites fault: An operations team plans an immediate firewall upgrade but the required intermediate software and backup checks are unknown. What configuration should it select to follow a supported upgrade path while preserving recovery options?
- Upgrade the passive member first according to the supported HA procedure, then complete the peer sequence.
- Install and schedule supported applications-and-threats content updates for the device.
- Schedule the supported upgrade sequence and capture a restorable configuration snapshot.
- Assign a certificate profile with the appropriate trusted CA and identity requirements.
Explanation
Correct Answer
C:Schedule the supported upgrade sequence and capture a restorable configuration snapshot. PAN-OS upgrades require release-path checks and controlled recovery preparation. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Upgrade the passive member first according to the supported HA procedure, then complete the peer sequence. This configuration is intended to upgrade HA members in a controlled order with failover testing, not to follow a supported upgrade path while preserving recovery options. Changing this adjacent capability would leave the stated pan-os upgrade path prerequisites requirement unresolved.
B:Install and schedule supported applications-and-threats content updates for the device. This configuration is intended to refresh compatible content updates without unintentionally changing operating software, not to follow a supported upgrade path while preserving recovery options. Changing this adjacent capability would leave the stated pan-os upgrade path prerequisites requirement unresolved.
D:Assign a certificate profile with the appropriate trusted CA and identity requirements. This configuration is intended to enforce trusted client certificate authentication criteria, not to follow a supported upgrade path while preserving recovery options. Changing this adjacent capability would leave the stated pan-os upgrade path prerequisites requirement unresolved.
Question 156
The engineer has finished diagnosis and must choose an enforceable change. A high-availability pair needs a software update without a planned simultaneous traffic outage. Which implementation best meets the need to upgrade HA members in a controlled order with failover testing?
- Install and schedule supported applications-and-threats content updates for the device.
- Upgrade the passive member first according to the supported HA procedure, then complete the peer sequence.
- Save a verified prechange configuration and define a rollback procedure before deployment.
- Bind a supported SSL/TLS service profile containing the valid issued certificate.
Explanation
Correct Answer
B:Upgrade the passive member first according to the supported HA procedure, then complete the peer sequence. Staged HA maintenance limits service interruption compared with rebooting both members together. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Install and schedule supported applications-and-threats content updates for the device. This configuration is intended to refresh compatible content updates without unintentionally changing operating software, not to upgrade HA members in a controlled order with failover testing. Changing this adjacent capability would leave the stated ha software upgrade sequencing requirement unresolved.
C:Save a verified prechange configuration and define a rollback procedure before deployment. This configuration is intended to restore known-good configuration safely after an unsuccessful change, not to upgrade HA members in a controlled order with failover testing. Changing this adjacent capability would leave the stated ha software upgrade sequencing requirement unresolved.
D:Bind a supported SSL/TLS service profile containing the valid issued certificate. This configuration is intended to serve the intended trusted certificate for administrative TLS, not to upgrade HA members in a controlled order with failover testing. Changing this adjacent capability would leave the stated ha software upgrade sequencing requirement unresolved.
Question 157
An approved design change is required after engineers establish: Threat signatures are stale even though the installed PAN-OS base release has not changed. Which control directly enables the organization to refresh compatible content updates without unintentionally changing operating software?
- Install and schedule supported applications-and-threats content updates for the device.
- Save a verified prechange configuration and define a rollback procedure before deployment.
- Schedule the supported upgrade sequence and capture a restorable configuration snapshot.
- Stage the replacement certificate and update only the intended service bindings.
Explanation
Correct Answer
A:Install and schedule supported applications-and-threats content updates for the device. Dynamic content packages and PAN-OS software releases have separate lifecycle controls. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Save a verified prechange configuration and define a rollback procedure before deployment. This configuration is intended to restore known-good configuration safely after an unsuccessful change, not to refresh compatible content updates without unintentionally changing operating software. Changing this adjacent capability would leave the stated content update dependencies requirement unresolved.
C:Schedule the supported upgrade sequence and capture a restorable configuration snapshot. This configuration is intended to follow a supported upgrade path while preserving recovery options, not to refresh compatible content updates without unintentionally changing operating software. Changing this adjacent capability would leave the stated content update dependencies requirement unresolved.
D:Stage the replacement certificate and update only the intended service bindings. This configuration is intended to maintain usable trusted certificates throughout the gateway cutover, not to refresh compatible content updates without unintentionally changing operating software. Changing this adjacent capability would leave the stated content update dependencies requirement unresolved.
Question 158
A validated firewall incident has this root condition: A firewall change fails acceptance, but the team has only an exported screenshot of the prior policy. Which targeted PAN-OS configuration directly addresses the requirement to restore known-good configuration safely after an unsuccessful change?
- Schedule the supported upgrade sequence and capture a restorable configuration snapshot.
- Upgrade the passive member first according to the supported HA procedure, then complete the peer sequence.
- Configure supported revocation verification in the client certificate authentication profile.
- Save a verified prechange configuration and define a rollback procedure before deployment.
Explanation
Correct Answer
D:Save a verified prechange configuration and define a rollback procedure before deployment. A recoverable configuration snapshot is stronger than screenshots or an undocumented undo plan. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Schedule the supported upgrade sequence and capture a restorable configuration snapshot. This configuration is intended to follow a supported upgrade path while preserving recovery options, not to restore known-good configuration safely after an unsuccessful change. Changing this adjacent capability would leave the stated configuration rollback readiness requirement unresolved.
B:Upgrade the passive member first according to the supported HA procedure, then complete the peer sequence. This configuration is intended to upgrade HA members in a controlled order with failover testing, not to restore known-good configuration safely after an unsuccessful change. Changing this adjacent capability would leave the stated configuration rollback readiness requirement unresolved.
C:Configure supported revocation verification in the client certificate authentication profile. This configuration is intended to enforce the configured certificate revocation policy for client authentication, not to restore known-good configuration safely after an unsuccessful change. Changing this adjacent capability would leave the stated configuration rollback readiness requirement unresolved.
Question 159
The team has confirmed its certificate issuer integration fault: An internal web portal presents a certificate issued by a CA untrusted by managed devices. What configuration should it select to establish a valid PKI trust path for administrative services?
- Configure an authorized forward-trust CA certificate and deploy its trust to affected clients.
- Configure the intended forward-untrust certificate behavior in the supported decryption design.
- Import the required trusted CA chain and install the matching service certificate.
- Bind a supported SSL/TLS service profile containing the valid issued certificate.
Explanation
Correct Answer
C:Import the required trusted CA chain and install the matching service certificate. PKI validation depends on a complete trusted issuer chain and certificate identity. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure an authorized forward-trust CA certificate and deploy its trust to affected clients. This configuration is intended to allow approved forward-proxy decryption without client trust warnings, not to establish a valid PKI trust path for administrative services. Changing this adjacent capability would leave the stated certificate issuer integration requirement unresolved.
B:Configure the intended forward-untrust certificate behavior in the supported decryption design. This configuration is intended to signal upstream certificate problems rather than silently creating apparent trust, not to establish a valid PKI trust path for administrative services. Changing this adjacent capability would leave the stated certificate issuer integration requirement unresolved.
D:Bind a supported SSL/TLS service profile containing the valid issued certificate. This configuration is intended to serve the intended trusted certificate for administrative TLS, not to establish a valid PKI trust path for administrative services. Changing this adjacent capability would leave the stated certificate issuer integration requirement unresolved.
Question 160
The engineer has finished diagnosis and must choose an enforceable change. A sanctioned TLS decryption policy is enabled but managed browsers reject the substitute certificates. Which implementation best meets the need to allow approved forward-proxy decryption without client trust warnings?
- Configure the intended forward-untrust certificate behavior in the supported decryption design.
- Configure an authorized forward-trust CA certificate and deploy its trust to affected clients.
- Assign a certificate profile with the appropriate trusted CA and identity requirements.
- Stage the replacement certificate and update only the intended service bindings.
Explanation
Correct Answer
B:Configure an authorized forward-trust CA certificate and deploy its trust to affected clients. Forward-proxy decryption requires a trusted signing CA for generated server certificates. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure the intended forward-untrust certificate behavior in the supported decryption design. This configuration is intended to signal upstream certificate problems rather than silently creating apparent trust, not to allow approved forward-proxy decryption without client trust warnings. Changing this adjacent capability would leave the stated forward-trust decryption ca requirement unresolved.
C:Assign a certificate profile with the appropriate trusted CA and identity requirements. This configuration is intended to enforce trusted client certificate authentication criteria, not to allow approved forward-proxy decryption without client trust warnings. Changing this adjacent capability would leave the stated forward-trust decryption ca requirement unresolved.
D:Stage the replacement certificate and update only the intended service bindings. This configuration is intended to maintain usable trusted certificates throughout the gateway cutover, not to allow approved forward-proxy decryption without client trust warnings. Changing this adjacent capability would leave the stated forward-trust decryption ca requirement unresolved.
