Palo Alto Networks NGFW-Engineer Practice Test 17
Question 160
The engineer has finished diagnosis and must choose an enforceable change. A sanctioned TLS decryption policy is enabled but managed browsers reject the substitute certificates. Which implementation best meets the need to allow approved forward-proxy decryption without client trust warnings?
- Configure the intended forward-untrust certificate behavior in the supported decryption design.
- Configure an authorized forward-trust CA certificate and deploy its trust to affected clients.
- Assign a certificate profile with the appropriate trusted CA and identity requirements.
- Stage the replacement certificate and update only the intended service bindings.
Explanation
Correct Answer
B:Configure an authorized forward-trust CA certificate and deploy its trust to affected clients. Forward-proxy decryption requires a trusted signing CA for generated server certificates. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure the intended forward-untrust certificate behavior in the supported decryption design. This configuration is intended to signal upstream certificate problems rather than silently creating apparent trust, not to allow approved forward-proxy decryption without client trust warnings. Changing this adjacent capability would leave the stated forward-trust decryption ca requirement unresolved.
C:Assign a certificate profile with the appropriate trusted CA and identity requirements. This configuration is intended to enforce trusted client certificate authentication criteria, not to allow approved forward-proxy decryption without client trust warnings. Changing this adjacent capability would leave the stated forward-trust decryption ca requirement unresolved.
D:Stage the replacement certificate and update only the intended service bindings. This configuration is intended to maintain usable trusted certificates throughout the gateway cutover, not to allow approved forward-proxy decryption without client trust warnings. Changing this adjacent capability would leave the stated forward-trust decryption ca requirement unresolved.
Question 161
An approved design change is required after engineers establish: A client uses TLS inspection through the firewall and sees a distinct failure for an upstream certificate that cannot be trusted. Which control directly enables the organization to signal upstream certificate problems rather than silently creating apparent trust?
- Configure the intended forward-untrust certificate behavior in the supported decryption design.
- Assign a certificate profile with the appropriate trusted CA and identity requirements.
- Bind a supported SSL/TLS service profile containing the valid issued certificate.
- Configure supported revocation verification in the client certificate authentication profile.
Explanation
Correct Answer
A:Configure the intended forward-untrust certificate behavior in the supported decryption design. Forward-untrust handling should distinguish upstream validation problems from a trusted intercepted connection. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Assign a certificate profile with the appropriate trusted CA and identity requirements. This configuration is intended to enforce trusted client certificate authentication criteria, not to signal upstream certificate problems rather than silently creating apparent trust. Changing this adjacent capability would leave the stated forward-untrust decryption certificate requirement unresolved.
C:Bind a supported SSL/TLS service profile containing the valid issued certificate. This configuration is intended to serve the intended trusted certificate for administrative TLS, not to signal upstream certificate problems rather than silently creating apparent trust. Changing this adjacent capability would leave the stated forward-untrust decryption certificate requirement unresolved.
D:Configure supported revocation verification in the client certificate authentication profile. This configuration is intended to enforce the configured certificate revocation policy for client authentication, not to signal upstream certificate problems rather than silently creating apparent trust. Changing this adjacent capability would leave the stated forward-untrust decryption certificate requirement unresolved.
Question 162
A validated firewall incident has this root condition: A privileged VPN portal must accept only clients with a certificate issued by an approved enterprise CA. Which targeted PAN-OS configuration directly addresses the requirement to enforce trusted client certificate authentication criteria?
- Bind a supported SSL/TLS service profile containing the valid issued certificate.
- Stage the replacement certificate and update only the intended service bindings.
- Narrow the exemption to the approved application or destination and retain inspection elsewhere.
- Assign a certificate profile with the appropriate trusted CA and identity requirements.
Explanation
Correct Answer
D:Assign a certificate profile with the appropriate trusted CA and identity requirements. Certificate profiles specify how client certificates are validated for authenticated access. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Bind a supported SSL/TLS service profile containing the valid issued certificate. This configuration is intended to serve the intended trusted certificate for administrative TLS, not to enforce trusted client certificate authentication criteria. Changing this adjacent capability would leave the stated client certificate profile validation requirement unresolved.
B:Stage the replacement certificate and update only the intended service bindings. This configuration is intended to maintain usable trusted certificates throughout the gateway cutover, not to enforce trusted client certificate authentication criteria. Changing this adjacent capability would leave the stated client certificate profile validation requirement unresolved.
C:Narrow the exemption to the approved application or destination and retain inspection elsewhere. This configuration is intended to avoid unnecessarily broad TLS decryption exclusions, not to enforce trusted client certificate authentication criteria. Changing this adjacent capability would leave the stated client certificate profile validation requirement unresolved.
Question 163
The team has confirmed its tls service profile certificate identity fault: The management API presents a self-signed certificate despite a CA-issued management certificate being available. What configuration should it select to serve the intended trusted certificate for administrative TLS?
- Stage the replacement certificate and update only the intended service bindings.
- Configure supported revocation verification in the client certificate authentication profile.
- Bind a supported SSL/TLS service profile containing the valid issued certificate.
- Import the required trusted CA chain and install the matching service certificate.
Explanation
Correct Answer
C:Bind a supported SSL/TLS service profile containing the valid issued certificate. A service profile selects the certificate used for supported inbound management TLS. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Stage the replacement certificate and update only the intended service bindings. This configuration is intended to maintain usable trusted certificates throughout the gateway cutover, not to serve the intended trusted certificate for administrative TLS. Changing this adjacent capability would leave the stated tls service profile certificate identity requirement unresolved.
B:Configure supported revocation verification in the client certificate authentication profile. This configuration is intended to enforce the configured certificate revocation policy for client authentication, not to serve the intended trusted certificate for administrative TLS. Changing this adjacent capability would leave the stated tls service profile certificate identity requirement unresolved.
D:Import the required trusted CA chain and install the matching service certificate. This configuration is intended to establish a valid PKI trust path for administrative services, not to serve the intended trusted certificate for administrative TLS. Changing this adjacent capability would leave the stated tls service profile certificate identity requirement unresolved.
Question 164
The engineer has finished diagnosis and must choose an enforceable change. A firewall's certificate expires during a planned GlobalProtect gateway migration. Which implementation best meets the need to maintain usable trusted certificates throughout the gateway cutover?
- Configure supported revocation verification in the client certificate authentication profile.
- Stage the replacement certificate and update only the intended service bindings.
- Narrow the exemption to the approved application or destination and retain inspection elsewhere.
- Configure an authorized forward-trust CA certificate and deploy its trust to affected clients.
Explanation
Correct Answer
B:Stage the replacement certificate and update only the intended service bindings. Certificate renewal must preserve the key, chain and correct service association. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure supported revocation verification in the client certificate authentication profile. This configuration is intended to enforce the configured certificate revocation policy for client authentication, not to maintain usable trusted certificates throughout the gateway cutover. Changing this adjacent capability would leave the stated certificate renewal dependency requirement unresolved.
C:Narrow the exemption to the approved application or destination and retain inspection elsewhere. This configuration is intended to avoid unnecessarily broad TLS decryption exclusions, not to maintain usable trusted certificates throughout the gateway cutover. Changing this adjacent capability would leave the stated certificate renewal dependency requirement unresolved.
D:Configure an authorized forward-trust CA certificate and deploy its trust to affected clients. This configuration is intended to allow approved forward-proxy decryption without client trust warnings, not to maintain usable trusted certificates throughout the gateway cutover. Changing this adjacent capability would leave the stated certificate renewal dependency requirement unresolved.
Question 165
An approved design change is required after engineers establish: A remote access client certificate was revoked but a test connection still succeeds. Which control directly enables the organization to enforce the configured certificate revocation policy for client authentication?
- Configure supported revocation verification in the client certificate authentication profile.
- Narrow the exemption to the approved application or destination and retain inspection elsewhere.
- Import the required trusted CA chain and install the matching service certificate.
- Configure the intended forward-untrust certificate behavior in the supported decryption design.
Explanation
Correct Answer
A:Configure supported revocation verification in the client certificate authentication profile. Revocation checking guards against previously issued credentials that should no longer authenticate. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Narrow the exemption to the approved application or destination and retain inspection elsewhere. This configuration is intended to avoid unnecessarily broad TLS decryption exclusions, not to enforce the configured certificate revocation policy for client authentication. Changing this adjacent capability would leave the stated certificate revocation checking requirement unresolved.
C:Import the required trusted CA chain and install the matching service certificate. This configuration is intended to establish a valid PKI trust path for administrative services, not to enforce the configured certificate revocation policy for client authentication. Changing this adjacent capability would leave the stated certificate revocation checking requirement unresolved.
D:Configure the intended forward-untrust certificate behavior in the supported decryption design. This configuration is intended to signal upstream certificate problems rather than silently creating apparent trust, not to enforce the configured certificate revocation policy for client authentication. Changing this adjacent capability would leave the stated certificate revocation checking requirement unresolved.
Question 166
A validated firewall incident has this root condition: An inspection bypass rule covers an entire business zone even though only a limited incompatible application needs exemption. Which targeted PAN-OS configuration directly addresses the requirement to avoid unnecessarily broad TLS decryption exclusions?
- Import the required trusted CA chain and install the matching service certificate.
- Configure an authorized forward-trust CA certificate and deploy its trust to affected clients.
- Assign a certificate profile with the appropriate trusted CA and identity requirements.
- Narrow the exemption to the approved application or destination and retain inspection elsewhere.
Explanation
Correct Answer
D:Narrow the exemption to the approved application or destination and retain inspection elsewhere. A broad decryption bypass weakens visibility beyond the application that requires an exception. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Import the required trusted CA chain and install the matching service certificate. This configuration is intended to establish a valid PKI trust path for administrative services, not to avoid unnecessarily broad TLS decryption exclusions. Changing this adjacent capability would leave the stated decryption policy exception scope requirement unresolved.
B:Configure an authorized forward-trust CA certificate and deploy its trust to affected clients. This configuration is intended to allow approved forward-proxy decryption without client trust warnings, not to avoid unnecessarily broad TLS decryption exclusions. Changing this adjacent capability would leave the stated decryption policy exception scope requirement unresolved.
C:Assign a certificate profile with the appropriate trusted CA and identity requirements. This configuration is intended to enforce trusted client certificate authentication criteria, not to avoid unnecessarily broad TLS decryption exclusions. Changing this adjacent capability would leave the stated decryption policy exception scope requirement unresolved.
Question 167
The team has confirmed its user-id user to ip mapping fault: User-based security rules stop matching after workstations renew their addresses. What configuration should it select to associate the right authenticated username with current client IP addresses?
- Configure or repair supported group mapping from the authoritative directory.
- Configure the correct Cloud Identity Engine tenant integration and supported group synchronization.
- Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds.
- Restrict User-ID source collection and redistribution to trusted agents and interfaces.
Explanation
Correct Answer
C:Restore supported user-to-IP mapping collection for the affected subnet and refresh source feeds. User-ID policy depends on current IP-to-identity mapping for the source session. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure or repair supported group mapping from the authoritative directory. This configuration is intended to refresh group membership information for policy decisions, not to associate the right authenticated username with current client IP addresses. Changing this adjacent capability would leave the stated user-id user to ip mapping requirement unresolved.
B:Configure the correct Cloud Identity Engine tenant integration and supported group synchronization. This configuration is intended to deliver current cloud group context into supported identity policy, not to associate the right authenticated username with current client IP addresses. Changing this adjacent capability would leave the stated user-id user to ip mapping requirement unresolved.
D:Restrict User-ID source collection and redistribution to trusted agents and interfaces. This configuration is intended to accept identity mappings only from trusted approved sources, not to associate the right authenticated username with current client IP addresses. Changing this adjacent capability would leave the stated user-id user to ip mapping requirement unresolved.
Question 168
The engineer has finished diagnosis and must choose an enforceable change. A security rule references an AD group but its renamed members are missing from the firewall's matching identity set. Which implementation best meets the need to refresh group membership information for policy decisions?
- Configure the correct Cloud Identity Engine tenant integration and supported group synchronization.
- Configure or repair supported group mapping from the authoritative directory.
- Configure supported User-ID redistribution between the authorized mapping sources and consumers.
- Use the supported terminal-server mapping mechanism appropriate to the environment.
Explanation
Correct Answer
B:Configure or repair supported group mapping from the authoritative directory. Group mapping supplies directory membership for group-specific policy matching. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure the correct Cloud Identity Engine tenant integration and supported group synchronization. This configuration is intended to deliver current cloud group context into supported identity policy, not to refresh group membership information for policy decisions. Changing this adjacent capability would leave the stated directory group mapping requirement unresolved.
C:Configure supported User-ID redistribution between the authorized mapping sources and consumers. This configuration is intended to redistribute approved identity mapping data across trusted segments, not to refresh group membership information for policy decisions. Changing this adjacent capability would leave the stated directory group mapping requirement unresolved.
D:Use the supported terminal-server mapping mechanism appropriate to the environment. This configuration is intended to distinguish user sessions that share a network source address, not to refresh group membership information for policy decisions. Changing this adjacent capability would leave the stated directory group mapping requirement unresolved.
Question 169
An approved design change is required after engineers establish: A multi-site environment uses Cloud Identity Engine but one cloud directory group has not populated firewall group policy. Which control directly enables the organization to deliver current cloud group context into supported identity policy?
- Configure the correct Cloud Identity Engine tenant integration and supported group synchronization.
- Configure supported User-ID redistribution between the authorized mapping sources and consumers.
- Restrict User-ID source collection and redistribution to trusted agents and interfaces.
- Configure a supported authentication portal policy and appropriate guest identity method.
Explanation
Correct Answer
A:Configure the correct Cloud Identity Engine tenant integration and supported group synchronization. Cloud identity integration depends on a functioning selected directory synchronization path. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure supported User-ID redistribution between the authorized mapping sources and consumers. This configuration is intended to redistribute approved identity mapping data across trusted segments, not to deliver current cloud group context into supported identity policy. Changing this adjacent capability would leave the stated cloud identity engine sync requirement unresolved.
C:Restrict User-ID source collection and redistribution to trusted agents and interfaces. This configuration is intended to accept identity mappings only from trusted approved sources, not to deliver current cloud group context into supported identity policy. Changing this adjacent capability would leave the stated cloud identity engine sync requirement unresolved.
D:Configure a supported authentication portal policy and appropriate guest identity method. This configuration is intended to obtain authenticated identity context before granting a user-based guest flow, not to deliver current cloud group context into supported identity policy. Changing this adjacent capability would leave the stated cloud identity engine sync requirement unresolved.
Question 170
A validated firewall incident has this root condition: Regional firewalls cannot use mappings learned by a central trusted firewall and the same clients become unknown users. Which targeted PAN-OS configuration directly addresses the requirement to redistribute approved identity mapping data across trusted segments?
- Restrict User-ID source collection and redistribution to trusted agents and interfaces.
- Use the supported terminal-server mapping mechanism appropriate to the environment.
- Tune supported mapping timeout and logoff integration for the observed workstation behavior.
- Configure supported User-ID redistribution between the authorized mapping sources and consumers.
Explanation
Correct Answer
D:Configure supported User-ID redistribution between the authorized mapping sources and consumers. Identity redistribution shares user context only through configured trusted channels. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Restrict User-ID source collection and redistribution to trusted agents and interfaces. This configuration is intended to accept identity mappings only from trusted approved sources, not to redistribute approved identity mapping data across trusted segments. Changing this adjacent capability would leave the stated user-id redistribution requirement unresolved.
B:Use the supported terminal-server mapping mechanism appropriate to the environment. This configuration is intended to distinguish user sessions that share a network source address, not to redistribute approved identity mapping data across trusted segments. Changing this adjacent capability would leave the stated user-id redistribution requirement unresolved.
C:Tune supported mapping timeout and logoff integration for the observed workstation behavior. This configuration is intended to expire stale identities and refresh mappings promptly, not to redistribute approved identity mapping data across trusted segments. Changing this adjacent capability would leave the stated user-id redistribution requirement unresolved.
