Palo Alto Networks NGFW-Engineer Practice Test 2
Question 10
In a controlled network review, the reported condition is: Traffic from a contractor VLAN unexpectedly matches a broad internal allow rule. The team needs to isolate contractor traffic in the proper source zone and policy scope. What diagnostic should precede a change request?
- Inspect session logs and the interzone rulebase before adding a broad permit.
- Review matching intra-zone rules and default intrazone policy behavior for the host pair.
- Inspect VLAN object membership and Layer 2 port assignments before moving any interfaces.
- Inspect the source and destination zones resolved for the test session and the first matching security rule.
Explanation
Correct Answer
D:Inspect the source and destination zones resolved for the test session and the first matching security rule. Security policies evaluate zones derived from interfaces along with application, addresses and other attributes. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect session logs and the interzone rulebase before adding a broad permit. That check is directed at interzone default policy handling, a different failure mechanism. It does not isolate the reported security-zone based rule matching dependency, which must be examined before a remedy is selected.
B:Review matching intra-zone rules and default intrazone policy behavior for the host pair. That check is directed at intrazone traffic policy behavior, a different failure mechanism. It does not isolate the reported security-zone based rule matching dependency, which must be examined before a remedy is selected.
C:Inspect VLAN object membership and Layer 2 port assignments before moving any interfaces. That check is directed at layer 2 vlan bridging, a different failure mechanism. It does not isolate the reported security-zone based rule matching dependency, which must be examined before a remedy is selected.
Question 11
An engineer is troubleshooting interzone default policy handling. The observed condition is: A newly routed partner segment has reachability but its cross-zone application sessions are denied. Which evidence-gathering action best establishes how to authorize only specified partner applications across the two zones?
- Review matching intra-zone rules and default intrazone policy behavior for the host pair.
- Inspect the interface mode, zone association and virtual-router membership for the new uplink.
- Inspect session logs and the interzone rulebase before adding a broad permit.
- Check whether both pass-through ports are in virtual-wire mode and belong to the expected vwire.
Explanation
Correct Answer
C:Inspect session logs and the interzone rulebase before adding a broad permit. Routing reachability does not imply interzone security-policy permission. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Review matching intra-zone rules and default intrazone policy behavior for the host pair. That check is directed at intrazone traffic policy behavior, a different failure mechanism. It does not isolate the reported interzone default policy handling dependency, which must be examined before a remedy is selected.
B:Inspect the interface mode, zone association and virtual-router membership for the new uplink. That check is directed at layer 3 interface membership, a different failure mechanism. It does not isolate the reported interzone default policy handling dependency, which must be examined before a remedy is selected.
D:Check whether both pass-through ports are in virtual-wire mode and belong to the expected vwire. That check is directed at virtual wire inline inspection, a different failure mechanism. It does not isolate the reported interzone default policy handling dependency, which must be examined before a remedy is selected.
Question 12
A security operations change cannot proceed until the cause is clear. The report states: Two hosts in the same security zone communicate despite a team assuming all internal flows are blocked by default. Which first check best supports the requirement to make same-zone restrictions explicit where the policy requires them?
- Inspect the interface mode, zone association and virtual-router membership for the new uplink.
- Review matching intra-zone rules and default intrazone policy behavior for the host pair.
- Inspect VLAN object membership and Layer 2 port assignments before moving any interfaces.
- Inspect member-port modes, aggregate assignment and peer switch negotiation state.
Explanation
Correct Answer
B:Review matching intra-zone rules and default intrazone policy behavior for the host pair. Intra-zone traffic can be allowed by a default rule unless a more specific security policy intervenes. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the interface mode, zone association and virtual-router membership for the new uplink. That check is directed at layer 3 interface membership, a different failure mechanism. It does not isolate the reported intrazone traffic policy behavior dependency, which must be examined before a remedy is selected.
C:Inspect VLAN object membership and Layer 2 port assignments before moving any interfaces. That check is directed at layer 2 vlan bridging, a different failure mechanism. It does not isolate the reported intrazone traffic policy behavior dependency, which must be examined before a remedy is selected.
D:Inspect member-port modes, aggregate assignment and peer switch negotiation state. That check is directed at aggregate ethernet member consistency, a different failure mechanism. It does not isolate the reported intrazone traffic policy behavior dependency, which must be examined before a remedy is selected.
Question 13
A firewall engineering team reports the following: An active/passive pair forms a peer relationship but sessions fail during a controlled failover. The operational requirement is to retain compatible configuration and session behavior across HA peers. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Check HA1 control synchronization and HA2 session/state links separately for the pair.
- Inspect HA mode, election status and peer compatibility before altering forwarding.
- Inspect the HA link-monitor profile and the monitored physical interfaces.
- Inspect session ownership, packet handling roles and route symmetry on both peers.
Explanation
Correct Answer
A:Check HA1 control synchronization and HA2 session/state links separately for the pair. HA1 carries control communication while HA2 supports data-plane state synchronization as supported. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Inspect HA mode, election status and peer compatibility before altering forwarding. That check is directed at active/passive ha role placement, a different failure mechanism. It does not isolate the reported ha control and data synchronization dependency, which must be examined before a remedy is selected.
C:Inspect the HA link-monitor profile and the monitored physical interfaces. That check is directed at ha link monitoring, a different failure mechanism. It does not isolate the reported ha control and data synchronization dependency, which must be examined before a remedy is selected.
D:Inspect session ownership, packet handling roles and route symmetry on both peers. That check is directed at active/active ha session ownership, a different failure mechanism. It does not isolate the reported ha control and data synchronization dependency, which must be examined before a remedy is selected.
Question 14
In a controlled network review, the reported condition is: A firewall pair should have one normal traffic-forwarding member and one ready standby but both attempt active forwarding. The team needs to establish the intended single-active failover model. What diagnostic should precede a change request?
- Inspect the HA link-monitor profile and the monitored physical interfaces.
- Inspect path-monitor target reachability and the configured failure thresholds.
- Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors.
- Inspect HA mode, election status and peer compatibility before altering forwarding.
Explanation
Correct Answer
D:Inspect HA mode, election status and peer compatibility before altering forwarding. Active/passive HA uses one forwarding peer at a time under normal conditions. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the HA link-monitor profile and the monitored physical interfaces. That check is directed at ha link monitoring, a different failure mechanism. It does not isolate the reported active/passive ha role placement dependency, which must be examined before a remedy is selected.
B:Inspect path-monitor target reachability and the configured failure thresholds. That check is directed at ha path monitoring, a different failure mechanism. It does not isolate the reported active/passive ha role placement dependency, which must be examined before a remedy is selected.
C:Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors. That check is directed at ha configuration compatibility, a different failure mechanism. It does not isolate the reported active/passive ha role placement dependency, which must be examined before a remedy is selected.
Question 15
An engineer is troubleshooting ha link monitoring. The observed condition is: A production port fails on the active firewall while its HA heartbeat remains healthy. Which evidence-gathering action best establishes how to cause failover when designated critical data links fail?
- Inspect path-monitor target reachability and the configured failure thresholds.
- Inspect session ownership, packet handling roles and route symmetry on both peers.
- Inspect the HA link-monitor profile and the monitored physical interfaces.
- Inspect preemption settings, device priorities and the recorded failback event.
Explanation
Correct Answer
C:Inspect the HA link-monitor profile and the monitored physical interfaces. Link monitoring triggers HA action from port failure independently of HA heartbeat health. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect path-monitor target reachability and the configured failure thresholds. That check is directed at ha path monitoring, a different failure mechanism. It does not isolate the reported ha link monitoring dependency, which must be examined before a remedy is selected.
B:Inspect session ownership, packet handling roles and route symmetry on both peers. That check is directed at active/active ha session ownership, a different failure mechanism. It does not isolate the reported ha link monitoring dependency, which must be examined before a remedy is selected.
D:Inspect preemption settings, device priorities and the recorded failback event. That check is directed at ha election preemption, a different failure mechanism. It does not isolate the reported ha link monitoring dependency, which must be examined before a remedy is selected.
Question 16
A security operations change cannot proceed until the cause is clear. The report states: A routed upstream next hop becomes unreachable even though the firewall Ethernet link stays up. Which first check best supports the requirement to make HA respond to loss of a required upstream path?
- Inspect session ownership, packet handling roles and route symmetry on both peers.
- Inspect path-monitor target reachability and the configured failure thresholds.
- Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors.
- Inspect HA1 failure, heartbeat backup paths and peer state-transition history.
Explanation
Correct Answer
B:Inspect path-monitor target reachability and the configured failure thresholds. Path monitoring detects reachability failure beyond a locally operational interface. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect session ownership, packet handling roles and route symmetry on both peers. That check is directed at active/active ha session ownership, a different failure mechanism. It does not isolate the reported ha path monitoring dependency, which must be examined before a remedy is selected.
C:Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors. That check is directed at ha configuration compatibility, a different failure mechanism. It does not isolate the reported ha path monitoring dependency, which must be examined before a remedy is selected.
D:Inspect HA1 failure, heartbeat backup paths and peer state-transition history. That check is directed at ha split-brain recovery, a different failure mechanism. It does not isolate the reported ha path monitoring dependency, which must be examined before a remedy is selected.
Question 17
A firewall engineering team reports the following: An active/active pair handles traffic asymmetrically and engineers must identify which peer owns a session. The operational requirement is to account for session owner and setup semantics in the active/active design. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Inspect session ownership, packet handling roles and route symmetry on both peers.
- Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors.
- Inspect preemption settings, device priorities and the recorded failback event.
- Check HA1 control synchronization and HA2 session/state links separately for the pair.
Explanation
Correct Answer
A:Inspect session ownership, packet handling roles and route symmetry on both peers. Active/active HA requires explicit treatment of session handling across concurrently forwarding peers. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors. That check is directed at ha configuration compatibility, a different failure mechanism. It does not isolate the reported active/active ha session ownership dependency, which must be examined before a remedy is selected.
C:Inspect preemption settings, device priorities and the recorded failback event. That check is directed at ha election preemption, a different failure mechanism. It does not isolate the reported active/active ha session ownership dependency, which must be examined before a remedy is selected.
D:Check HA1 control synchronization and HA2 session/state links separately for the pair. That check is directed at ha control and data synchronization, a different failure mechanism. It does not isolate the reported active/active ha session ownership dependency, which must be examined before a remedy is selected.
Question 18
In a controlled network review, the reported condition is: Two prospective HA peers run incompatible configurations and never become a stable synchronized pair. The team needs to prepare compatible peers before enabling production failover. What diagnostic should precede a change request?
- Inspect preemption settings, device priorities and the recorded failback event.
- Inspect HA1 failure, heartbeat backup paths and peer state-transition history.
- Inspect HA mode, election status and peer compatibility before altering forwarding.
- Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors.
Explanation
Correct Answer
D:Compare model compatibility, PAN-OS versions, interface roles and HA configuration errors. HA peers need supported compatibility and matched synchronization settings before resilience testing. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect preemption settings, device priorities and the recorded failback event. That check is directed at ha election preemption, a different failure mechanism. It does not isolate the reported ha configuration compatibility dependency, which must be examined before a remedy is selected.
B:Inspect HA1 failure, heartbeat backup paths and peer state-transition history. That check is directed at ha split-brain recovery, a different failure mechanism. It does not isolate the reported ha configuration compatibility dependency, which must be examined before a remedy is selected.
C:Inspect HA mode, election status and peer compatibility before altering forwarding. That check is directed at active/passive ha role placement, a different failure mechanism. It does not isolate the reported ha configuration compatibility dependency, which must be examined before a remedy is selected.
Question 19
An engineer is troubleshooting ha election preemption. The observed condition is: An HA pair unexpectedly switches back to its preferred node as soon as that node returns from maintenance. Which evidence-gathering action best establishes how to avoid unnecessary traffic disruption from automatic role preemption?
- Inspect HA1 failure, heartbeat backup paths and peer state-transition history.
- Check HA1 control synchronization and HA2 session/state links separately for the pair.
- Inspect preemption settings, device priorities and the recorded failback event.
- Inspect the HA link-monitor profile and the monitored physical interfaces.
Explanation
Correct Answer
C:Inspect preemption settings, device priorities and the recorded failback event. Preemption policy affects whether the preferred HA peer reclaims active status automatically. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect HA1 failure, heartbeat backup paths and peer state-transition history. That check is directed at ha split-brain recovery, a different failure mechanism. It does not isolate the reported ha election preemption dependency, which must be examined before a remedy is selected.
B:Check HA1 control synchronization and HA2 session/state links separately for the pair. That check is directed at ha control and data synchronization, a different failure mechanism. It does not isolate the reported ha election preemption dependency, which must be examined before a remedy is selected.
D:Inspect the HA link-monitor profile and the monitored physical interfaces. That check is directed at ha link monitoring, a different failure mechanism. It does not isolate the reported ha election preemption dependency, which must be examined before a remedy is selected.
Question 20
A security operations change cannot proceed until the cause is clear. The report states: Two HA nodes lose control-plane contact while each has live data links to the protected networks. Which first check best supports the requirement to limit simultaneous-forwarding risk under control-link failure?
- Check HA1 control synchronization and HA2 session/state links separately for the pair.
- Inspect HA1 failure, heartbeat backup paths and peer state-transition history.
- Inspect HA mode, election status and peer compatibility before altering forwarding.
- Inspect path-monitor target reachability and the configured failure thresholds.
Explanation
Correct Answer
B:Inspect HA1 failure, heartbeat backup paths and peer state-transition history. Loss of peer control connectivity needs deliberate design to reduce dual-active failures. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Check HA1 control synchronization and HA2 session/state links separately for the pair. That check is directed at ha control and data synchronization, a different failure mechanism. It does not isolate the reported ha split-brain recovery dependency, which must be examined before a remedy is selected.
C:Inspect HA mode, election status and peer compatibility before altering forwarding. That check is directed at active/passive ha role placement, a different failure mechanism. It does not isolate the reported ha split-brain recovery dependency, which must be examined before a remedy is selected.
D:Inspect path-monitor target reachability and the configured failure thresholds. That check is directed at ha path monitoring, a different failure mechanism. It does not isolate the reported ha split-brain recovery dependency, which must be examined before a remedy is selected.
