Palo Alto Networks NGFW-Engineer Practice Test 20
Question 190
A validated firewall incident has this root condition: A daily configuration job creates duplicate tags because its logic appends instead of reconciling existing objects. Which targeted PAN-OS configuration directly addresses the requirement to apply repeatable configuration changes without duplicate definitions?
- Require reviewed declarative configuration and an approval gate before Terraform apply.
- Use supported Ansible modules with approved inventory and configuration variables.
- Call the supported XML API operational command for the session inquiry.
- Use an idempotent lookup-and-update method with stable object identifiers.
Explanation
Correct Answer
D:Use an idempotent lookup-and-update method with stable object identifiers. Idempotent automation converges to a desired state rather than duplicating resources on retries. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Require reviewed declarative configuration and an approval gate before Terraform apply. This configuration is intended to review infrastructure changes before mutating the deployed security environment, not to apply repeatable configuration changes without duplicate definitions. Changing this adjacent capability would leave the stated automation idempotent object creation requirement unresolved.
B:Use supported Ansible modules with approved inventory and configuration variables. This configuration is intended to apply versioned and repeatable configuration through supported automation, not to apply repeatable configuration changes without duplicate definitions. Changing this adjacent capability would leave the stated automation idempotent object creation requirement unresolved.
C:Call the supported XML API operational command for the session inquiry. This configuration is intended to use an operational XML API command without modifying the candidate configuration, not to apply repeatable configuration changes without duplicate definitions. Changing this adjacent capability would leave the stated automation idempotent object creation requirement unresolved.
Question 191
The team has confirmed its terraform plan review fault: A Terraform job for new cloud firewalls would replace production resources, but nobody reviews the generated plan. What configuration should it select to review infrastructure changes before mutating the deployed security environment?
- Use supported Ansible modules with approved inventory and configuration variables.
- Send the supported REST API method and resource payload for the address object.
- Require reviewed declarative configuration and an approval gate before Terraform apply.
- Move API credentials to an approved secret store and assign the narrowest applicable API role.
Explanation
Correct Answer
C:Require reviewed declarative configuration and an approval gate before Terraform apply. A plan review exposes proposed infrastructure changes before execution. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Use supported Ansible modules with approved inventory and configuration variables. This configuration is intended to apply versioned and repeatable configuration through supported automation, not to review infrastructure changes before mutating the deployed security environment. Changing this adjacent capability would leave the stated terraform plan review requirement unresolved.
B:Send the supported REST API method and resource payload for the address object. This configuration is intended to use the supported REST resource and request contract for the intended object, not to review infrastructure changes before mutating the deployed security environment. Changing this adjacent capability would leave the stated terraform plan review requirement unresolved.
D:Move API credentials to an approved secret store and assign the narrowest applicable API role. This configuration is intended to authenticate API automation without exposing privileged credentials, not to review infrastructure changes before mutating the deployed security environment. Changing this adjacent capability would leave the stated terraform plan review requirement unresolved.
Question 192
The engineer has finished diagnosis and must choose an enforceable change. A team repeatedly configures the same approved policy by hand across branch firewalls and changes drift. Which implementation best meets the need to apply versioned and repeatable configuration through supported automation?
- Send the supported REST API method and resource payload for the address object.
- Use supported Ansible modules with approved inventory and configuration variables.
- Call the supported XML API operational command for the session inquiry.
- Use an idempotent lookup-and-update method with stable object identifiers.
Explanation
Correct Answer
B:Use supported Ansible modules with approved inventory and configuration variables. Ansible can standardize declared firewall changes when inventory and modules are compatible. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Send the supported REST API method and resource payload for the address object. This configuration is intended to use the supported REST resource and request contract for the intended object, not to apply versioned and repeatable configuration through supported automation. Changing this adjacent capability would leave the stated ansible repeatable pan-os configuration requirement unresolved.
C:Call the supported XML API operational command for the session inquiry. This configuration is intended to use an operational XML API command without modifying the candidate configuration, not to apply versioned and repeatable configuration through supported automation. Changing this adjacent capability would leave the stated ansible repeatable pan-os configuration requirement unresolved.
D:Use an idempotent lookup-and-update method with stable object identifiers. This configuration is intended to apply repeatable configuration changes without duplicate definitions, not to apply versioned and repeatable configuration through supported automation. Changing this adjacent capability would leave the stated ansible repeatable pan-os configuration requirement unresolved.
Question 193
An approved design change is required after engineers establish: A site policy accidentally applies to every firewall because engineers created it in a shared scope. Which control directly enables the organization to scope policy to the intended managed-firewall population?
- Place the site-specific rule in the correct Panorama device group.
- Reorder compatible templates so the approved higher-precedence value wins.
- Install the approved restriction as an appropriate Panorama pre-rule.
- Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope.
Explanation
Correct Answer
A:Place the site-specific rule in the correct Panorama device group. Device groups control centrally managed policy scope, while shared settings reach broadly. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Reorder compatible templates so the approved higher-precedence value wins. This configuration is intended to apply the intended device-network setting according to stack precedence, not to scope policy to the intended managed-firewall population. Changing this adjacent capability would leave the stated panorama device group policy scope requirement unresolved.
C:Install the approved restriction as an appropriate Panorama pre-rule. This configuration is intended to enforce the shared security restriction before local rules are evaluated, not to scope policy to the intended managed-firewall population. Changing this adjacent capability would leave the stated panorama device group policy scope requirement unresolved.
D:Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope. This configuration is intended to activate the intended centralized change on the target firewall, not to scope policy to the intended managed-firewall population. Changing this adjacent capability would leave the stated panorama device group policy scope requirement unresolved.
Question 194
A validated firewall incident has this root condition: Two templates in one stack define different DNS servers and managed firewalls receive the wrong value. Which targeted PAN-OS configuration directly addresses the requirement to apply the intended device-network setting according to stack precedence?
- Install the approved restriction as an appropriate Panorama pre-rule.
- Create the intended Panorama post-rule after the local policy layer.
- Configure supported Panorama HA with appropriate peer communication and role design.
- Reorder compatible templates so the approved higher-precedence value wins.
Explanation
Correct Answer
D:Reorder compatible templates so the approved higher-precedence value wins. Higher templates in a stack take precedence when they define the same setting. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Install the approved restriction as an appropriate Panorama pre-rule. This configuration is intended to enforce the shared security restriction before local rules are evaluated, not to apply the intended device-network setting according to stack precedence. Changing this adjacent capability would leave the stated panorama template stack precedence requirement unresolved.
B:Create the intended Panorama post-rule after the local policy layer. This configuration is intended to enforce the residual restriction after permitted local rules, not to apply the intended device-network setting according to stack precedence. Changing this adjacent capability would leave the stated panorama template stack precedence requirement unresolved.
C:Configure supported Panorama HA with appropriate peer communication and role design. This configuration is intended to maintain centralized management availability during node failure, not to apply the intended device-network setting according to stack precedence. Changing this adjacent capability would leave the stated panorama template stack precedence requirement unresolved.
Question 195
The team has confirmed its panorama pre-rule enforcement order fault: A mandatory organization-wide block is bypassed by a more permissive local firewall rule. What configuration should it select to enforce the shared security restriction before local rules are evaluated?
- Create the intended Panorama post-rule after the local policy layer.
- Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope.
- Install the approved restriction as an appropriate Panorama pre-rule.
- Build an ACC view scoped to the approved application and zone dimensions.
Explanation
Correct Answer
C:Install the approved restriction as an appropriate Panorama pre-rule. Panorama pre-rules are evaluated before local firewall rules in their effective hierarchy. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Create the intended Panorama post-rule after the local policy layer. This configuration is intended to enforce the residual restriction after permitted local rules, not to enforce the shared security restriction before local rules are evaluated. Changing this adjacent capability would leave the stated panorama pre-rule enforcement order requirement unresolved.
B:Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope. This configuration is intended to activate the intended centralized change on the target firewall, not to enforce the shared security restriction before local rules are evaluated. Changing this adjacent capability would leave the stated panorama pre-rule enforcement order requirement unresolved.
D:Build an ACC view scoped to the approved application and zone dimensions. This configuration is intended to present a useful Application Command Center view for triage, not to enforce the shared security restriction before local rules are evaluated. Changing this adjacent capability would leave the stated panorama pre-rule enforcement order requirement unresolved.
Question 196
The engineer has finished diagnosis and must choose an enforceable change. The organization needs a catch-all restriction evaluated after site-specific local exceptions. Which implementation best meets the need to enforce the residual restriction after permitted local rules?
- Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope.
- Create the intended Panorama post-rule after the local policy layer.
- Configure supported Panorama HA with appropriate peer communication and role design.
- Configure a supported custom report and approved distribution schedule.
Explanation
Correct Answer
B:Create the intended Panorama post-rule after the local policy layer. Panorama post-rules follow local rules and can provide centralized fallback enforcement. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope. This configuration is intended to activate the intended centralized change on the target firewall, not to enforce the residual restriction after permitted local rules. Changing this adjacent capability would leave the stated panorama post-rule fallback requirement unresolved.
C:Configure supported Panorama HA with appropriate peer communication and role design. This configuration is intended to maintain centralized management availability during node failure, not to enforce the residual restriction after permitted local rules. Changing this adjacent capability would leave the stated panorama post-rule fallback requirement unresolved.
D:Configure a supported custom report and approved distribution schedule. This configuration is intended to deliver repeatable scoped reports from firewall or Panorama data, not to enforce the residual restriction after permitted local rules. Changing this adjacent capability would leave the stated panorama post-rule fallback requirement unresolved.
Question 197
An approved design change is required after engineers establish: A security rule is committed in Panorama but the managed firewall still uses an older configuration. Which control directly enables the organization to activate the intended centralized change on the target firewall?
- Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope.
- Configure supported Panorama HA with appropriate peer communication and role design.
- Build an ACC view scoped to the approved application and zone dimensions.
- Place the site-specific rule in the correct Panorama device group.
Explanation
Correct Answer
A:Perform the supported commit-to-Panorama and push-to-devices workflow for the selected scope. Committing Panorama settings alone does not automatically push their running configuration to managed firewalls. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
B:Configure supported Panorama HA with appropriate peer communication and role design. This configuration is intended to maintain centralized management availability during node failure, not to activate the intended centralized change on the target firewall. Changing this adjacent capability would leave the stated panorama commit and push sequence requirement unresolved.
C:Build an ACC view scoped to the approved application and zone dimensions. This configuration is intended to present a useful Application Command Center view for triage, not to activate the intended centralized change on the target firewall. Changing this adjacent capability would leave the stated panorama commit and push sequence requirement unresolved.
D:Place the site-specific rule in the correct Panorama device group. This configuration is intended to scope policy to the intended managed-firewall population, not to activate the intended centralized change on the target firewall. Changing this adjacent capability would leave the stated panorama commit and push sequence requirement unresolved.
Question 198
A validated firewall incident has this root condition: The primary Panorama appliance becomes unreachable and staff lose management visibility despite having a standby. Which targeted PAN-OS configuration directly addresses the requirement to maintain centralized management availability during node failure?
- Build an ACC view scoped to the approved application and zone dimensions.
- Configure a supported custom report and approved distribution schedule.
- Reorder compatible templates so the approved higher-precedence value wins.
- Configure supported Panorama HA with appropriate peer communication and role design.
Explanation
Correct Answer
D:Configure supported Panorama HA with appropriate peer communication and role design. Management high availability requires supported peer synchronization and a tested recovery path. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Build an ACC view scoped to the approved application and zone dimensions. This configuration is intended to present a useful Application Command Center view for triage, not to maintain centralized management availability during node failure. Changing this adjacent capability would leave the stated panorama ha management continuity requirement unresolved.
B:Configure a supported custom report and approved distribution schedule. This configuration is intended to deliver repeatable scoped reports from firewall or Panorama data, not to maintain centralized management availability during node failure. Changing this adjacent capability would leave the stated panorama ha management continuity requirement unresolved.
C:Reorder compatible templates so the approved higher-precedence value wins. This configuration is intended to apply the intended device-network setting according to stack precedence, not to maintain centralized management availability during node failure. Changing this adjacent capability would leave the stated panorama ha management continuity requirement unresolved.
Question 199
The team has confirmed its acc dashboard traffic visibility fault: The SOC sees raw traffic records but cannot quickly distinguish application risk patterns by business segment. What configuration should it select to present a useful Application Command Center view for triage?
- Configure a supported custom report and approved distribution schedule.
- Place the site-specific rule in the correct Panorama device group.
- Build an ACC view scoped to the approved application and zone dimensions.
- Install the approved restriction as an appropriate Panorama pre-rule.
Explanation
Correct Answer
C:Build an ACC view scoped to the approved application and zone dimensions. ACC combines application-aware firewall telemetry into investigation views. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Configure a supported custom report and approved distribution schedule. This configuration is intended to deliver repeatable scoped reports from firewall or Panorama data, not to present a useful Application Command Center view for triage. Changing this adjacent capability would leave the stated acc dashboard traffic visibility requirement unresolved.
B:Place the site-specific rule in the correct Panorama device group. This configuration is intended to scope policy to the intended managed-firewall population, not to present a useful Application Command Center view for triage. Changing this adjacent capability would leave the stated acc dashboard traffic visibility requirement unresolved.
D:Install the approved restriction as an appropriate Panorama pre-rule. This configuration is intended to enforce the shared security restriction before local rules are evaluated, not to present a useful Application Command Center view for triage. Changing this adjacent capability would leave the stated acc dashboard traffic visibility requirement unresolved.
Question 200
The engineer has finished diagnosis and must choose an enforceable change. Regional managers need recurring security summaries but receive manual screenshots with inconsistent filters. Which implementation best meets the need to deliver repeatable scoped reports from firewall or Panorama data?
- Place the site-specific rule in the correct Panorama device group.
- Configure a supported custom report and approved distribution schedule.
- Reorder compatible templates so the approved higher-precedence value wins.
- Create the intended Panorama post-rule after the local policy layer.
Explanation
Correct Answer
B:Configure a supported custom report and approved distribution schedule. Custom reports require stable data filters, schedule and distribution scope. This is the specific implementation of the required outcome, rather than a change to an adjacent feature.
Incorrect Answers
A:Place the site-specific rule in the correct Panorama device group. This configuration is intended to scope policy to the intended managed-firewall population, not to deliver repeatable scoped reports from firewall or Panorama data. Changing this adjacent capability would leave the stated scheduled custom management reports requirement unresolved.
C:Reorder compatible templates so the approved higher-precedence value wins. This configuration is intended to apply the intended device-network setting according to stack precedence, not to deliver repeatable scoped reports from firewall or Panorama data. Changing this adjacent capability would leave the stated scheduled custom management reports requirement unresolved.
D:Create the intended Panorama post-rule after the local policy layer. This configuration is intended to enforce the residual restriction after permitted local rules, not to deliver repeatable scoped reports from firewall or Panorama data. Changing this adjacent capability would leave the stated scheduled custom management reports requirement unresolved.
