Palo Alto Networks NGFW-Engineer Practice Test 23
Question 220
The configuration has been committed, but the engineer needs functional proof. The earlier issue was: Two HA nodes lose control-plane contact while each has live data links to the protected networks. Which acceptance check supports the goal to limit simultaneous-forwarding risk under control-link failure?
- Fail over a test session and examine peer state and session continuity.
- Disconnect the primary control link in a controlled test and verify the fallback behavior.
- Trigger a controlled role change and confirm only the active unit handles normal flows.
- Simulate upstream path loss while keeping the interface up and verify the HA reaction.
Explanation
Correct Answer
B:Disconnect the primary control link in a controlled test and verify the fallback behavior. Loss of peer control connectivity needs deliberate design to reduce dual-active failures. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Fail over a test session and examine peer state and session continuity. A passing result would demonstrate ha control and data synchronization behavior. It would not establish that the original ha split-brain recovery failure has been corrected under the required traffic or administrative scope.
C:Trigger a controlled role change and confirm only the active unit handles normal flows. A passing result would demonstrate active/passive ha role placement behavior. It would not establish that the original ha split-brain recovery failure has been corrected under the required traffic or administrative scope.
D:Simulate upstream path loss while keeping the interface up and verify the HA reaction. A passing result would demonstrate ha path monitoring behavior. It would not establish that the original ha split-brain recovery failure has been corrected under the required traffic or administrative scope.
Question 221
A repair for advanced routing engine logical routers has been deployed. The affected service previously showed: A migration introduces logical routers, but a new uplink is still attached to an old forwarding context. What observed test result would demonstrate the requirement to place each routed interface into the intended Advanced Routing Engine logical router?
- Trace a controlled flow and confirm lookup occurs in the expected logical router.
- Check the forwarding route and test the supplier prefix without diverting unrelated traffic.
- Verify an established BGP adjacency and an authorized route advertisement.
- Compare announced routes against an allowed prefix inventory after the change.
Explanation
Correct Answer
A:Trace a controlled flow and confirm lookup occurs in the expected logical router. An IP interface must be associated with the routing instance that makes forwarding decisions. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
B:Check the forwarding route and test the supplier prefix without diverting unrelated traffic. A passing result would demonstrate static route next hop behavior. It would not establish that the original advanced routing engine logical routers failure has been corrected under the required traffic or administrative scope.
C:Verify an established BGP adjacency and an authorized route advertisement. A passing result would demonstrate bgp peer establishment behavior. It would not establish that the original advanced routing engine logical routers failure has been corrected under the required traffic or administrative scope.
D:Compare announced routes against an allowed prefix inventory after the change. A passing result would demonstrate route redistribution control behavior. It would not establish that the original advanced routing engine logical routers failure has been corrected under the required traffic or administrative scope.
Question 222
An installation report says the change succeeded. The initial fault was: A firewall has a connected path to its ISP but no route toward a remote supplier prefix. Which independent check most directly proves the goal to install a precise next hop for the supplier destination?
- Verify an established BGP adjacency and an authorized route advertisement.
- Check full adjacency and expected link-state routes after convergence.
- Simulate upstream failure and confirm the primary route withdraws and backup traffic works.
- Check the forwarding route and test the supplier prefix without diverting unrelated traffic.
Explanation
Correct Answer
D:Check the forwarding route and test the supplier prefix without diverting unrelated traffic. A specific static destination route must identify how packets leave the router. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Verify an established BGP adjacency and an authorized route advertisement. A passing result would demonstrate bgp peer establishment behavior. It would not establish that the original static route next hop failure has been corrected under the required traffic or administrative scope.
B:Check full adjacency and expected link-state routes after convergence. A passing result would demonstrate ospf area adjacency behavior. It would not establish that the original static route next hop failure has been corrected under the required traffic or administrative scope.
C:Simulate upstream failure and confirm the primary route withdraws and backup traffic works. A passing result would demonstrate monitored default route behavior. It would not establish that the original static route next hop failure has been corrected under the required traffic or administrative scope.
Question 223
After a controlled firewall change, the original finding was: A new transit peer never reaches established BGP state despite a functioning physical circuit. Which test best demonstrates that the system can now exchange routing information with the authorized external neighbor?
- Check full adjacency and expected link-state routes after convergence.
- Compare announced routes against an allowed prefix inventory after the change.
- Verify an established BGP adjacency and an authorized route advertisement.
- Exercise multiple flows and confirm stable paths and successful return traffic.
Explanation
Correct Answer
C:Verify an established BGP adjacency and an authorized route advertisement. A BGP adjacency requires compatible peer parameters and transport reachability before routes can exchange. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Check full adjacency and expected link-state routes after convergence. A passing result would demonstrate ospf area adjacency behavior. It would not establish that the original bgp peer establishment failure has been corrected under the required traffic or administrative scope.
B:Compare announced routes against an allowed prefix inventory after the change. A passing result would demonstrate route redistribution control behavior. It would not establish that the original bgp peer establishment failure has been corrected under the required traffic or administrative scope.
D:Exercise multiple flows and confirm stable paths and successful return traffic. A passing result would demonstrate equal-cost forwarding design behavior. It would not establish that the original bgp peer establishment failure has been corrected under the required traffic or administrative scope.
Question 224
The configuration has been committed, but the engineer needs functional proof. The earlier issue was: A campus OSPF neighbor is stuck below full adjacency after a router migration. Which acceptance check supports the goal to form a stable adjacency in the intended area?
- Compare announced routes against an allowed prefix inventory after the change.
- Check full adjacency and expected link-state routes after convergence.
- Simulate upstream failure and confirm the primary route withdraws and backup traffic works.
- Test a packet toward the partner subnet and confirm it uses the specific route.
Explanation
Correct Answer
B:Check full adjacency and expected link-state routes after convergence. OSPF peers must agree on key adjacency parameters to share link-state information. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Compare announced routes against an allowed prefix inventory after the change. A passing result would demonstrate route redistribution control behavior. It would not establish that the original ospf area adjacency failure has been corrected under the required traffic or administrative scope.
C:Simulate upstream failure and confirm the primary route withdraws and backup traffic works. A passing result would demonstrate monitored default route behavior. It would not establish that the original ospf area adjacency failure has been corrected under the required traffic or administrative scope.
D:Test a packet toward the partner subnet and confirm it uses the specific route. A passing result would demonstrate route selection and specificity behavior. It would not establish that the original ospf area adjacency failure has been corrected under the required traffic or administrative scope.
Question 225
A repair for route redistribution control has been deployed. The affected service previously showed: A branch advertises too many internal prefixes after adding redistribution from a static table. What observed test result would demonstrate the requirement to export only approved network routes to the neighboring protocol domain?
- Compare announced routes against an allowed prefix inventory after the change.
- Simulate upstream failure and confirm the primary route withdraws and backup traffic works.
- Exercise multiple flows and confirm stable paths and successful return traffic.
- Trace a controlled flow and confirm lookup occurs in the expected logical router.
Explanation
Correct Answer
A:Compare announced routes against an allowed prefix inventory after the change. Redistribution policy should limit route propagation rather than import an entire source table. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
B:Simulate upstream failure and confirm the primary route withdraws and backup traffic works. A passing result would demonstrate monitored default route behavior. It would not establish that the original route redistribution control failure has been corrected under the required traffic or administrative scope.
C:Exercise multiple flows and confirm stable paths and successful return traffic. A passing result would demonstrate equal-cost forwarding design behavior. It would not establish that the original route redistribution control failure has been corrected under the required traffic or administrative scope.
D:Trace a controlled flow and confirm lookup occurs in the expected logical router. A passing result would demonstrate advanced routing engine logical routers behavior. It would not establish that the original route redistribution control failure has been corrected under the required traffic or administrative scope.
Question 226
An installation report says the change succeeded. The initial fault was: A static ISP default route stays installed even after the upstream connection beyond its first hop fails. Which independent check most directly proves the goal to withdraw an unusable primary route and use a valid backup path?
- Exercise multiple flows and confirm stable paths and successful return traffic.
- Test a packet toward the partner subnet and confirm it uses the specific route.
- Check the forwarding route and test the supplier prefix without diverting unrelated traffic.
- Simulate upstream failure and confirm the primary route withdraws and backup traffic works.
Explanation
Correct Answer
D:Simulate upstream failure and confirm the primary route withdraws and backup traffic works. Route monitoring can detect remote unreachability despite an operational local interface. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Exercise multiple flows and confirm stable paths and successful return traffic. A passing result would demonstrate equal-cost forwarding design behavior. It would not establish that the original monitored default route failure has been corrected under the required traffic or administrative scope.
B:Test a packet toward the partner subnet and confirm it uses the specific route. A passing result would demonstrate route selection and specificity behavior. It would not establish that the original monitored default route failure has been corrected under the required traffic or administrative scope.
C:Check the forwarding route and test the supplier prefix without diverting unrelated traffic. A passing result would demonstrate static route next hop behavior. It would not establish that the original monitored default route failure has been corrected under the required traffic or administrative scope.
Question 227
After a controlled firewall change, the original finding was: A data center introduces two equal-cost WAN paths but the traffic distribution differs from the routing team's expectation. Which test best demonstrates that the system can now use supported multipath forwarding without breaking stateful inspection?
- Test a packet toward the partner subnet and confirm it uses the specific route.
- Trace a controlled flow and confirm lookup occurs in the expected logical router.
- Exercise multiple flows and confirm stable paths and successful return traffic.
- Verify an established BGP adjacency and an authorized route advertisement.
Explanation
Correct Answer
C:Exercise multiple flows and confirm stable paths and successful return traffic. ECMP distributes selected flows over eligible next hops and needs a compatible bidirectional design. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Test a packet toward the partner subnet and confirm it uses the specific route. A passing result would demonstrate route selection and specificity behavior. It would not establish that the original equal-cost forwarding design failure has been corrected under the required traffic or administrative scope.
B:Trace a controlled flow and confirm lookup occurs in the expected logical router. A passing result would demonstrate advanced routing engine logical routers behavior. It would not establish that the original equal-cost forwarding design failure has been corrected under the required traffic or administrative scope.
D:Verify an established BGP adjacency and an authorized route advertisement. A passing result would demonstrate bgp peer establishment behavior. It would not establish that the original equal-cost forwarding design failure has been corrected under the required traffic or administrative scope.
Question 228
The configuration has been committed, but the engineer needs functional proof. The earlier issue was: Traffic for a specific partner subnet incorrectly follows a broader default route. Which acceptance check supports the goal to select the most specific eligible destination route?
- Trace a controlled flow and confirm lookup occurs in the expected logical router.
- Test a packet toward the partner subnet and confirm it uses the specific route.
- Check the forwarding route and test the supplier prefix without diverting unrelated traffic.
- Check full adjacency and expected link-state routes after convergence.
Explanation
Correct Answer
B:Test a packet toward the partner subnet and confirm it uses the specific route. Longest-prefix matching selects the most specific applicable destination route. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Trace a controlled flow and confirm lookup occurs in the expected logical router. A passing result would demonstrate advanced routing engine logical routers behavior. It would not establish that the original route selection and specificity failure has been corrected under the required traffic or administrative scope.
C:Check the forwarding route and test the supplier prefix without diverting unrelated traffic. A passing result would demonstrate static route next hop behavior. It would not establish that the original route selection and specificity failure has been corrected under the required traffic or administrative scope.
D:Check full adjacency and expected link-state routes after convergence. A passing result would demonstrate ospf area adjacency behavior. It would not establish that the original route selection and specificity failure has been corrected under the required traffic or administrative scope.
Question 229
A repair for globalprotect portal configuration has been deployed. The affected service previously showed: Remote employees receive portal settings but no stable list of appropriate VPN gateways. What observed test result would demonstrate the requirement to deliver the intended agent and gateway configuration to remote clients?
- Sign in a test agent and verify it receives the expected gateway list.
- Connect a test client and verify a usable tunnel address and permitted application flow.
- Confirm an approved contractor signs in while an unapproved account fails.
- Connect a representative client and verify successful certificate validation and tunnel setup.
Explanation
Correct Answer
A:Sign in a test agent and verify it receives the expected gateway list. A GlobalProtect portal distributes client configuration and gateway selection information. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
B:Connect a test client and verify a usable tunnel address and permitted application flow. A passing result would demonstrate globalprotect gateway connectivity behavior. It would not establish that the original globalprotect portal configuration failure has been corrected under the required traffic or administrative scope.
C:Confirm an approved contractor signs in while an unapproved account fails. A passing result would demonstrate globalprotect authentication profile behavior. It would not establish that the original globalprotect portal configuration failure has been corrected under the required traffic or administrative scope.
D:Connect a representative client and verify successful certificate validation and tunnel setup. A passing result would demonstrate globalprotect certificate trust behavior. It would not establish that the original globalprotect portal configuration failure has been corrected under the required traffic or administrative scope.
Question 230
An installation report says the change succeeded. The initial fault was: A client retrieves portal configuration but cannot establish its secured remote access tunnel. Which independent check most directly proves the goal to terminate an authenticated remote VPN connection at the intended gateway?
- Confirm an approved contractor signs in while an unapproved account fails.
- Verify corporate subnet access uses the tunnel while a designated public flow remains local.
- Connect a client inside and outside the office and verify the expected gateway behavior.
- Connect a test client and verify a usable tunnel address and permitted application flow.
Explanation
Correct Answer
D:Connect a test client and verify a usable tunnel address and permitted application flow. A GlobalProtect gateway authenticates and terminates the remote access connection. The observed behavior is stronger evidence than a successful commit or configuration screenshot by itself.
Incorrect Answers
A:Confirm an approved contractor signs in while an unapproved account fails. A passing result would demonstrate globalprotect authentication profile behavior. It would not establish that the original globalprotect gateway connectivity failure has been corrected under the required traffic or administrative scope.
B:Verify corporate subnet access uses the tunnel while a designated public flow remains local. A passing result would demonstrate globalprotect split-tunnel routes behavior. It would not establish that the original globalprotect gateway connectivity failure has been corrected under the required traffic or administrative scope.
C:Connect a client inside and outside the office and verify the expected gateway behavior. A passing result would demonstrate globalprotect internal gateway recognition behavior. It would not establish that the original globalprotect gateway connectivity failure has been corrected under the required traffic or administrative scope.
