Palo Alto Networks NGFW-Engineer Practice Test 3
Question 20
A security operations change cannot proceed until the cause is clear. The report states: Two HA nodes lose control-plane contact while each has live data links to the protected networks. Which first check best supports the requirement to limit simultaneous-forwarding risk under control-link failure?
- Check HA1 control synchronization and HA2 session/state links separately for the pair.
- Inspect HA1 failure, heartbeat backup paths and peer state-transition history.
- Inspect HA mode, election status and peer compatibility before altering forwarding.
- Inspect path-monitor target reachability and the configured failure thresholds.
Explanation
Correct Answer
B:Inspect HA1 failure, heartbeat backup paths and peer state-transition history. Loss of peer control connectivity needs deliberate design to reduce dual-active failures. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Check HA1 control synchronization and HA2 session/state links separately for the pair. That check is directed at ha control and data synchronization, a different failure mechanism. It does not isolate the reported ha split-brain recovery dependency, which must be examined before a remedy is selected.
C:Inspect HA mode, election status and peer compatibility before altering forwarding. That check is directed at active/passive ha role placement, a different failure mechanism. It does not isolate the reported ha split-brain recovery dependency, which must be examined before a remedy is selected.
D:Inspect path-monitor target reachability and the configured failure thresholds. That check is directed at ha path monitoring, a different failure mechanism. It does not isolate the reported ha split-brain recovery dependency, which must be examined before a remedy is selected.
Question 21
A firewall engineering team reports the following: A migration introduces logical routers, but a new uplink is still attached to an old forwarding context. The operational requirement is to place each routed interface into the intended Advanced Routing Engine logical router. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Inspect which logical router owns the interface and where the destination route is installed.
- Inspect the selected routing table and candidate next-hop reachability for the remote subnet.
- Examine local and remote AS numbers, neighbor reachability and BGP session logs.
- Inspect redistribution profiles, filters and the actual announced prefix set.
Explanation
Correct Answer
A:Inspect which logical router owns the interface and where the destination route is installed. An IP interface must be associated with the routing instance that makes forwarding decisions. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Inspect the selected routing table and candidate next-hop reachability for the remote subnet. That check is directed at static route next hop, a different failure mechanism. It does not isolate the reported advanced routing engine logical routers dependency, which must be examined before a remedy is selected.
C:Examine local and remote AS numbers, neighbor reachability and BGP session logs. That check is directed at bgp peer establishment, a different failure mechanism. It does not isolate the reported advanced routing engine logical routers dependency, which must be examined before a remedy is selected.
D:Inspect redistribution profiles, filters and the actual announced prefix set. That check is directed at route redistribution control, a different failure mechanism. It does not isolate the reported advanced routing engine logical routers dependency, which must be examined before a remedy is selected.
Question 22
In a controlled network review, the reported condition is: A firewall has a connected path to its ISP but no route toward a remote supplier prefix. The team needs to install a precise next hop for the supplier destination. What diagnostic should precede a change request?
- Examine local and remote AS numbers, neighbor reachability and BGP session logs.
- Compare OSPF area identifiers, interface settings, authentication and hello/dead timers.
- Inspect route-monitor settings and verify reachability beyond the immediate next hop.
- Inspect the selected routing table and candidate next-hop reachability for the remote subnet.
Explanation
Correct Answer
D:Inspect the selected routing table and candidate next-hop reachability for the remote subnet. A specific static destination route must identify how packets leave the router. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Examine local and remote AS numbers, neighbor reachability and BGP session logs. That check is directed at bgp peer establishment, a different failure mechanism. It does not isolate the reported static route next hop dependency, which must be examined before a remedy is selected.
B:Compare OSPF area identifiers, interface settings, authentication and hello/dead timers. That check is directed at ospf area adjacency, a different failure mechanism. It does not isolate the reported static route next hop dependency, which must be examined before a remedy is selected.
C:Inspect route-monitor settings and verify reachability beyond the immediate next hop. That check is directed at monitored default route, a different failure mechanism. It does not isolate the reported static route next hop dependency, which must be examined before a remedy is selected.
Question 23
An engineer is troubleshooting bgp peer establishment. The observed condition is: A new transit peer never reaches established BGP state despite a functioning physical circuit. Which evidence-gathering action best establishes how to exchange routing information with the authorized external neighbor?
- Compare OSPF area identifiers, interface settings, authentication and hello/dead timers.
- Inspect redistribution profiles, filters and the actual announced prefix set.
- Examine local and remote AS numbers, neighbor reachability and BGP session logs.
- Inspect the installed equal-cost routes, flow hashing and asymmetric return paths.
Explanation
Correct Answer
C:Examine local and remote AS numbers, neighbor reachability and BGP session logs. A BGP adjacency requires compatible peer parameters and transport reachability before routes can exchange. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Compare OSPF area identifiers, interface settings, authentication and hello/dead timers. That check is directed at ospf area adjacency, a different failure mechanism. It does not isolate the reported bgp peer establishment dependency, which must be examined before a remedy is selected.
B:Inspect redistribution profiles, filters and the actual announced prefix set. That check is directed at route redistribution control, a different failure mechanism. It does not isolate the reported bgp peer establishment dependency, which must be examined before a remedy is selected.
D:Inspect the installed equal-cost routes, flow hashing and asymmetric return paths. That check is directed at equal-cost forwarding design, a different failure mechanism. It does not isolate the reported bgp peer establishment dependency, which must be examined before a remedy is selected.
Question 24
A security operations change cannot proceed until the cause is clear. The report states: A campus OSPF neighbor is stuck below full adjacency after a router migration. Which first check best supports the requirement to form a stable adjacency in the intended area?
- Inspect redistribution profiles, filters and the actual announced prefix set.
- Compare OSPF area identifiers, interface settings, authentication and hello/dead timers.
- Inspect route-monitor settings and verify reachability beyond the immediate next hop.
- Inspect the forwarding table for overlapping prefixes and the actual selected route.
Explanation
Correct Answer
B:Compare OSPF area identifiers, interface settings, authentication and hello/dead timers. OSPF peers must agree on key adjacency parameters to share link-state information. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect redistribution profiles, filters and the actual announced prefix set. That check is directed at route redistribution control, a different failure mechanism. It does not isolate the reported ospf area adjacency dependency, which must be examined before a remedy is selected.
C:Inspect route-monitor settings and verify reachability beyond the immediate next hop. That check is directed at monitored default route, a different failure mechanism. It does not isolate the reported ospf area adjacency dependency, which must be examined before a remedy is selected.
D:Inspect the forwarding table for overlapping prefixes and the actual selected route. That check is directed at route selection and specificity, a different failure mechanism. It does not isolate the reported ospf area adjacency dependency, which must be examined before a remedy is selected.
Question 25
A firewall engineering team reports the following: A branch advertises too many internal prefixes after adding redistribution from a static table. The operational requirement is to export only approved network routes to the neighboring protocol domain. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Inspect redistribution profiles, filters and the actual announced prefix set.
- Inspect route-monitor settings and verify reachability beyond the immediate next hop.
- Inspect the installed equal-cost routes, flow hashing and asymmetric return paths.
- Inspect which logical router owns the interface and where the destination route is installed.
Explanation
Correct Answer
A:Inspect redistribution profiles, filters and the actual announced prefix set. Redistribution policy should limit route propagation rather than import an entire source table. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Inspect route-monitor settings and verify reachability beyond the immediate next hop. That check is directed at monitored default route, a different failure mechanism. It does not isolate the reported route redistribution control dependency, which must be examined before a remedy is selected.
C:Inspect the installed equal-cost routes, flow hashing and asymmetric return paths. That check is directed at equal-cost forwarding design, a different failure mechanism. It does not isolate the reported route redistribution control dependency, which must be examined before a remedy is selected.
D:Inspect which logical router owns the interface and where the destination route is installed. That check is directed at advanced routing engine logical routers, a different failure mechanism. It does not isolate the reported route redistribution control dependency, which must be examined before a remedy is selected.
Question 26
In a controlled network review, the reported condition is: A static ISP default route stays installed even after the upstream connection beyond its first hop fails. The team needs to withdraw an unusable primary route and use a valid backup path. What diagnostic should precede a change request?
- Inspect the installed equal-cost routes, flow hashing and asymmetric return paths.
- Inspect the forwarding table for overlapping prefixes and the actual selected route.
- Inspect the selected routing table and candidate next-hop reachability for the remote subnet.
- Inspect route-monitor settings and verify reachability beyond the immediate next hop.
Explanation
Correct Answer
D:Inspect route-monitor settings and verify reachability beyond the immediate next hop. Route monitoring can detect remote unreachability despite an operational local interface. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the installed equal-cost routes, flow hashing and asymmetric return paths. That check is directed at equal-cost forwarding design, a different failure mechanism. It does not isolate the reported monitored default route dependency, which must be examined before a remedy is selected.
B:Inspect the forwarding table for overlapping prefixes and the actual selected route. That check is directed at route selection and specificity, a different failure mechanism. It does not isolate the reported monitored default route dependency, which must be examined before a remedy is selected.
C:Inspect the selected routing table and candidate next-hop reachability for the remote subnet. That check is directed at static route next hop, a different failure mechanism. It does not isolate the reported monitored default route dependency, which must be examined before a remedy is selected.
Question 27
An engineer is troubleshooting equal-cost forwarding design. The observed condition is: A data center introduces two equal-cost WAN paths but the traffic distribution differs from the routing team's expectation. Which evidence-gathering action best establishes how to use supported multipath forwarding without breaking stateful inspection?
- Inspect the forwarding table for overlapping prefixes and the actual selected route.
- Inspect which logical router owns the interface and where the destination route is installed.
- Inspect the installed equal-cost routes, flow hashing and asymmetric return paths.
- Examine local and remote AS numbers, neighbor reachability and BGP session logs.
Explanation
Correct Answer
C:Inspect the installed equal-cost routes, flow hashing and asymmetric return paths. ECMP distributes selected flows over eligible next hops and needs a compatible bidirectional design. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the forwarding table for overlapping prefixes and the actual selected route. That check is directed at route selection and specificity, a different failure mechanism. It does not isolate the reported equal-cost forwarding design dependency, which must be examined before a remedy is selected.
B:Inspect which logical router owns the interface and where the destination route is installed. That check is directed at advanced routing engine logical routers, a different failure mechanism. It does not isolate the reported equal-cost forwarding design dependency, which must be examined before a remedy is selected.
D:Examine local and remote AS numbers, neighbor reachability and BGP session logs. That check is directed at bgp peer establishment, a different failure mechanism. It does not isolate the reported equal-cost forwarding design dependency, which must be examined before a remedy is selected.
Question 28
A security operations change cannot proceed until the cause is clear. The report states: Traffic for a specific partner subnet incorrectly follows a broader default route. Which first check best supports the requirement to select the most specific eligible destination route?
- Inspect which logical router owns the interface and where the destination route is installed.
- Inspect the forwarding table for overlapping prefixes and the actual selected route.
- Inspect the selected routing table and candidate next-hop reachability for the remote subnet.
- Compare OSPF area identifiers, interface settings, authentication and hello/dead timers.
Explanation
Correct Answer
B:Inspect the forwarding table for overlapping prefixes and the actual selected route. Longest-prefix matching selects the most specific applicable destination route. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect which logical router owns the interface and where the destination route is installed. That check is directed at advanced routing engine logical routers, a different failure mechanism. It does not isolate the reported route selection and specificity dependency, which must be examined before a remedy is selected.
C:Inspect the selected routing table and candidate next-hop reachability for the remote subnet. That check is directed at static route next hop, a different failure mechanism. It does not isolate the reported route selection and specificity dependency, which must be examined before a remedy is selected.
D:Compare OSPF area identifiers, interface settings, authentication and hello/dead timers. That check is directed at ospf area adjacency, a different failure mechanism. It does not isolate the reported route selection and specificity dependency, which must be examined before a remedy is selected.
Question 29
A firewall engineering team reports the following: Remote employees receive portal settings but no stable list of appropriate VPN gateways. The operational requirement is to deliver the intended agent and gateway configuration to remote clients. Before altering the configuration, which investigation most directly identifies the relevant gap?
- Inspect portal agent configuration, user matching and gateway assignments.
- Inspect gateway authentication, tunnel interface settings and connection logs.
- Inspect the gateway or portal authentication profile and identity source mapping.
- Inspect certificate subject, chain, expiry and the trust stores used by GlobalProtect clients.
Explanation
Correct Answer
A:Inspect portal agent configuration, user matching and gateway assignments. A GlobalProtect portal distributes client configuration and gateway selection information. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
B:Inspect gateway authentication, tunnel interface settings and connection logs. That check is directed at globalprotect gateway connectivity, a different failure mechanism. It does not isolate the reported globalprotect portal configuration dependency, which must be examined before a remedy is selected.
C:Inspect the gateway or portal authentication profile and identity source mapping. That check is directed at globalprotect authentication profile, a different failure mechanism. It does not isolate the reported globalprotect portal configuration dependency, which must be examined before a remedy is selected.
D:Inspect certificate subject, chain, expiry and the trust stores used by GlobalProtect clients. That check is directed at globalprotect certificate trust, a different failure mechanism. It does not isolate the reported globalprotect portal configuration dependency, which must be examined before a remedy is selected.
Question 30
In a controlled network review, the reported condition is: A client retrieves portal configuration but cannot establish its secured remote access tunnel. The team needs to terminate an authenticated remote VPN connection at the intended gateway. What diagnostic should precede a change request?
- Inspect the gateway or portal authentication profile and identity source mapping.
- Inspect pushed split-tunnel access routes, included domains and resolved client routes.
- Check the configured internal host detection and the client's observed network evidence.
- Inspect gateway authentication, tunnel interface settings and connection logs.
Explanation
Correct Answer
D:Inspect gateway authentication, tunnel interface settings and connection logs. A GlobalProtect gateway authenticates and terminates the remote access connection. The check evaluates the failing dependency before configuration changes are assumed to be necessary.
Incorrect Answers
A:Inspect the gateway or portal authentication profile and identity source mapping. That check is directed at globalprotect authentication profile, a different failure mechanism. It does not isolate the reported globalprotect gateway connectivity dependency, which must be examined before a remedy is selected.
B:Inspect pushed split-tunnel access routes, included domains and resolved client routes. That check is directed at globalprotect split-tunnel routes, a different failure mechanism. It does not isolate the reported globalprotect gateway connectivity dependency, which must be examined before a remedy is selected.
C:Check the configured internal host detection and the client's observed network evidence. That check is directed at globalprotect internal gateway recognition, a different failure mechanism. It does not isolate the reported globalprotect gateway connectivity dependency, which must be examined before a remedy is selected.
