Paloalto Networks NGFW Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: NGFW Engineer
- Exam Name: Palo Alto Networks Next-Generation Firewall Engineer
- Certification Provider: Paloalto Networks
- Latest update: Oct 22,2026
Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)
- A . For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
- B . The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
- C . For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
- D . The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.
C, D
Explanation:
Separate rules must be created for each direction: Palo Alto Networks firewalls enforce security policies based on traffic direction. To allow bidirectional communication through the IPSec tunnel, two separate rules are required – one for incoming and one for outgoing traffic.
IKE negotiation and IPSec/ESP packets are denied by default: Palo Alto Networks firewalls use an interzone default deny policy, meaning that unless an explicit policy allows IKE (UDP 500/4500) and ESP (protocol 50) traffic, the firewall will block these packets, preventing tunnel establishment. Therefore, administrators must create explicit rules permitting IKE and IPSec/ESP traffic to the firewall’s external interface.
What must be configured before a firewall administrator can define policy rules based on users and groups?
- A . User Mapping profile
- B . Authentication profile
- C . Group mapping settings
- D . LDAP Server profile
C
Explanation:
Before a firewall administrator can define policy rules based on users and groups, the Group Mapping settings must be configured. These settings enable the firewall to map users to their respective Active Directory (AD) groups. This mapping allows the firewall to use user and group information to create policy rules based on group membership.
An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to transition between zones without leaving the firewall (no external physical connections). The interfaces for each VSYS are assigned to separate virtual routers (VRs), and inter-VR static routes have been configured. An external zone has been created correctly for each VSYS. Security policies have been added to permit the desired traffic between each zone and its respective external zone. However, the desired traffic is still unable to successfully pass from one VSYS to the other in either direction.
Which additional configuration task is required to resolve this issue?
- A . Create a transit VSYS and route all inter-VSYS traffic through it.
- B . Add each VSYS to the list of visible virtual systems of the other VSYS.
- C . Enable the “allow inter-VSYS traffic” option in both external zone configurations.
- D . Create Security policies to allow the traffic between the two external zones.
B
Explanation:
In Palo Alto Networks firewalls, each virtual system (VSYS) is typically isolated from other VSYSs, meaning that traffic between different VSYSs cannot pass through the firewall by default. In this case, since the interfaces for each VSYS are assigned to separate virtual routers (VRs), and the desired traffic is still not passing between the two VSYSs, the firewall needs to be explicitly configured to allow traffic between them.
The required configuration is to add each VSYS to the list of visible virtual systems of the other VSYS. This allows inter-VSYS communication to be enabled, effectively permitting the traffic to pass between the zones of different VSYSs.
An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML.
Which two actions meet the criteria? (Choose two.)
- A . Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
- B . Create an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.
- C . Create and apply an authentication profile with the “SAML Identity Provider” Server Profile.
- D . Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.
B, D
Explanation:
To enable both RADIUS and SAML authentication to run in parallel during the transition period, you need to configure an authentication sequence and an authentication profile that includes both authentication methods.
By creating an authentication sequence that includes both RADIUS and SAML server profiles, the firewall will attempt authentication with RADIUS first and, if that fails, will fall back to SAML. This enables both authentication types to function simultaneously during the transition period.
You can also configure an authentication profile that includes both the RADIUS Server Profile and the SAML Identity Provider server profile. This setup allows the firewall to use both RADIUS and SAML for authentication requests, and it will check both authentication methods in parallel.
How does a Palo Alto Networks firewall choose the best route when it receives routes for the same destination from different routing protocols?
- A . The route that was received first will be entered into the forwarding table, and all subsequent routes will be rejected.
- B . It will attempt to load balance the traffic across all routes.
- C . It compares the administrative distance and chooses the one with the highest value.
- D . It compares the administrative distance and chooses the one with the lowest value.
D
Explanation:
When a Palo Alto Networks firewall receives routes for the same destination from different routing protocols, it uses the administrative distance (AD) to determine the best route. The administrative distance is a measure of the trustworthiness of a route, with a lower value indicating higher preference. The firewall will choose the route with the lowest administrative distance to populate its forwarding table.
Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)
- A . Select IKE v2, enable the Advanced Options • PQ PPK, then set a 64+ character string for the post-quantum pre shared key.
- B . Ensure Authentication is set to “certificate,” then import a post-quantum derived certificate.
- C . Select IKE v2 Preferred, enable the Advanced Options • PQ KEM, then add one or more “Rounds.”
- D . Select IKE v2, enable the Advanced Options • PQ KEM, then create an IKE Crypto Profile with Advanced Options adding one or more “Rounds.”
C, D
Explanation:
To implement post-quantum cryptography (PQC) in VPNs between Palo Alto Networks NGFWs, you would enable the PQ KEM (Post-Quantum Key Encapsulation Mechanism) in the IKE gateway configuration. This enables the firewall to use quantum-resistant encryption for key exchange, which is an essential part of securing communications against the potential future threats posed by quantum computing.
By selecting IKE v2 Preferred and enabling the PQ KEM option under Advanced Options, you can add specific Rounds for the post-quantum cryptography process, which will help in implementing quantum-resistant key exchange methods.
This option similarly selects IKE v2 and enables PQ KEM while also creating a dedicated IKE Crypto Profile with the necessary Rounds configured for post-quantum cryptography.
An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.
Which action taken by the engineer will resolve this issue?
- A . Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.
- B . Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.
- C . Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.
- D . Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.
B
Explanation:
In a Layer 2 configuration, interfaces are typically grouped into the same Layer 2 zone. When the interfaces are assigned to the same VLAN, the firewall will treat them as part of the same broadcast domain.
In a Layer 2 setup, interfaces must be in the same Layer 2 zone to allow the traffic within the same VLAN to pass. Additionally, a security policy must be configured to allow traffic within this VLAN or zone. This will resolve the issue by ensuring that traffic is permitted between clients behind different interfaces assigned to the same VLAN.
During an upgrade to the routing infrastructure in a customer environment, the network administrator wants to implement Advanced Routing Engine (ARE) on a Palo Alto Networks firewall.
Which firewall models support this configuration?
- A . PA-5280, PA-7080, PA-3250, VM-Series
- B . PA-455, VM-Series, PA-1410, PA-5450
- C . PA-3260, PA-5410, PA-850, PA-460
- D . PA-7050, PA-1420, VM-Series, CN-Series
C
Explanation:
The Advanced Routing Engine (ARE) is supported on Palo Alto Networks firewalls that utilize the PAN-OS 11.0+ software and have the required hardware architecture. The supported models include PA-3200 Series, PA-5400 Series, PA-800 Series, and PA-400 Series. These models provide enhanced routing capabilities, including BGP, OSPF, and more complex routing policies.
PA-3260 and PA-5410 are part of the PA-3200 and PA-5400 Series, which are known to support ARE. PA-850 and PA-460 are within the PA-800 and PA-400 Series, which also support ARE
Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?
- A . When a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.
- B . Local firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.
- C . Panorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.
- D . The order of policy evaluation can be configured differently in different device groups.
B
Explanation:
Local firewall rules are evaluated after Panorama pre-rules (those applied before the firewall’s local policies) and before Panorama post-rules (those applied after the firewall’s local policies). This ensures that the local firewall rules do not override the central Panorama policy and are only applied in the appropriate order within the policy evaluation sequence.
After an engineer configures an IPSec tunnel with a Cisco ASA, the Palo Alto Networks firewall generates system messages reporting the tunnel is failing to establish.
Which of the following actions will resolve this issue?
- A . Ensure that an active static or dynamic route exists for the VPN peer with next hop as the tunnel interface.
- B . Configure the Proxy IDs to match the Cisco ASA configuration.
- C . Check that IPSec is enabled in the management profile on the external interface.
- D . Validate the tunnel interface VLAN against the peer’s configuration.
B
Explanation:
The Proxy IDs (or Traffic Selectors) define the local and remote subnets that are allowed to communicate over the IPSec tunnel. If the Proxy IDs on the Palo Alto Networks firewall do not match the configuration on the Cisco ASA, the tunnel will fail to establish because the firewalls won’t agree
on which traffic to encrypt. Ensuring that the Proxy IDs match between the Palo Alto Networks firewall and the Cisco ASA will resolve the issue.