Paloalto Networks NGFW Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: NGFW Engineer
- Exam Name: Palo Alto Networks Next-Generation Firewall Engineer
- Certification Provider: Paloalto Networks
- Latest update: Oct 22,2026
Question #41
An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?
- A . Modify all active Log Forwarding profiles to select the “Cloud Logging” option in each profile match list in the appropriate device groups.
- B . Enable the “Panorama/Cloud Logging” option in the Logging and Reporting Settings section under Device –> Setup –> Management in the appropriate templates.
- C . Select the “Enable Duplicate Logging” option in the Cloud Logging section under Device –> Setup – -> Management in the appropriate templates.
- D . Select the “Enable Cloud Logging” option in the Cloud Logging section under Device –> Setup –> Management in the appropriate templates.
Correct Answer: D
D
Explanation:
To begin sending logs to Strata Logging Service while continuing to forward them to Panorama log collectors, the necessary configuration is to enable Cloud Logging. This option is configured in the Cloud Logging section under Device → Setup → Management in the appropriate templates. Once enabled, this ensures that logs are directed both to the Strata Logging Service (cloud) and to the Panorama log collectors.
D
Explanation:
To begin sending logs to Strata Logging Service while continuing to forward them to Panorama log collectors, the necessary configuration is to enable Cloud Logging. This option is configured in the Cloud Logging section under Device → Setup → Management in the appropriate templates. Once enabled, this ensures that logs are directed both to the Strata Logging Service (cloud) and to the Panorama log collectors.
Question #42
Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?
- A . It acts as a logging service for NGFW performance metrics.
- B . It orchestrates real-time traffic inspection for network segments.
- C . It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.
- D . It manages threat intelligence data synchronization with NGFWs.
Correct Answer: C
C
Explanation:
Terraform is an Infrastructure-as-Code (IaC) tool that automates the provisioning and management of infrastructure resources, including Palo Alto Networks Next-Generation Firewalls (NGFWs). By using Terraform configuration files, administrators can define and deploy NGFW instances across cloud environments (such as AWS, Azure, and GCP) efficiently and consistently.
Terraform enables:
Automated firewall deployment in cloud environments.
Configuration of security policies and networking settings in a declarative manner.
Scalability and repeatability, reducing manual intervention in firewall provisioning.
C
Explanation:
Terraform is an Infrastructure-as-Code (IaC) tool that automates the provisioning and management of infrastructure resources, including Palo Alto Networks Next-Generation Firewalls (NGFWs). By using Terraform configuration files, administrators can define and deploy NGFW instances across cloud environments (such as AWS, Azure, and GCP) efficiently and consistently.
Terraform enables:
Automated firewall deployment in cloud environments.
Configuration of security policies and networking settings in a declarative manner.
Scalability and repeatability, reducing manual intervention in firewall provisioning.
Question #43
When integrating Kubernetes with Palo Alto Networks NGFWs, what is used to secure traffic between microservices?
- A . Service graph
- B . Ansible automation modules
- C . Panorama role-based access control
- D . CN-Series firewalls
Correct Answer: D
D
Explanation:
When integrating Kubernetes with Palo Alto Networks NGFWs, the CN-Series firewalls are specifically designed to secure traffic between microservices in containerized environments. These firewalls provide advanced security features like Application Identification (App-ID), URL filtering, and Threat Prevention to secure communication between containers and microservices within a Kubernetes environment.
D
Explanation:
When integrating Kubernetes with Palo Alto Networks NGFWs, the CN-Series firewalls are specifically designed to secure traffic between microservices in containerized environments. These firewalls provide advanced security features like Application Identification (App-ID), URL filtering, and Threat Prevention to secure communication between containers and microservices within a Kubernetes environment.
Question #44
Which two statements describe an external zone in the context of virtual systems (VSYS) on a Palo Alto Networks firewall? (Choose two.)
- A . It is associated with an interface within a VSYS of a firewall.
- B . It is a security object associated with a specific virtual router of a VSYS.
- C . It is not associated with an interface; it is associated with a VSYS itself.
- D . It is a security object associated with a specific VSYS.
Correct Answer: A, D
A, D
Explanation:
In the context of virtual systems (VSYS) on a Palo Alto Networks firewall, the external zone is typically associated with specific interfaces within a VSYS. Zones are fundamental security objects used to define traffic flow between interfaces, and the external zone would be used for interfaces that connect to external networks.
An external zone is associated with an interface within a VSYS of the firewall. This ensures that traffic
from specific interfaces can be classified as belonging to the external zone, allowing the firewall to apply appropriate security policies.
The external zone is indeed a security object that is specific to a given VSYS, as each VSYS can have its own set of zones that are isolated from others.
A, D
Explanation:
In the context of virtual systems (VSYS) on a Palo Alto Networks firewall, the external zone is typically associated with specific interfaces within a VSYS. Zones are fundamental security objects used to define traffic flow between interfaces, and the external zone would be used for interfaces that connect to external networks.
An external zone is associated with an interface within a VSYS of the firewall. This ensures that traffic
from specific interfaces can be classified as belonging to the external zone, allowing the firewall to apply appropriate security policies.
The external zone is indeed a security object that is specific to a given VSYS, as each VSYS can have its own set of zones that are isolated from others.
Question #45
How does a Palo Alto Networks NGFW respond when the preemptive hold time is set to 0 minutes during configuration of route monitoring?
- A . It does not accept the configuration.
- B . It accepts the configuration but throws a warning message.
- C . It removes the static route because 0 is a NULL value
- D . It reinstalls the route into the routing information base (RIB) as soon as the path comes up.
Correct Answer: D
D
Explanation:
When the preemptive hold time is set to 0 minutes in route monitoring, the firewall is configured to immediately reinstall the route into the Routing Information Base (RIB) as soon as the monitored path comes up. This essentially means that the firewall will not wait for any predefined hold time before reestablishing the route once the monitoring condition is met, ensuring a faster recovery of the route.
D
Explanation:
When the preemptive hold time is set to 0 minutes in route monitoring, the firewall is configured to immediately reinstall the route into the Routing Information Base (RIB) as soon as the monitored path comes up. This essentially means that the firewall will not wait for any predefined hold time before reestablishing the route once the monitoring condition is met, ensuring a faster recovery of the route.
Question #46
Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?
- A . Import the new subordinate CA certificate into the trust stores of all client devices.
- B . Set the subordinate CA certificate as the default routing certificate for all network traffic.
- C . Configure the subordinate CA to issue certificates with indefinite validity periods.
- D . Disable all existing SSL decryption rules until the new certificate is fully propagated.
Correct Answer: A
A
Explanation:
When implementing a new self-signed root certificate authority (CA) for SSL decryption on a Palo Alto Networks firewall, the subordinate CA certificate (which is generated by the firewall) must be imported into the trust stores of all client devices. This ensures that client devices trust the firewall as a valid certificate authority, enabling the firewall to decrypt and re-encrypt SSL traffic.
Importing the subordinate CA certificate into the client devices’ trust stores is necessary for those devices to trust the new self-signed root CA and properly handle SSL decryption traffic.
A
Explanation:
When implementing a new self-signed root certificate authority (CA) for SSL decryption on a Palo Alto Networks firewall, the subordinate CA certificate (which is generated by the firewall) must be imported into the trust stores of all client devices. This ensures that client devices trust the firewall as a valid certificate authority, enabling the firewall to decrypt and re-encrypt SSL traffic.
Importing the subordinate CA certificate into the client devices’ trust stores is necessary for those devices to trust the new self-signed root CA and properly handle SSL decryption traffic.
Question #47
An engineer at a managed services provider is updating an application that allows its customers to request firewall changes to also manage SD-WAN. The application will be able to make any approved changes directly to devices via API.
What is a requirement for the application to create SD-WAN interfaces?
- A . REST API’s “sdwanInterfaceprofiles” parameter on a Panorama device
- B . REST API’s “sdwanInterfaces” parameter on a firewall device
- C . XML API’s “sdwanprofiles/interfaces” parameter on a Panorama device
- D . XML API’s “InterfaceProfiles/sdwan” parameter on a firewall device
Correct Answer: B
B
Explanation:
To create SD-WAN interfaces through an API, the correct approach is to use the REST API’s "sdwanInterfaces" parameter on a firewall device. This parameter allows you to configure SD-WAN interfaces directly on the firewall devices via API, ensuring that the required interfaces are set up and managed for SD-WAN functionality.
B
Explanation:
To create SD-WAN interfaces through an API, the correct approach is to use the REST API’s "sdwanInterfaces" parameter on a firewall device. This parameter allows you to configure SD-WAN interfaces directly on the firewall devices via API, ensuring that the required interfaces are set up and managed for SD-WAN functionality.
Question #48
What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?
- A . Scanning, Isolation, Whitelisting, Logging
- B . Discovery, Deployment, Detection, Prevention
- C . Policy Generation, Discovery, Enforcement, Logging
- D . Profiling, Policy Generation, Enforcement, Reporting
Correct Answer: B
B
Explanation:
The phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution are designed to help identify and protect against potential threats in real time by using AI to detect and prevent malicious activities within the network.
Discovery: Identifying applications, services, and behaviors within the network to understand baseline activity.
Deployment: Implementing the solution into the network and integrating with existing security measures.
Detection: Monitoring traffic and activities to identify abnormal or malicious behavior.
Prevention: Taking action to stop threats once detected, such as blocking malicious traffic or stopping exploit attempts.
B
Explanation:
The phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution are designed to help identify and protect against potential threats in real time by using AI to detect and prevent malicious activities within the network.
Discovery: Identifying applications, services, and behaviors within the network to understand baseline activity.
Deployment: Implementing the solution into the network and integrating with existing security measures.
Detection: Monitoring traffic and activities to identify abnormal or malicious behavior.
Prevention: Taking action to stop threats once detected, such as blocking malicious traffic or stopping exploit attempts.
Question #49
An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS,
Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-west traffic
within each cluster, maintain consistent Security policies across all environments, and dynamically
scale as containerized workloads spin up or down. They also plan to use a centralized Panorama
instance for policy management and visibility.
Which approach meets these requirements?
- A . Install standalone CN-Series instances in each cluster with local configuration only. Export daily policy configuration snapshots to Panorama for recordkeeping, but do not unify policy enforcement.
- B . Configure the CN-Series only in public cloud clusters, and rely on Kubernetes Network Policies for on-premises cluster security. Synchronize partial policy information into Panorama manually as needed.
- C . Use Kubernetes-native deployment tools (e.g., Helm) to deploy CN-Series in each cluster, ensuring local insertion into the service mesh or CNI. Manage all CN-Series firewalls centrally from Panorama, applying uniform Security policies across on-premises and cloud clusters.
- D . Deploy a single CN-Series firewall in the on-premises data center to process traffic for all clusters, connecting remote clusters via VPN or peering. Manage this single instance through Panorama.
Correct Answer: C
C
Explanation:
This approach meets all the requirements for securing east-west traffic within each Kubernetes cluster, maintaining consistent security policies across on-premises and cloud environments, and allowing for dynamic scaling of the CN-Series NGFWs as containerized workloads spin up or down. By using Kubernetes-native deployment tools (such as Helm), the CN-Series NGFWs can be deployed and scaled dynamically within each cluster. Local insertion into the service mesh or CNI ensures that the NGFW can inspect traffic at the appropriate points within the cluster.
Centralized management via Panorama ensures that security policies are uniform across both on-premises and cloud environments, providing visibility and control across all clusters.
C
Explanation:
This approach meets all the requirements for securing east-west traffic within each Kubernetes cluster, maintaining consistent security policies across on-premises and cloud environments, and allowing for dynamic scaling of the CN-Series NGFWs as containerized workloads spin up or down. By using Kubernetes-native deployment tools (such as Helm), the CN-Series NGFWs can be deployed and scaled dynamically within each cluster. Local insertion into the service mesh or CNI ensures that the NGFW can inspect traffic at the appropriate points within the cluster.
Centralized management via Panorama ensures that security policies are uniform across both on-premises and cloud environments, providing visibility and control across all clusters.
Question #50
Which forwarding methods can be used on the Objects tab when configuring the Log Forwarding profile?
- A . Panorama, syslog, email
- B . Syslog, HTTP, NetFlow
- C . Panorama, ADEM, syslog
- D . SNMP, HTTP, RADIUS
Correct Answer: A
A
Explanation:
When configuring the Log Forwarding profile on a Palo Alto Networks firewall, the forwarding methods available include:
Panorama: For forwarding logs to a Panorama management system.
Syslog: For forwarding logs to a syslog server.
Email: For sending logs via email.
A
Explanation:
When configuring the Log Forwarding profile on a Palo Alto Networks firewall, the forwarding methods available include:
Panorama: For forwarding logs to a Panorama management system.
Syslog: For forwarding logs to a syslog server.
Email: For sending logs via email.