Next-Generation Firewall Engineer

Last checked October 22, 2026 against the official Palo Alto Networks exam page.

1. Question 1PAN-OS Networking Configuration

   An engineer must place a Palo Alto Networks firewall between two Layer 2 switches without changing the IP addressing of either segment. Which interface type should be used?

   1. ATunnel interface, which encapsulates traffic in an IPsec tunnel between two sites
   2. BLayer 3 interface with a static IP address on each side of the firewall
   3. CLoopback interface, which is used only for management traffic to the firewall itself
   4. DVirtual wire, which passes traffic transparently between two interfaces without routing
   Show answer and explanationHide answer

   Correct answer: D

   A virtual wire passes traffic transparently between two interfaces, so the segments keep their addressing and the firewall is inserted without routing changes. Layer 3 interfaces would require new addressing, and loopback and tunnel interfaces serve other functions.

2. Question 2Device Setting Configuration

   Which profile determines how an administrator is authenticated when signing in to the firewall management interface?

   1. AA security policy rule that allows the administrator's IP address to reach the management interface
   2. BAn authentication profile that references an authentication service such as LDAP, RADIUS or SAML
   3. CA NAT policy that translates the administrator's address when the session reaches the device
   4. DA log forwarding profile that sends the administrator's login events to an external system
   Show answer and explanationHide answer

   Correct answer: B

   An authentication profile references services such as LDAP, RADIUS or SAML to authenticate administrators. Policy rules, NAT and log forwarding do not authenticate the login.

3. Question 3Integration and Automation

   Which interface provides programmatic access to PAN-OS configuration and operations through HTTP requests that return structured responses?

   1. AThe keyboard shortcut list of the device console, which lists the keys that move the cursor on screen
   2. BThe PAN-OS REST and XML API, which allow scripts to read and change configuration and run operations
   3. CThe printer driver for the firewall's front panel, which controls the status lights on the device
   4. DThe power button on the firewall chassis, which turns the device on and off when pressed
   Show answer and explanationHide answer

   Correct answer: B

   The PAN-OS REST and XML APIs allow scripts to read and change configuration and run operations. The other options are not programmatic interfaces.

4. Question 4PAN-OS Networking Configuration

   Which element defines the boundary that security policy rules use to match traffic on a Palo Alto Networks firewall?

   1. ALog forwarding profiles, which send the log entries to external systems after they are generated
   2. BVirtual routers, which only hold the routing table and cannot be used in security policy matching
   3. CManagement profiles, which control which protocols may reach the management interface of the device
   4. DSecurity zones, which group interfaces and are referenced as the source and destination in rules
   Show answer and explanationHide answer

   Correct answer: D

   Security zones group interfaces and are used as source and destination zones in security policy rules. Virtual routers, management profiles and log forwarding profiles serve other functions.

5. Question 5Device Setting Configuration

   Which administrator role type restricts an administrator to viewing and managing specific functions without full device control?

   1. AA custom admin role that limits access to selected functions and areas of the device
   2. BA superuser role that grants full control over every function on the device without limits
   3. CA shared root account that every engineer uses for all tasks without any restrictions
   4. DAn anonymous login that provides read access to the device's management pages to anyone
   Show answer and explanationHide answer

   Correct answer: A

   Custom admin roles limit access to the functions an administrator needs. Superuser, shared root and anonymous access grant broader or unattributable control.