CertArea
All Palo Alto Networks exams

Free Next-Generation Firewall Engineer practice test: 30 questions with answers

30 original questions for Next-Generation Firewall Engineer, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Next-Generation Firewall Engineer exam guide: topics, cost and format

All 30 Next-Generation Firewall Engineer questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

PAN-OS Networking Configuration (10 questions)

  1. Question 1

    An engineer must place a Palo Alto Networks firewall between two Layer 2 switches without changing the IP addressing of either segment. Which interface type should be used?

    1. ATunnel interface, which encapsulates traffic in an IPsec tunnel between two sites
    2. BLayer 3 interface with a static IP address on each side of the firewall
    3. CLoopback interface, which is used only for management traffic to the firewall itself
    4. DVirtual wire, which passes traffic transparently between two interfaces without routing
    Show answer and explanation
    Correct answer: D

    A virtual wire passes traffic transparently between two interfaces, so the segments keep their addressing and the firewall is inserted without routing changes. Layer 3 interfaces would require new addressing, and loopback and tunnel interfaces serve other functions.

  2. Question 2

    Which element defines the boundary that security policy rules use to match traffic on a Palo Alto Networks firewall?

    1. ALog forwarding profiles, which send the log entries to external systems after they are generated
    2. BVirtual routers, which only hold the routing table and cannot be used in security policy matching
    3. CManagement profiles, which control which protocols may reach the management interface of the device
    4. DSecurity zones, which group interfaces and are referenced as the source and destination in rules
    Show answer and explanation
    Correct answer: D

    Security zones group interfaces and are used as source and destination zones in security policy rules. Virtual routers, management profiles and log forwarding profiles serve other functions.

  3. Question 3

    Which NAT type translates the destination address of inbound traffic so that an internal server can be reached from the internet?

    1. ABidirectional NAT that is used only for the firewall's own management plane traffic
    2. BSource NAT with dynamic IP and port, which translates outbound sessions to a shared public address
    3. CStatic source NAT, which translates the source of outbound traffic from a private to a public address
    4. DDestination NAT, which maps a public address and port to an internal server address
    Show answer and explanation
    Correct answer: D

    Destination NAT maps inbound public addresses and ports to internal servers. Source NAT variants translate the source of outbound traffic, which is the opposite direction.

  4. Question 4

    Which high availability mode keeps one firewall actively processing traffic while the peer stands by and takes over on failure?

    1. AClustering with no failover, where each member processes only its own separate traffic
    2. BActive/active HA, where both peers process traffic and share the sessions in every case
    3. CActive/passive HA, where the standby peer takes over the traffic on a failover event
    4. DStandalone operation with a backup configuration file stored on a USB drive in the rack
    Show answer and explanation
    Correct answer: C

    Active/passive HA keeps one peer active and the other ready to take over on failure. Active/active HA has both peers processing traffic, and the other options do not describe HA failover.

  5. Question 5

    Which routing protocol is typically used for dynamic routing between a Palo Alto Networks firewall and an upstream router within an enterprise network?

    1. ATelnet, a terminal access protocol that sends commands and data in plain text
    2. BOSPF, an interior gateway protocol that exchanges routes within an autonomous system
    3. CNTP, a protocol used to synchronise the clocks of devices on the network
    4. DSNMP, a protocol used to monitor and manage devices through management information
    Show answer and explanation
    Correct answer: B

    OSPF is an interior gateway protocol for dynamic routing inside an autonomous system and is supported on PAN-OS. Telnet, NTP and SNMP do not provide routing.

  6. Question 6

    A branch office must connect securely to headquarters over the internet using a site-to-site tunnel. Which feature is appropriate?

    1. AA Telnet session through the public internet that forwards the branch's traffic to HQ
    2. BAn IPsec VPN tunnel with an IKE gateway and an IPsec tunnel interface
    3. CA plain HTTP proxy that forwards unencrypted traffic between the two sites over the internet
    4. DA static NAT rule that exposes the branch's internal network to the public internet directly
    Show answer and explanation
    Correct answer: B

    An IPsec site-to-site VPN uses an IKE gateway and tunnel interface to encrypt traffic between sites. Telnet, plain proxies and static NAT do not provide encrypted site-to-site connectivity.

  7. Question 7

    Remote users need secure access to internal applications from laptops, and the firewall must be able to apply policy based on user identity. Which feature provides this?

    1. AA loopback interface that the users access directly over the internet without any tunnel
    2. BA static route to the internal network that is published to every remote laptop directly
    3. CA virtual wire between the laptops and the internal switch, with no authentication at all
    4. DGlobalProtect, which provides remote access VPN with user-based policy enforcement
    Show answer and explanation
    Correct answer: D

    GlobalProtect provides remote access VPN and enables user-based policy. Static routes, virtual wires and loopbacks do not provide authenticated remote access with identity-based policy.

  8. Question 8

    Which element of a security policy rule matches traffic by application rather than by port number alone?

    1. ALog forwarding profile, which sends logs to an external syslog server or SIEM
    2. BZone protection profile, which protects a zone from floods and reconnaissance traffic
    3. CApp-ID, which identifies applications regardless of the port they use
    4. DAuthentication profile, which verifies the identity of users who sign in to the device
    Show answer and explanation
    Correct answer: C

    App-ID identifies applications independently of port numbers, which allows accurate policy. Zone protection, log forwarding and authentication profiles serve other purposes.

  9. Question 9

    Which feature maps user identities to IP addresses so that security policies can reference users and groups?

    1. AContent-ID, which inspects the content of traffic for threats and data patterns in the session
    2. BUser-ID, which maps users and groups to IP addresses using directory and login information
    3. CApp-ID, which identifies applications and their functions regardless of the port they use
    4. DDecryption policy, which decrypts traffic so that it can be inspected for threats in the session
    Show answer and explanation
    Correct answer: B

    User-ID maps users and groups to IP addresses so policies can reference identities. Content-ID inspects content, App-ID identifies applications, and decryption exposes traffic for inspection.

  10. Question 10

    A security policy allows web traffic, but the firewall must block downloads of executable files from those sessions. Which profile does this?

    1. AA management profile that limits which administrators can log in to the firewall device
    2. BA NAT policy that rewrites the destination address of the download request on the firewall
    3. CA static route that sends the download traffic to an external web server for scanning instead
    4. DFile blocking, which is applied within a security profile group to block specified file types
    Show answer and explanation
    Correct answer: D

    File blocking is a security profile that blocks specified file types within allowed sessions. NAT, static routes and management profiles do not inspect file types.

Device Setting Configuration (10 questions)

  1. Question 11

    Which profile determines how an administrator is authenticated when signing in to the firewall management interface?

    1. AA security policy rule that allows the administrator's IP address to reach the management interface
    2. BAn authentication profile that references an authentication service such as LDAP, RADIUS or SAML
    3. CA NAT policy that translates the administrator's address when the session reaches the device
    4. DA log forwarding profile that sends the administrator's login events to an external system
    Show answer and explanation
    Correct answer: B

    An authentication profile references services such as LDAP, RADIUS or SAML to authenticate administrators. Policy rules, NAT and log forwarding do not authenticate the login.

  2. Question 12

    Which administrator role type restricts an administrator to viewing and managing specific functions without full device control?

    1. AA custom admin role that limits access to selected functions and areas of the device
    2. BA superuser role that grants full control over every function on the device without limits
    3. CA shared root account that every engineer uses for all tasks without any restrictions
    4. DAn anonymous login that provides read access to the device's management pages to anyone
    Show answer and explanation
    Correct answer: A

    Custom admin roles limit access to the functions an administrator needs. Superuser, shared root and anonymous access grant broader or unattributable control.

  3. Question 13

    An administrator needs to send traffic logs from the firewall to an external SIEM. Which configuration is required?

    1. AA static route that points to the SIEM for every packet the firewall receives on any interface
    2. BA log forwarding profile that is attached to the security policy rules whose logs should be sent
    3. CA NAT rule that rewrites the SIEM's address so that log messages can reach the device at all
    4. DA management profile that disables logging so that the SIEM receives a summary every hour
    Show answer and explanation
    Correct answer: B

    A log forwarding profile attached to the relevant security rules sends matching logs to the SIEM. Static routes, NAT rules and disabled logging do not forward logs.

  4. Question 14

    Which certificate type is required so that the firewall can perform SSL forward proxy decryption without browsers showing trust warnings?

    1. AAn expired certificate from a public website that the firewall retrieves during the session
    2. BA self-signed certificate that is never installed on any client device for the proxy function
    3. CA forward trust certificate that is installed in the trusted root store of client devices
    4. DA certificate from a random site that the administrator copies from a browser's history
    Show answer and explanation
    Correct answer: C

    A forward trust certificate must be trusted by clients so decryption does not trigger warnings. Untrusted self-signed, expired and random certificates produce warnings or fail.

  5. Question 15

    Which feature lets a single physical firewall be divided into logically separate firewalls with their own administrators and policy?

    1. AA faster network cable connected between the firewall and the upstream switch in the rack
    2. BA larger memory module installed in the device to store more logs for each separate client
    3. CVirtual systems, which partition a device into separate logical firewalls with their own configuration
    4. DA longer licence term purchased for the firewall so that the device lasts for more years
    Show answer and explanation
    Correct answer: C

    Virtual systems partition a device into separate logical firewalls, each with its own configuration. Memory, cabling and licence term do not partition the device.

  6. Question 16

    Which action is recommended before upgrading the PAN-OS software on a production firewall?

    1. ABack up the configuration, review release notes, and confirm the upgrade path and compatibility
    2. BUpgrade immediately during business hours without a backup, since the upgrade is always reversible
    3. CDisable all logging for the period of the upgrade so that the logs are not affected by the change
    4. DDelete the candidate configuration so that the new version starts with a clean configuration file
    Show answer and explanation
    Correct answer: A

    Backing up configuration, reviewing release notes and confirming the upgrade path and compatibility reduce upgrade risk. Upgrading without backup, disabling logs and deleting configuration each add risk.

  7. Question 17

    Which Panorama feature groups firewalls so that the same policy can be pushed to a set of devices at once?

    1. ADevice groups, which group managed firewalls so that shared policies can be pushed together
    2. BLog collector groups, which only store the logs for devices and do not push any policies
    3. CLocal users on each firewall, which must be created separately on every device in the network
    4. DVirtual routers on the firewall, which hold the routing table of each individual device only
    Show answer and explanation
    Correct answer: A

    Device groups let Panorama push shared policy to a set of firewalls. Log collector groups store logs, local users are per device, and virtual routers are local to each firewall.

  8. Question 18

    Which THREE are valid log types that a Palo Alto Networks firewall can generate? (Choose three.)

    1. ATraffic logs that record sessions allowed or denied by the security policy
    2. BThreat logs that record events matched by security profiles such as antivirus and spyware
    3. CSystem logs that record events about the device's own operation and health
    4. DCanteen logs that record the meals served in the staff kitchen during the working day
    5. EFloor plan logs that record the layout changes to the building's rooms and corridors
    Show answer and explanation
    Correct answer: A, B, C

    Traffic, threat and system logs are standard log types on PAN-OS. Canteen and floor plan records are not firewall logs.

  9. Question 19

    Which feature gives a single summary of traffic by application, user and threat on a Palo Alto Networks firewall?

    1. AThe coffee order page, which lists the drinks ordered for the office each morning
    2. BThe application command centre, which summarises traffic by application, user and threat
    3. CThe rack diagram, which shows the physical location of each device in the cabinet
    4. DThe printer status page, which reports the toner level on the networked printers
    Show answer and explanation
    Correct answer: B

    The application command centre summarises traffic by application, user and threat, which supports investigation and tuning. The other items have no bearing on firewall visibility.

  10. Question 20

    What does a commit validation check in PAN-OS?

    1. AThat every rule has a comment, which is the only requirement for accepting a change
    2. BThat the staff have signed the security policy before each change is made to the device
    3. CThat the candidate configuration is valid before it is applied to the running device
    4. DThat the device is connected to the internet before any configuration is saved at all
    Show answer and explanation
    Correct answer: C

    Validation checks the candidate configuration for errors before it is committed, which prevents broken changes reaching production. Signatures, comments and connectivity are not what validation tests.

Integration and Automation (10 questions)

  1. Question 21

    Which interface provides programmatic access to PAN-OS configuration and operations through HTTP requests that return structured responses?

    1. AThe keyboard shortcut list of the device console, which lists the keys that move the cursor on screen
    2. BThe PAN-OS REST and XML API, which allow scripts to read and change configuration and run operations
    3. CThe printer driver for the firewall's front panel, which controls the status lights on the device
    4. DThe power button on the firewall chassis, which turns the device on and off when pressed
    Show answer and explanation
    Correct answer: B

    The PAN-OS REST and XML APIs allow scripts to read and change configuration and run operations. The other options are not programmatic interfaces.

  2. Question 22

    Which tool is used to manage Palo Alto Networks firewall configuration as code with an infrastructure-as-code provider?

    1. AA spreadsheet macro, which adjusts the colours of the rule table cells when they are edited
    2. BA word processor, which is used to write the design document for the firewall rule set
    3. CThe Terraform provider for PAN-OS, which manages configuration resources declaratively
    4. DA photo editing tool, which resizes screenshots of the device's management pages for the report
    Show answer and explanation
    Correct answer: C

    The Terraform provider for PAN-OS manages configuration as code declaratively. Word processors, spreadsheet macros and photo editors do not manage device configuration.

  3. Question 23

    Which benefit comes from managing firewall rules through version-controlled code and automated pipelines?

    1. AChanges are applied directly by any staff member without review to save time on every request
    2. BChanges are reviewed, tracked, repeatable and easier to roll back when something goes wrong
    3. CRules are kept only in the memory of the engineer who wrote them, which keeps the design secret
    4. DConfiguration drift is encouraged, since every change is made manually on each device separately
    Show answer and explanation
    Correct answer: B

    Version control and pipelines make changes reviewable, repeatable and reversible. Unreviewed changes, personal memory and encouraged drift each increase operational risk.

  4. Question 24

    Which tool provides automation modules for Palo Alto Networks devices as part of configuration management workflows?

    1. AAnsible, with collections that provide modules for managing PAN-OS and Panorama
    2. BA calendar application, which schedules the times when firewall maintenance is planned each month
    3. CA chat application, which sends status messages to the operations team during each change
    4. DA drawing tool, which creates network diagrams for the design documentation of the project
    Show answer and explanation
    Correct answer: A

    Ansible collections provide modules for PAN-OS and Panorama automation. Calendars, chat tools and drawing applications do not automate device configuration.

  5. Question 25

    Which practice keeps automation of firewall changes safe when pipelines push configuration to production?

    1. ADisabling the pipeline's error checks so that deployment never stops for a minor warning message
    2. BPushing every change to production immediately, since automation is always correct the first time
    3. CTesting changes in a non-production environment and requiring approval before production deployment
    4. DAllowing each pipeline to use the superuser account with no restrictions or audit trail at all
    Show answer and explanation
    Correct answer: C

    Testing in non-production and requiring approval before production deployment reduce the risk of automated errors. Immediate pushes, disabled checks and unrestricted superuser access each increase the risk of outages or misuse.

  6. Question 26

    Which API credential practice is recommended for scripts that call the PAN-OS API?

    1. AUse the superuser account for all scripts so that they never fail because of permissions
    2. BEmbed the administrator's username and password in the script so that it always works
    3. CUse an API key tied to a dedicated role with only the permissions the script needs
    4. DShare one API key across every script and team so that the key never needs to be changed
    Show answer and explanation
    Correct answer: C

    A dedicated role with minimal permissions and a scoped API key limits the impact of a leaked key. Embedded passwords, superuser use and shared keys each widen the exposure.

  7. Question 27

    Which format is commonly used by the PAN-OS REST API to exchange structured data with scripts?

    1. AA scanned image of the configuration page, saved as a bitmap file on the desktop
    2. BJSON, a structured text format that scripts can parse easily
    3. CA printed report that must be typed back into the script by hand for each change
    4. DA handwritten note that the engineer reads aloud to the automation tool during each change
    Show answer and explanation
    Correct answer: B

    The REST API commonly exchanges structured JSON, which scripts can parse. Images, printouts and handwritten notes are not machine-readable formats.

  8. Question 28

    Which practice helps detect configuration drift between firewalls that should be identical?

    1. AComparing exported configuration or state against a known baseline on a schedule
    2. BChanging each firewall's configuration by hand whenever a team member has a new idea
    3. CTurning off configuration backups so that the devices no longer record their settings history
    4. DAssuming that identical hardware always holds identical configuration without any checks
    Show answer and explanation
    Correct answer: A

    Comparing configuration against a baseline on a schedule reveals drift early. Manual changes, disabled backups and assumptions each allow drift to grow unseen.

  9. Question 29

    Which tool is commonly used to define infrastructure such as firewall rules and address objects as code, so that they can be versioned and reviewed?

    1. AA drawing tool, which draws the network diagram for the project's design documentation folder
    2. BA presentation tool, which shows the rules on slides for each review meeting with the team
    3. CTerraform, which describes infrastructure resources declaratively in version-controlled files
    4. DA mail client, which sends the change request to the approver by email attachment each time
    Show answer and explanation
    Correct answer: C

    Terraform describes infrastructure resources declaratively in files that can be versioned and reviewed. Presentation, drawing and mail tools do not define infrastructure.

  10. Question 30

    Which TWO are benefits of automating firewall configuration with an API? (Choose two.)

    1. ARepeatable changes that can be tested, reviewed and rolled back consistently
    2. BFaster rollout of standard configurations across many devices with fewer manual errors
    3. CRemoving the need for any change control or review of the configuration changes made
    4. DAllowing unrecorded changes that avoid the audit trail for sensitive rules in the policy
    5. EReplacing all security policy with a single rule that allows traffic from every source
    Show answer and explanation
    Correct answer: A, B

    Automation gives repeatable, testable changes and consistent rollout with fewer manual errors. Removing review, unrecorded changes and replacing policy with one rule each undermine security.