I85PREP
⌘ K
NGFW Engineer study materials
NGFW Engineer study resources

NGFW Engineer practice questions

One question at a time. Build your NGFW Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment and Installation

A security team wants to monitor traffic on a switch without affecting forwarding. Which firewall deployment mode receives a copy of traffic from a SPAN port?

  1. Virtual Wire mode
  2. Layer 2 mode
  3. TAP mode Correct answer.
  4. Layer 3 mode

Explanation

TAP mode connects the firewall to a mirror or SPAN port and inspects a passive copy of the traffic. Because the firewall is not inline, it cannot block or modify the original flow. Virtual Wire, Layer 2, and Layer 3 modes are inline deployments that participate in the forwarding path.

Question 2Deployment and Installation

What is the default IPv4 address assigned to the management interface of a Palo Alto Networks hardware firewall?

  1. 10.0.0.1/24
  2. 172.16.0.1/24
  3. 203.0.113.1/24
  4. 192.168.1.1/24 Correct answer.

Explanation

A new hardware firewall ships with the management interface configured as 192.168.1.1/24. Administrators connect to this address to perform initial setup before changing it to a production management address. The other addresses are common private or documentation ranges but are not the factory default.

Question 3Deployment and Installation

Which credentials are configured by default on a newly shipped Palo Alto Networks firewall?

  1. root / paloalto
  2. admin / password
  3. paloalto / admin
  4. admin / admin Correct answer.

Explanation

The factory configuration includes a single administrative account with the username admin and the password admin. Best practice is to change this password during initial setup and before connecting the firewall to untrusted networks. The other combinations are not default accounts on the platform.

Question 4Deployment and Installation

Which action is required before a firewall can install a license and activate subscriptions?

  1. Configure a virtual router
  2. Enable high availability
  3. Register the serial number Correct answer.
  4. Create a security zone

Explanation

The firewall serial number must be registered to a support account before licenses can be issued and installed. Registration associates the device with the customer account and enables subscription entitlements. Virtual routers, zones, and HA are configuration features and do not activate licensing.

Question 5Deployment and Installation

Two firewall interfaces are placed inline between a router and a switch. No IP addresses or switching decisions are required on the data path. Which interface configuration meets this requirement?

  1. A Layer 3 subinterface with DHCP
  2. A Layer 2 interface in a VLAN
  3. A TAP interface bound to a SPAN port
  4. A virtual wire pair Correct answer.

Explanation

A virtual wire pair binds two interfaces together so that traffic entering one interface exits the other transparently. No IP addressing or MAC-based switching is required on the data path. Layer 3 and Layer 2 interfaces require addressing or VLAN logic, while TAP is passive and cannot forward inline traffic.

Question 6Deployment and Installation

Which link carries heartbeats, hello messages, and state synchronization in an active/passive HA pair?

  1. HA1 control link Correct answer.
  2. HA2 data link
  3. Management interface
  4. HA3 forwarding link

Explanation

The HA1 control link carries heartbeats, hello messages, and synchronization of configuration and state information between HA peers. The HA2 link carries session and forwarding information for seamless failover. HA3 is not a standard HA link type, and the management interface is not used for HA control traffic.

Question 7Deployment and Installation

Which HA configuration allows both firewalls to process sessions simultaneously by using floating IP addresses and separate virtual routers?

  1. Standalone
  2. Active/passive
  3. HA Lite
  4. Active/active Correct answer.

Explanation

Active/active HA uses two virtual routers and floating IP addresses so that both peers can forward sessions at the same time. Active/passive keeps one peer on standby, HA Lite is a reduced-function mode, and standalone is not an HA configuration.

Question 8Deployment and Installation

Before a Layer 3 interface can be referenced by a security policy, what must be assigned to it?

  1. A virtual router only
  2. A security zone Correct answer.
  3. A service route
  4. A management profile only

Explanation

Every dataplane interface used in security policy must be bound to a security zone. The zone defines the security boundary that policy rules reference. A virtual router is also needed for routing, but the policy requirement is the zone assignment.

Question 9Deployment and Installation

Two interfaces are each assigned to different virtual routers. What happens to traffic that must pass between them?

  1. The firewall automatically leaks connected routes between them.
  2. The interfaces become a virtual wire pair.
  3. It cannot be routed because each virtual router keeps a separate routing table. Correct answer.
  4. The firewall bridges them at Layer 2.

Explanation

Each virtual router maintains an independent routing table, and routes are not shared between virtual routers by default. Traffic cannot be routed from one virtual router to another without an explicit design such as a shared interface or external routing. Assigning interfaces to different virtual routers does not create a virtual wire or Layer 2 bridge.

Question 10Deployment and Installation

What is the default action for interzone traffic when no security policy rule matches?

  1. Allow
  2. Drop silently
  3. Deny with reset
  4. Deny Correct answer.

Explanation

The default interzone action is deny, so traffic between different zones is blocked unless a policy rule explicitly permits it. Intrazone traffic has a different default and is allowed by default. This implicit deny behavior is foundational to zone-based security policy design.

Question 11Deployment and Installation

An administrator needs to commit a configuration change even though another administrator has an uncommitted change in the same shared policy. Which commit option should be used?

  1. Commit Force Correct answer.
  2. Commit
  3. Validate
  4. Commit All

Explanation

Commit Force commits the changes even when another administrator holds the commit lock or has uncommitted changes. A standard commit can be blocked by the lock, and Commit All commits all changes but does not override the lock. Validate only checks the configuration for errors without applying it.

Question 12Deployment and Installation

Which file format is used when exporting a firewall configuration for backup?

  1. PCAP
  2. XML Correct answer.
  3. JSON
  4. CSV

Explanation

A firewall configuration export is saved as an XML file that contains the device configuration. This file can be imported to restore settings or to move configuration to another device. CSV, PCAP, and JSON are used for other data types and are not the native configuration export format.

Question 13Deployment and Installation

What is the recommended first step before upgrading PAN-OS on a production firewall?

  1. Export the current configuration and review release notes Correct answer.
  2. Reset the firewall to factory defaults
  3. Disable HA on all peers
  4. Delete the content database

Explanation

Before an upgrade, export the current configuration so it can be restored if needed and review release notes for known issues and required upgrade paths. A factory reset would destroy the production configuration, and deleting content or disabling HA is not a standard prerequisite.

Question 14Deployment and Installation

Which Panorama component is used to push security policy rules to managed firewalls?

  1. Template Stack
  2. Template
  3. Collector Group
  4. Device Group Correct answer.

Explanation

Device Groups hold policy rules and policy-related objects that are pushed to managed firewalls. Templates hold network and device settings, template stacks combine templates, and collector groups manage log collection. Policy is therefore delivered through device groups.

Question 15Deployment and Installation

Which mechanism allows a VM-Series firewall to receive its initial configuration from a USB drive or cloud storage at first boot?

  1. Bootstrap package Correct answer.
  2. Dynamic updates
  3. Panorama plugin
  4. Content delivery network

Explanation

A bootstrap package contains the initial configuration, licenses, software, and content that a VM-Series firewall can consume at first boot. It is commonly used for automated and scaled deployments. Dynamic updates deliver content, and Panorama plugins extend Panorama functionality but do not bootstrap a firewall.

Question 16Deployment and Installation

In a VMware NSX-T deployment, which component registers the VM-Series firewall as a service and redirects traffic to it?

  1. NSX Manager alone
  2. Panorama collector group
  3. Partner service manager Correct answer.
  4. vCenter standard switch

Explanation

NSX-T uses a partner service manager to register the VM-Series firewall as a service, and service insertion or service chains then redirect traffic to it. NSX Manager coordinates the environment, but registration of the partner service is handled through the partner service manager. vCenter switches and collector groups do not perform this role.

Question 17Deployment and Installation

Which item is required for Zero Touch Provisioning of a hardware firewall?

  1. A bootstrap configuration delivered over the network or from USB Correct answer.
  2. A direct console session for every device
  3. A manually entered license key at first boot
  4. A local admin password typed at the console

Explanation

Zero Touch Provisioning relies on a bootstrap configuration that the firewall can obtain automatically, such as through DHCP options, a USB drive, or a cloud service. Manual console access, password entry, and license typing defeat the purpose of zero touch. The bootstrap can include licensing and initial configuration.

Question 18Deployment and Installation

Which connection method is used to access a firewall that has no network connectivity and no configured management IP?

  1. Serial console Correct answer.
  2. Panorama commit
  3. HTTPS to the dataplane
  4. SSH to the loopback

Explanation

A serial console connection provides local access when the firewall has no reachable management address. It is commonly used for initial configuration, password recovery, and troubleshooting. SSH, HTTPS, and Panorama all require network connectivity to the device.

Question 19Deployment and Installation

Which action restores a firewall to its default configuration while leaving the installed PAN-OS version in place?

  1. Factory reset Correct answer.
  2. Rebooting into maintenance mode only
  3. Running a commit force
  4. Deleting the content database

Explanation

A factory reset returns the device configuration to factory defaults without reinstalling the PAN-OS software image. It is used when a clean configuration baseline is required. Deleting content, forcing a commit, or simply rebooting does not restore default configuration.

Question 20Deployment and Installation

Which two services should be configured so that the firewall has accurate time and can resolve update server names?

  1. SNMP and Syslog
  2. NTP and DNS Correct answer.
  3. LDAP and RADIUS
  4. DHCP and TFTP

Explanation

NTP keeps the firewall clock accurate for certificates, logs, and scheduling, while DNS resolves the names of update and licensing servers. SNMP, Syslog, DHCP, TFTP, LDAP, and RADIUS serve other purposes and do not provide both time synchronization and name resolution.

Question 21Deployment and Installation

A firewall in a restricted network cannot reach Palo Alto Networks update servers directly. Which configuration allows content updates through an internal proxy?

  1. Configure a proxy server for the device Correct answer.
  2. Build a virtual wire pair
  3. Enable an HA2 link
  4. Create a policy-based forwarding rule

Explanation

The firewall can be configured with an outbound proxy server so that update and licensing requests are sent through the proxy. Policy-based forwarding, virtual wire, and HA2 links affect traffic forwarding but do not provide proxy access to external update servers.

Question 22Deployment and Installation

Which setting controls when application and threat content is downloaded automatically?

  1. HA failover timer
  2. Config audit schedule
  3. Commit schedule
  4. Dynamic update schedule Correct answer.

Explanation

The dynamic update schedule defines when the firewall checks for and downloads content updates such as application signatures and threat definitions. Commit schedules and config audits relate to configuration management, while the HA failover timer controls HA behavior.

Question 23Deployment and Installation

In an active/passive HA pair, how should dynamic content updates be installed?

  1. Only on the passive peer
  2. Separately on each peer at different times
  3. On both peers so that they stay synchronized Correct answer.
  4. Only on the active peer

Explanation

Both HA peers must have matching dynamic content so that policy enforcement remains consistent after a failover. The update should be installed on both devices, following the supported HA update procedure. Installing on only one peer or at different times can create a content mismatch.

Question 24Deployment and Installation

Which interface type combines multiple physical interfaces into one logical link?

  1. Aggregate Ethernet Correct answer.
  2. VLAN
  3. Tunnel
  4. Loopback

Explanation

An Aggregate Ethernet interface bundles multiple physical interfaces into a single logical interface for increased bandwidth and redundancy. Loopback and tunnel interfaces are logical endpoints, and a VLAN interface is a Layer 3 construct associated with a VLAN.

Question 25Deployment and Installation

Which statement distinguishes Layer 2 mode from Virtual Wire mode?

  1. Layer 2 is passive only; Virtual Wire is inline only.
  2. Layer 2 ignores policy; Virtual Wire enforces policy.
  3. Layer 2 needs no zones; Virtual Wire needs two zones.
  4. Layer 2 switches by VLAN; Virtual Wire pairs two interfaces. Correct answer.

Explanation

Layer 2 mode performs VLAN-based switching between multiple interfaces, while Virtual Wire mode transparently forwards traffic between a paired set of interfaces. Both are inline modes that can enforce security policy and require zone assignments. Neither mode is passive.

Question 26Deployment and Installation

Which Panorama object is used to push interface, zone, and virtual router settings to managed firewalls?

  1. Device group
  2. Collector group
  3. Template Correct answer.
  4. Log forwarding profile

Explanation

Panorama separates policy from device and network configuration. Templates carry the device and network settings, such as interfaces, zones, virtual routers, and administrative settings, and are applied to firewalls when configuration is pushed. Policy rules are handled by a separate object type.

Question 27Deployment and Installation

Which interface type delivers a copy of traffic for analysis without the firewall dropping or forwarding the original packets?

  1. Virtual wire
  2. Layer 2
  3. Layer 3
  4. Tap Correct answer.

Explanation

A tap interface is a passive monitoring mode in which the firewall receives a copy of the traffic from a switch SPAN or mirror port and inspects it without participating in the forwarding path. Because the firewall is not inline, it cannot block the monitored sessions.

Question 28Deployment and Installation

A firewall with no path to the internet must be licensed. Which method activates the license?

  1. Point the firewall to an internal DNS server and retry activation
  2. Copy the license from an already licensed firewall's configuration
  3. Install a license file obtained from the support portal Correct answer.
  4. Enter the auth code on the firewall and let it activate offline

Explanation

When a firewall cannot reach the licensing servers, the license is activated outside the firewall. The license file downloaded from the support portal is installed on the firewall through the web interface or CLI, which activates the subscription without internet access.

Question 29Deployment and Installation

Which HA feature triggers a failover when a monitored destination upstream of the firewall stops responding?

  1. Path monitoring Correct answer.
  2. Session owner election
  3. HA1 heartbeat
  4. Link monitoring

Explanation

Path monitoring sends probes to configured IP destinations and fails over when those destinations become unreachable, which detects failures beyond the firewall's own interfaces. Link monitoring instead watches the physical link state of individual interfaces.

Question 30Deployment and Installation

An administrator edits a device group policy on Panorama. Which sequence makes the change take effect on the managed firewalls?

  1. Push to devices first, then commit to Panorama
  2. Commit to Panorama, then push to devices Correct answer.
  3. Run a local commit on each managed firewall only
  4. Commit to Panorama only, because changes propagate automatically

Explanation

Panorama changes stay in a candidate configuration until they are committed to Panorama, which saves them into the Panorama configuration. A separate push then delivers the committed configuration to the selected firewalls, so both steps are required.

Question 31Deployment and Installation

Which credential is needed on a firewall to register it with Panorama for the first time?

  1. A device certificate signed by Panorama
  2. An API key exported from the support portal
  3. The Panorama administrator account password
  4. A one-time auth key defined on Panorama Correct answer.

Explanation

Registration uses a one-time authentication key that is created on Panorama and entered on the firewall together with the Panorama IP address. Once the connection is established, the firewall appears in Panorama's managed devices list, and the key expires after use.

Question 32Deployment and Installation

A single physical link carries traffic for three VLANs that the firewall must route between. What should be configured?

  1. Three virtual wire interfaces bound to the physical link
  2. A Layer 3 subinterface for each VLAN Correct answer.
  3. An aggregate interface group with three member links
  4. One tap interface with three security zones

Explanation

Layer 3 subinterfaces each carry an 802.1Q VLAN tag on the same physical interface and hold their own IP address, which allows the firewall to route between the tagged networks. Each subinterface is then placed in the appropriate zone and referenced by policy.

Question 33Deployment and Installation

One template must be reused across firewalls that have different management IP addresses. Which Panorama feature supports this?

  1. Shared policy objects
  2. Template variables Correct answer.
  3. Device group hierarchy
  4. Collector group overrides

Explanation

Template variables are placeholders in a template whose values are set per firewall, so a single template can serve devices that differ in addresses or other site-specific values. When the configuration is pushed, each firewall substitutes its own values.

Question 34Deployment and Installation

Which Panorama component determines which log collectors store logs forwarded from managed firewalls?

  1. Template stack
  2. Device group
  3. Collector group Correct answer.
  4. Log forwarding profile

Explanation

A collector group is a set of log collectors that Panorama uses to store logs received from managed firewalls, and it can include more than one collector for redundancy. The firewall side only decides which logs to send and to which Panorama address.

Question 35Policy Configuration and Management

When a next-generation firewall evaluates a security policy from top to bottom, what happens after a packet matches a rule?

  1. Evaluation continues so later rules can add actions.
  2. The rule's action is applied and evaluation stops. Correct answer.
  3. The packet is logged and then re-evaluated from the top.
  4. Only rules with logging enabled are considered.

Explanation

Security policies are evaluated in order and stop at the first match. The matched rule's action determines the fate of the session, and later rules are not consulted for that traffic.

Question 36Policy Configuration and Management

Traffic that does not match any explicitly configured security rule is subject to which default behavior on most NGFW platforms?

  1. It is denied by an implicit default rule. Correct answer.
  2. It is allowed but never logged.
  3. It is queued for administrator approval.
  4. It is allowed if it stays within a single zone.

Explanation

Most NGFW platforms place an implicit deny rule at the bottom of the policy. Any session that matches no explicit rule is dropped, and logging of that drop may be configurable.

Question 37Policy Configuration and Management

In security policy, what is the primary purpose of a zone?

  1. To group interfaces of similar trust for policy enforcement. Correct answer.
  2. To assign a physical interface to a VLAN trunk.
  3. To define the encryption algorithm for IPsec tunnels.
  4. To specify DNS servers used for application identification.

Explanation

A zone represents a logical boundary of trust, such as internal, DMZ, or internet. Security rules use source and destination zones to determine whether traffic is permitted between those boundaries.

Question 38Policy Configuration and Management

Why should administrators use address objects instead of literal IP addresses in security rules?

  1. Editing the object updates every rule that uses it. Correct answer.
  2. Address objects automatically translate addresses for NAT.
  3. Address objects reduce the number of rules required to deny traffic.
  4. Literal addresses are not permitted in most policy editors.

Explanation

Address objects centralize the definition of a host or network. When the object is updated, every security rule that references it inherits the change, reducing inconsistency and administrative effort.

Question 39Policy Configuration and Management

Which security rule action permits matching traffic to continue to its destination, subject to any attached security profiles?

  1. Allow Correct answer.
  2. Drop
  3. Reset client
  4. Deny

Explanation

The allow action permits the session and allows attached security profiles to inspect the permitted traffic. Deny and drop actions block the session, while a reset action terminates it with a TCP reset.

Question 40Policy Configuration and Management

How does application identification differ from traditional port-based filtering?

  1. It identifies applications by behavior rather than by port. Correct answer.
  2. It removes the need for security policy rules.
  3. It requires every application to use its registered port.
  4. It relies only on the destination port in the TCP header.

Explanation

Application identification inspects traffic characteristics and protocol behavior to determine the application. This lets policy identify applications even when they use non-standard ports or hop between ports.

Question 41Policy Configuration and Management

Which policy translates a private source address to a public address for outbound internet access?

  1. Decryption policy
  2. Policy-based routing
  3. Destination NAT
  4. Source NAT Correct answer.

Explanation

Source NAT rewrites the source address of outbound sessions, typically to a public address, so returning traffic can be mapped back to the internal host. Destination NAT instead rewrites the destination address of inbound sessions.

Question 42Policy Configuration and Management

Where are security profiles such as antivirus and anti-spyware typically attached in a security policy?

  1. To the default deny rule
  2. To the zone definition
  3. To an allow rule Correct answer.
  4. To the NAT rule

Explanation

Security profiles inspect traffic that is permitted by a security rule, so they are attached to allow rules. Denied sessions are blocked before content inspection profiles can act on them.

Question 43Policy Configuration and Management

Rule A allows any application from the Trust zone to the Untrust zone. Rule B, placed directly below Rule A, denies a specific business application from Trust to Untrust. What is the effect of this configuration?

  1. Rule B takes precedence because deny rules are evaluated first.
  2. Both rules match and the deny action overrides the allow.
  3. Rule B is shadowed and never matches. Correct answer.
  4. Rule B applies only to sessions that were already established.

Explanation

Security policy is first-match, so the broader allow rule is hit before the specific deny is reached. To make the deny effective, it must be placed above the broad allow rule or the allow rule must be narrowed.

Question 44Policy Configuration and Management

A rule allows traffic from the Untrust zone to a server and uses a negated source of 10.0.0.0/8. What is the practical effect of the negation?

  1. All sources outside 10.0.0.0/8 match. Correct answer.
  2. The firewall resolves the negation to the server's subnet.
  3. The rule is invalid because source negation is unsupported.
  4. Only hosts in 10.0.0.0/8 can reach the server.

Explanation

Negation inverts the match: the rule matches every address except those listed. This often broadens scope more than intended, so negated rules should be reviewed carefully.

Question 45Policy Configuration and Management

An application is configured in a rule with the service set to application-default, but the server listens on a non-standard port. What is the likely result?

  1. The firewall rewrites the packet to the default port.
  2. The firewall automatically adds the port to the application definition.
  3. The rule may not match because the port is not in the default service. Correct answer.
  4. The application is detected but the rule never matches.

Explanation

The application-default service restricts matching to the ports the application normally uses. If the server uses a non-standard port, the rule must be adjusted, such as with an explicit service or a broader service setting, to match correctly.

Question 46Policy Configuration and Management

To enforce a rule that allows only members of the Finance group, what must be working before the rule can match correctly?

  1. A URL filtering profile must be attached to the rule.
  2. A decryption policy must be enabled for all Finance traffic.
  3. User-ID must map source IPs to users and groups. Correct answer.
  4. The Finance group must be defined as an address object.

Explanation

Group-based rules depend on identity mapping, which associates a source IP address with the currently logged-in user. Without that mapping, the firewall cannot determine that the session belongs to the Finance group.

Question 47Policy Configuration and Management

For HTTPS traffic, what is required for URL filtering to inspect the full path and categorize content reliably?

  1. SSL/TLS decryption of the session Correct answer.
  2. Disabling application identification
  3. Using the destination port as the only match criterion
  4. Configuring the rule with a schedule

Explanation

HTTPS encrypts the request path and content, so the firewall must decrypt the session to see the full URL. Without decryption, URL filtering is limited to metadata such as the domain name.

Question 48Policy Configuration and Management

Why is attaching an antivirus profile to a deny rule of little practical value?

  1. Deny rules are evaluated after all allow rules.
  2. The session is blocked before content inspection can occur. Correct answer.
  3. Antivirus profiles apply only to encrypted traffic.
  4. Deny rules cannot reference security profiles in any product.

Explanation

Content inspection profiles act on sessions that are permitted by the security rule. A deny rule stops the session at policy enforcement, so the antivirus profile has no permitted traffic to scan.

Question 49Policy Configuration and Management

An administrator reviews a rule that has shown zero hit counts for over a year but permits traffic for a year-end financial close. What is the most appropriate action?

  1. Validate with the business owner before removal; traffic may be seasonal. Correct answer.
  2. Disable logging to reduce noise and keep the rule.
  3. Move the rule to the bottom of the policy to improve performance.
  4. Delete the rule immediately because zero hits prove it is unused.

Explanation

Zero hit counts are a useful signal but not proof that a rule is unnecessary. Seasonal or rarely used business traffic can require a rule that shows no hits during the review period, so validation should precede removal.

Question 50Policy Configuration and Management

In a hierarchical policy model with parent and child policy scopes, how are parent rules generally evaluated relative to child rules?

  1. Parent rules are evaluated before child rules in the overall rule order. Correct answer.
  2. Child rules are evaluated first and parent rules only if no child rule matches.
  3. Parent and child rules are merged and sorted alphabetically.
  4. Parent rules are ignored when a child policy exists.

Explanation

Hierarchical policy models typically evaluate inherited parent rules before local child rules, with optional post-rules after them. This allows an organization to enforce baseline policy above local additions.