NGFW Engineer study plan

Map every physical interface to a zone and security segment on paper before touching the device, and justify each mapping in writing

Perform a clean install of the firewall image in a lab VM, complete initial bootstrapping, and bring management access online over an out-of-band address

Configure baseline services (admin authentication, NTP, DNS, syslog target, time zone, banner) and prove each one works with a verification command or capture

Export a full configuration backup, wipe the device, and restore from that backup to confirm recoverability

Draft a rollback decision tree covering failed upgrade, failed restore, and lost management access

Author a zone-based rule base that ends in an explicit default-deny and annotate the ordering rationale for every rule

Configure source NAT and destination NAT for an internal-to-internet and an inbound-published service, then verify each with a packet trace and a session table entry

Enable application identification and URL filtering on one egress rule, then confirm a blocked and an allowed category both behave as intended

Diagnose three intentionally misordered or shadowed rules using hit counters and rule-order trace output

Write the change-control checklist you would follow before pushing any rule modification to production

Build a three-router lab topology and bring up a dynamic routing adjacency across the firewall with a verified neighbor state

Configure static routes, policy-based forwarding, and multiple virtual routers, and document which traffic uses which table

Reproduce an asymmetric-routing failure and resolve it using route selection or return-path configuration

Test route and NAT interaction by changing an egress interface and confirming existing sessions behave as predicted

Measure reconvergence time after a link failure and record the observed value

Bring up a site-to-site IPsec tunnel using IKEv2 with pre-shared key authentication and confirm both phases reach an established state

Repeat the tunnel using certificate-based authentication and document the exact differences in configuration steps

Reproduce a phase-1 and a phase-2 negotiation failure on purpose and identify each from debug or log output alone

Configure a remote-access VPN profile with an address pool and split tunneling, then connect a client and verify traffic paths

Build a mismatch matrix listing proposal, proxy-ID, and identity errors against their log signatures and fixes

Deploy a two-node high-availability pair in active/passive mode with dedicated control and data-sync links and confirm synchronized state

Configure interface and link monitoring so a failed uplink triggers failover, then force that failure and time the switchover

Verify session synchronization by holding a long-lived connection open across a forced failover and documenting whether it survived

Test preemption behavior and state the exact conditions under which the secondary reclaims the active role

Evaluate active/active versus active/passive for a given topology and defend your recommendation in writing

Configure log forwarding to an external collector and confirm receipt of traffic, threat, and system logs

Build a custom dashboard that surfaces top denied applications, top source addresses, and interface health in one view

Schedule a recurring report and verify it generates and delivers with the expected content

Create three alert rules with thresholds and confirm each fires during a simulated event

Write a triage runbook that maps five distinct log signatures to a first response action

Rebuild the entire lab from scratch using only your week-1 runbook, timed, and log every step where the runbook was insufficient

Re-audit the rule base against the default-deny baseline and remove or reorder every rule that no longer earns its place

Re-run the routing failover and NAT tests to confirm they still pass after the rebuild

Complete a 60-question mixed timed quiz across the three domains and itemize every miss by root cause

Sit two full-length timed mock exams under exam conditions with no notes or breaks

Cluster every incorrect answer by domain and by failure mode (knowledge gap, misread, or guess)

Re-study only the two weakest domains and re-test each with a focused set of at least 40 questions

Recite from memory the failover sequence, the IPsec negotiation phases, and the deployment rollback tree without reference material

Finalize a one-page personal weakness sheet to review in the 24 hours before the exam