Online Access Free NGFW-Engineer Practice Test

When deploying Palo Alto Networks NGFWs in a cloud service provider (CSP) environment, which method ensures high availability (HA) across multiple availability zones?

• A.Configuring active/active HA
• B.Deploying Ansible scripts for zone-specific scaling
• C.Implementing Terraform templates for redundancy within one availability zone
• D.Using load balancer and health probes

An engineer is required to configure a site-to-site VPN that will automatically fail over to a backup link if the primary tunnel goes down. The engineer also needs to exchange routes dynamically between the sites.
Which two features necessitate assigning an IP address to the tunnel interface? (Choose two.)

• A.Proxy ID configuration
• B.Tunnel monitoring
• C.IKEv2 protocol support
• D.Dynamic routing

Which interface types should be used to configure link monitoring for a high availability (HA) deployment on a Palo Alto Networks NGFW?

• A.Tap, Virtual Wire, and Layer 3
• B.Virtual Wire, Layer 2, and Layer 3
• C.HA, Virtual Wire, and Layer 2
• D.HA, Layer 2, and Layer 3

An engineer is implementing a new rollout of SAML for administrator authentication across a company's Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML.
Which two actions meet the criteria? (Choose two.)

• A.Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
• B.Create and add the "SAML Identity Provider" Server Profile to the authentication profile for the
  "RADIUS" Server Profile.
• C.Create an authentication sequence that includes both the "RADIUS" Server Profile and "SAML Identity Provider" Server Profile to run the two services in tandem.
• D.Create and apply an authentication profile with the "SAML Identity Provider" Server Profile.

A network security engineer wants to create Security policy rules that allow or deny traffic based on a user's department, which corresponds to groups in the company's Active Directory. To achieve this, the firewall needs to retrieve group information from the directory server.
Which configuration object must be created first to establish the connection with the Active Directory server?

• A.Kerberos server profile
• B.User-ID agent service account
• C.Authentication sequence
• D.LDAP server profile