NGFW-Engineer Practice Test

NGFW-Engineer Practice Test practice questions, page 4 of 6, with answer review and explanations.

Question 16

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

  1. Flood Protection
  2. Protocol Protection
  3. Packet-Based Attack Protection
  4. Reconnaissance Protection

Question 17

For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

  1. Use of dynamic routing protocols
  2. Tunnel monitoring
  3. Use of peer IP
  4. Redistribution of User-ID

Question 18

Which PAN-OS method of mapping users to IP addresses is the most reliable?

  1. Port mapping
  2. GlobalProtect
  3. Syslog
  4. Server monitoring

Question 19

In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

  1. To forward packets to the HA peer during session setup and asymmetric traffic flow
  2. To exchange hellos, heartbeats, HA state information, and management plane synchronization for routing and User-ID information
  3. To synchronize sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in an HA pair
  4. To perform session cache synchronization among all HA peers having the same cluster ID

Question 20

A PA-Series firewall with all licensable features is being installed. The customer’s Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions. Which action meets the requirements in this scenario?

  1. Deploy the transparent proxy with Web Cache Communications Protocol (WCCP).
  2. Deploy the Next-Generation Firewalls as normal and install the User-ID agent.
  3. Deploy the Advanced URL Filtering license and captive portal.
  4. Deploy the explicit proxy with Kerberos authentication scheme.