Free NGFW-Engineer Practice Test Questions and Answers (2026)

Palo Alto Networks’ content-update best-practice guide states that in mission-critical networks you should schedule the firewall to install an Applications-and-Threats dynamic-update only after the package has been available for at least eight (8) hours.

The eight-hour threshold balances operational safety—giving the vendor time to withdraw a faulty release—against the need to keep signatures current for high-value production environments.

B. 16 hours – Longer than the recommended 8-hour delay, needlessly postponing protection in a mission-critical environment.

C. 32 hours – Excessive delay; guideline for less-critical or staging networks, not mission-critical.

D. 48 hours – Conservative setting used for test or highly risk-averse networks, not the mission-critical best-practice value.

1. Palo Alto Networks TechDocs

“Best Practices for Applications and Threats Content Updates

” Table ‘Deployment Recommendations’

row “Mission-Critical – Install after: 8 hours”; doc version 10.2

para. 3. (https://docs.paloaltonetworks.com/)

2. Palo Alto Networks PAN-OS Administrator’s Guide 10.2

Device > Dynamic Updates > Schedule Content Updates

example schedule for mission-critical networks (“set Threshold to 8 hours”); Section “Configure Content Update Schedules

” step 6.

3. Palo Alto Networks LIVEcommunity Article “Content Release Deployment and Best Practices” (rev. May 2023)

Recommendation #2: “Mission-critical production—Install if update is older than 8 hours.”

In cloud service provider (CSP) environments, the standard and recommended method for achieving high availability (HA) across multiple availability zones (AZs) is to use a native cloud load balancer. The load balancer distributes traffic to multiple Palo Alto Networks NGFW instances, each located in a different AZ. It uses health probes to continuously monitor the status of each firewall. If a firewall instance or an entire AZ fails, the health probe detects the failure, and the load balancer automatically stops sending traffic to the unhealthy instance, redirecting it to the remaining healthy firewalls in other AZs. This architecture provides seamless failover and resilience.

A. Deploying Ansible scripts for zone-specific scaling: Ansible is an automation tool used for configuration and deployment, not the architectural mechanism that provides high availability and failover.

B. Implementing Terraform templates for redundancy within one availability zone: This option is incorrect because the question explicitly requires a solution for HA across multiple availability zones, not within a single one.

D. Configuring active/active HA: Traditional Palo Alto Networks active/active HA relies on Layer 2 connectivity for state synchronization, which is not available across different cloud availability zones. Cloud HA architectures depend on load balancers.

1. Palo Alto Networks - VM-Series on AWS Reference Architecture Guide: "To provide high availability for the VM-Series firewalls

you deploy an active/active pair of firewalls that are fronted by an Elastic Load Balancer (ELB). The ELB distributes traffic between the firewalls and provides health checks to ensure that traffic is only sent to a healthy firewall." (Section: Security VPC with an Internet Gateway

subsection: High Availability)

2. Palo Alto Networks - VM-Series on Azure Deployment Guide: "For high availability and resiliency

you can deploy the VM-Series firewalls in an active/active configuration across multiple availability zones. The Azure Load Balancer distributes sessions between the firewalls and uses health probes to detect firewall failure." (Chapter: VM-Series Firewall for Azure Reference Architecture

Section: High Availability for the VM-Series Firewall on Azure)

3. Palo Alto Networks - High Availability for VM-Series Firewall on AWS: "The VM-Series firewall on AWS supports high availability (HA) between instances deployed in different Availability Zones (AZs). This solution uses AWS services such as Elastic Load Balancing (ELB)

Lambda

and S3 to provide a resilient firewall solution." (Document ID: 86453

Section: Overview)

To allow both SAML and RADIUS administrator authentication to function concurrently, a PAN-OS feature called an Authentication Sequence must be used. This involves two primary actions:

1. Creating the new authentication components for SAML. This requires creating a SAML Identity Provider Server Profile and then creating an Authentication Profile that uses, or "applies," this server profile to it.

2. Creating an Authentication Sequence that lists both the new SAML Authentication Profile and the existing RADIUS Authentication Profile.

This sequence allows the firewall to try authenticating an administrator against one profile (e.g., SAML) and, if that fails or is unavailable, try the next profile in the sequence (e.g., RADIUS). This configuration is then applied to the firewall's administrator authentication settings.

A. Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.

This is factually incorrect. The Authentication Sequence feature in PAN-OS is specifically designed to allow multiple authentication profiles to be used in tandem.

D. Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.

This describes a technically impossible action. An Authentication Profile can only reference one Server Profile or one Authentication Sequence; you cannot add a Server Profile to another.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Configure an Authentication Sequence". Device > Authentication Sequence. This section states

"An authentication sequence allows you to try multiple authentication profiles in a specific order... For example

you can create an authentication sequence that first attempts to authenticate users against a Kerberos server. If the Kerberos server is unreachable

the firewall then attempts to authenticate users against an LDAP server

and so on." This directly supports the use of a sequence for the RADIUS and SAML profiles.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Configure an Authentication Profile and Sequence". Device > Authentication Profile. This guide details the process: "Create an Authentication profile for each authentication service that you plan to use... Create an Authentication Sequence that includes the Authentication profiles you created... Apply the Authentication Sequence to a firewall service." This confirms that creating the SAML authentication profile (Option C) and the sequence (Option B) are the correct

distinct actions.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Configure SAML Authentication". Device > Server Profiles > SAML Identity Provider. This section outlines the creation of the SAML IdP Server Profile

which is then selected within an Authentication Profile

confirming the action described in Option C.

Palo Alto Networks firewalls enforce security policies based on traffic moving between security zones. For an IPSec tunnel, two distinct types of traffic must be considered: the control plane traffic (IKE, ESP) that builds the tunnel, and the data plane traffic that passes through it.

The data plane traffic, which is the user data being protected, typically travels between an internal zone (e.g., trust) and the zone containing the tunnel interface (e.g., a dedicated vpn zone or the untrust zone). Because this traffic crosses zones, it is subject to the interzone-default security rule, which has a default action of deny. Therefore, explicit security rules must be created to allow this traffic. To permit sessions to be initiated from both sides of the tunnel, separate, directional rules are required.

A. A single security rule is directional and only allows traffic initiation from the specified source zone to the destination zone. A second rule is required for return-initiated traffic.

B. The firewall's control plane implicitly allows IKE and ESP packets destined for the firewall itself to establish the tunnel; they are not processed against the intrazone-default allow policy for this purpose.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Security Policy

" Page 1031. The guide describes the two default security rules: intrazone-default (allow) and interzone-default (deny). This supports the principle that traffic between zones

such as from a trust zone to a vpn zone

is denied by default

which is the concept behind option D.

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"Define Security Policy for the IPSec Tunnel

" Page 588. This section explicitly states

"To allow traffic to flow through the VPN tunnel

you must configure a security policy rule." The examples provided consistently show separate rules for allowing traffic in each direction (e.g.

from LAN to VPN

and from VPN to LAN)

which directly supports option C.

3. Palo Alto Networks PAN-OS® Administrator's Guide 10.2

"How Does the Firewall Process IPSec Packets?

" Page 554. This section clarifies

"The firewall allows IKE and IPSec traffic to and from the interfaces that are configured as IPSec tunnel endpoints; you do not need to create Security policy rules to allow this traffic." This directly refutes the premise of option B.

Enabling split tunneling with the “Both Network Traffic and DNS” option in a GlobalProtect configuration allows for precise control over DNS resolution. This feature, often referred to as DNS-based split tunneling, directs the GlobalProtect agent to intercept all DNS queries on the endpoint. If a query matches a domain specified in the split-tunnel include list, the agent forwards it to the corporate DNS servers assigned by the VPN gateway. All other DNS queries for domains not on the list are forwarded to the endpoint's locally configured DNS servers. This ensures that internal corporate resources are resolved correctly by internal servers, while general internet traffic is resolved locally, optimizing performance and reducing load on the corporate network.

A. This is incorrect. The feature is not about primary versus secondary DNS server logic for redundancy, but about routing DNS queries to either the VPN's DNS or the local DNS based on the domain name.

B. This describes a use case known as split-brain DNS, which this feature can facilitate. However, the direct function of the setting is to control the DNS resolution path, not to manage FQDN-to-IP mappings based on location.

C. This misrepresents the feature's purpose. While it could potentially be misused to bypass local DNS filtering, its intended function is to correctly route corporate versus public traffic, not to circumvent security policies.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"GlobalProtect > Configure Split Tunneling for the GlobalProtect Apps".

In the section "Split Tunneling Based on the Domain and Application

" the documentation states: "When you configure split tunneling based on domain

the GlobalProtect app on the endpoint intercepts all DNS requests. The app then compares the domain in the request to the domains in the split tunnel include list. If the domain in the request matches a domain in the include list

the app forwards the request to the private DNS server for resolution. If the domain in the request does not match a domain in the include list

the app forwards the request to the public DNS server for resolution." This directly supports the mechanism described in answer D.

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0

"GlobalProtect > Configure Split Tunneling for the GlobalProtect Apps".

The section "DNS-Based Split Tunneling" explains: "To ensure that the app can resolve the IP addresses of the applications that you want to access through the tunnel

you must also configure the app to direct DNS queries for the specified domains to the private DNS server." This confirms that the configuration is about specifying which domains are resolved by which set of DNS servers (VPN-assigned vs. local).

To programmatically create or configure SD-WAN interfaces, the application must use the Palo Alto Networks REST API. The specific API endpoint for this task targets the firewall device directly. The object type used to manage these configurations is SDWANInterfaces. An API call, such as a POST request to the /restapi/v11.0/Objects/SDWANInterfaces endpoint on the firewall, allows the application to define the properties for an interface to be part of the SD-WAN fabric. This aligns with the requirement for the application to make changes directly to the devices.

A. The sdwanInterfaceprofiles object is used to configure SD-WAN Interface Profiles on Panorama, which are templates for settings, not the actual interface configuration on a specific firewall.

C. The XML API XPath sdwanprofiles/interfaces is not a valid configuration path. SD-WAN configuration is managed under a different node in the XML structure on Panorama or the firewall.

D. The XML API XPath InterfaceProfiles/sdwan is an invalid path. Interface Profiles and SD-WAN settings are configured under separate, distinct hierarchies within the PAN-OS XML configuration tree.

---

1. Palo Alto Networks PAN-OS 11.0 REST API Reference Guide:

Reference: The guide details the API structure for configuration objects. The SDWANInterfaces object is specifically for configuring SD-WAN interfaces on a firewall.

Location: In the API reference

navigate to Configuration APIs > Objects > SDWANInterfaces. The documentation shows the endpoint is .../Objects/SDWANInterfaces and it is configured on a firewall

identified by its vsys. This directly supports option B.

Source: Palo Alto Networks. (2023). PAN-OS 11.0 REST API Reference. Retrieved from the Palo Alto Networks Technical Documentation portal.

2. Palo Alto Networks PAN-OS 11.0 XML API Reference Guide:

Reference: This guide provides the complete XML configuration tree (schema) for PAN-OS devices. Reviewing the schema confirms that the XPaths mentioned in options C and D are invalid.

Location: The correct XPath to configure SD-WAN settings on an existing Ethernet interface is /config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='']/sdwan-link-settings. This demonstrates the incorrectness of the paths in options C and D.

Source: Palo Alto Networks. (2023). PAN-OS 11.0 XML API Reference Guide. Retrieved from the Palo Alto Networks Technical Documentation portal.

The Palo Alto Networks AI Runtime Security solution, a component of Prisma Cloud, operates in a distinct lifecycle. The process begins with the Discovery phase, where the system automatically identifies all running workloads across the environment. This is followed by the Deployment of enforcers (Defenders) to these workloads to gain visibility and control. Once deployed, the system enters the Detection phase, using machine learning and behavioral analysis to monitor for threats and anomalies. The final phase is Prevention, where the solution actively blocks identified attacks in real-time, protecting applications from exploits, malware, and other runtime threats.

A. Scanning, Isolation, Whitelisting, Logging: These are specific security functions or features, not the overarching operational phases of the entire AI Runtime Security solution's lifecycle.

C. Policy Generation, Discovery, Enforcement, Logging: This option omits the critical initial deployment phase and conflates the distinct detection and prevention stages into a single "enforcement" step.

D. Profiling, Policy Generation, Enforcement, Reporting: While profiling is part of discovery and enforcement is a key outcome, this option misses the explicit deployment and detection phases that define the solution's workflow.

1. Palo Alto Networks. (2023). Prisma® Cloud AI Runtime Security Solution Brief. "Prisma Cloud AI Runtime Security provides comprehensive protection for your cloud native applications... It starts with discovery of all your running workloads... Deploy enforcers... Detect threats... Prevent attacks..." (Page 2).

2. Palo Alto Networks. (2024). Prisma Cloud Administrator's Guide (Compute). The guide's structure for implementing runtime defense follows this model: Deploying Defenders (Deployment)

viewing runtime data (Discovery)

creating runtime rules (Detection)

and setting the rule effect to "Prevent" or "Block" (Prevention). (Sections: "Deploy Defenders"

"Runtime security").

On a firewall managed by Panorama, the Security policy rulebase is a composite of rules pushed from Panorama and rules configured locally on the firewall. The firewall's policy engine evaluates these rules in a specific, non-configurable order. Panorama pre-rules are always evaluated first. If no match is found, the firewall proceeds to evaluate its local rules. If there is still no match, it then evaluates the Panorama post-rules. This hierarchical structure allows central administrators to enforce universal security policies (pre-rules) and default cleanup policies (post-rules) while still permitting local administrators to create device-specific rules in between.

A. Firewall policy evaluation stops on the first rule that matches the session's traffic. If a local rule matches, subsequent rules, including any post-rules, are not processed for that session.

C. The order of evaluation (Pre-rules -> Local rules -> Post-rules) is a fixed architectural principle of the PAN-OS and Panorama integration. It cannot be altered for troubleshooting or any other reason.

D. While device groups determine which policies are pushed to a firewall, they do not alter the fundamental, built-in logic of how the firewall evaluates the pre-rule, local, and post-rule sections.

1. Palo Alto Networks Panorama Administrator's Guide 10.2: In the section "Policies

" under "Policy Rulebase

" the documentation states

"When you push policies from Panorama to a managed firewall

the firewall evaluates the rules in the following order: Pre-rules

Local firewall rules

Post-rules... The firewall evaluates rules in order and the first rule that matches the traffic is applied." (Reference: Policies > Policy Rulebase section).

2. Palo Alto Networks Panorama Administrator's Guide 11.0: The section "Manage Policies Using Device Groups" explicitly details the rule hierarchy. It explains

"Pre-rules are added before the local firewall rules and post-rules are added after. This allows you to create a policy structure where some rules are always processed before others." (Reference: Device Groups > Manage Policies Using Device Groups).

3. Palo Alto Networks

"Day in the Life of a Packet

" White Paper: This document describes the packet flow logic within the firewall. It confirms that policy lookup is a sequential

top-down process. Once a matching security policy rule is found

the defined action is taken

and the policy lookup for that session concludes

reinforcing that post-rules would not be checked after a local rule match. (Reference: Section on "Policy Lookup").

An SSL/TLS Service Profile on a Palo Alto Networks NGFW is used to configure the server certificate and protocol settings for services where the firewall acts as an SSL/TLS server. This profile is essential for securing management and access services by authenticating the firewall to the connecting client and encrypting the session. The two most prominent services that utilize SSL/TLS Service Profiles are the GlobalProtect Portal, which provides client configurations, and the GlobalProtect Gateway, which terminates the secure VPN tunnels from clients. Both require a configured profile to establish a trusted and encrypted connection.

A. NAT tables: These are networking constructs for translating IP addresses and ports; they are not services or connections secured by SSL/TLS profiles.

B. User Authentication: This is a broad process. While services that perform user authentication (like Captive Portal) use these profiles, GlobalProtect Portal and Gateway are specific, configurable services that directly apply them.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section on security profiles

it states

"An SSL/TLS service profile specifies a server certificate and the SSL/TLS protocol versions that a firewall interface will support when it functions as an SSL/TLS server to secure services such as the GlobalProtect portal

GlobalProtect gateways

Captive Portal

and Prisma Access."

Reference: Palo Alto Networks. (2023). PAN-OS® Administrator's Guide Version 10.2. Objects > Security Profiles > SSL/TLS Service Profile.

2. Palo Alto Networks TechDocs - Configure an SSL/TLS Service Profile: This official documentation page explicitly lists the services that use these profiles. The primary examples provided are for securing firewall management interfaces and remote access solutions.

Reference: Palo Alto Networks TechDocs. (n.d.). Configure an SSL/TLS Service Profile. Retrieved from docs.paloaltonetworks.com. The document states

"You can attach an SSL/TLS service profile to any firewall service that requires a server certificate..." and provides examples including "GlobalProtect portal" and "GlobalProtect gateways".

3. Palo Alto Networks TechDocs - Set Up the GlobalProtect Infrastructure: The configuration steps for both the portal and the gateway explicitly require the administrator to select a pre-configured SSL/TLS Service Profile to assign a server certificate for the service.

Reference: Palo Alto Networks TechDocs. (n.d.). Set Up the GlobalProtect Infrastructure in the Web Interface. Retrieved from docs.paloaltonetworks.com. See steps under "Configure the GlobalProtect Portal" and "Configure a GlobalProtect Gateway

" which both include selecting an SSL/TLS Service Profile.

The Advanced Routing Engine is a licensed feature in PAN-OS 10.2/11.x. PAN-OS does not expose the “Enable Advanced Routing Engine” option on any logical (virtual) router until an Advanced Routing Engine license is present and activated. Therefore the very first prerequisite to configuring a logical router that will run ARE is to enable (install + activate) the corresponding license on the firewall.

B. Plugin – No ARE plug-in exists; ARE is built into PAN-OS once licensed.

C. Content update – Dynamic content updates do not influence the availability of routing-engine features.

D. General setting – The General tab of the logical router appears only after the ARE license is active; it cannot be configured first.

1. Palo Alto Networks

“PAN-OS 11.0 Administrator’s Guide – Networking > Advanced Routing Engine > Enable the Advanced Routing Engine

” Step 1: “Verify that the Advanced Routing Engine license is activated on the firewall.” (docs.paloaltonetworks.com

Admin Guide

11.0

section link)

2. Palo Alto Networks Knowledge Base

“Activate the Advanced Routing Engine License

” paragraphs 1–3 (KB 002004413

2023-02-15).

3. Palo Alto Networks

“PAN-OS 10.2 New Features Guide – Advanced Routing Engine

” Requirements subsection: “Requires an Advanced Routing Engine license for platforms other than PA-3400

PA-5400

PA-5450

and VM-Series-DPDK.”