Palo Alto Networks Certified Next-Generation Firewall Engineer Free Sample Questions

In an active/active HA configuration, session synchronization is enabled globally. To selectively exclude certain sessions from being synchronized, you create a security policy rule that matches the specific traffic (in this case, general internet browsing) and select the 'Do not sync session' option within that rule's action settings. This provides granular control over HA resource utilization while ensuring critical application sessions are fully synchronized. Denying the traffic is incorrect, and session sync cannot be configured per-application or with different settings in multiple rules.

When configuring objects on a firewall managed by Panorama, the configuration is typically pushed via Device Groups. The '/config/shared/' XPath is used to target the shared scope within Panorama, from which objects can be referenced by device groups. The other XPaths refer to a local firewall configuration ('localhost.localdomain'), a specific device group, or a non-existent path.

An SSL/TLS Service Profile is used to define the specific SSL/TLS protocol versions and cipher suites that the firewall will use for services it hosts, such as the management web UI. By creating a profile that only permits TLSv1.3 and applying it to the management interface, all other protocol versions will be rejected. Decryption profiles are for inspecting traffic, a Certificate Profile is for client certificate validation, and an Interface Mgmt profile enables services but does not control the TLS version.

A Virtual Wire interface pair connects two physical interfaces on the firewall, allowing traffic to pass between them transparently. It does not have an IP address, does not participate in routing, and does not process spanning-tree BPDUs by default, making it logically invisible on the network. This perfectly matches the requirement for transparent inspection without network participation. Layer 2 interfaces participate in switching and spanning-tree, and Layer 3 interfaces participate in routing.

For the firewall to act as an explicit proxy, clients must be able to route traffic directly to it. This requires the firewall to have a Layer 3 interface with an IP address that is reachable by the clients. This interface must be in a security zone from which traffic is allowed to be proxied.

The BGP 'Active' state indicates that the firewall is actively trying to establish a TCP connection (on port 179) with its peer but is not receiving a response. This is often due to a network connectivity issue, such as an intermediate firewall blocking the connection, an incorrect peer IP address, or a routing problem preventing the TCP SYN packet from reaching the peer or the SYN-ACK from returning. An 'Idle' state would mean it's waiting, 'Connect' means TCP is established and waiting for an OPEN message, and 'Established' is a successful peering.

Disabling split tunneling (also known as 'tunnel all' mode) forces all traffic from the client, including internet-bound traffic, through the GlobalProtect VPN tunnel. This meets the requirement for full traffic inspection. Additionally, the 'No direct access to local network' option, which is part of the agent configuration pushed from the portal, prevents the user from accessing their local network resources, satisfying the second requirement.

In the Palo Alto Networks Cloud NGFW provider for Terraform, the paloaltonetworks_cloudngfw_aws_rule_stack resource is used to define a collection of security rules (a ruleset). This rule stack can then be associated with one or more paloaltonetworks_cloudngfw_aws_firewall resources, allowing for the definition of reusable, modular security policies.