NGFW-Engineer: Palo Alto Networks Certified Next-Generation Firewall Engineer Practice Exam

What the NGFW-Engineer exam covers

• PAN-OS Networking Configuration309 questions
• PAN-OS Device Setting Configuration305 questions
• Integration and Automation155 questions

Free NGFW-Engineer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 769.

1. Question 1PAN-OS Networking Configuration

   When BGP path selection reaches the router ID comparison stage, which router ID is preferred?

   • AThe lowest router ID value among the candidate paths at this stageCorrect
   • BThe highest router ID value among the candidate paths at this stage
   • CRouter ID is skipped entirely at this stage since the oldest path always wins ties
   • DWhichever router ID happens to match the local virtual router's own configured ID
   ✓ Correct answer: A

   This comparison only comes into play when every earlier attribute in the path selection sequence has failed to distinguish between candidate paths, making router ID one of the last, low-priority mechanisms for arriving at a single best path.

   Why the other options are wrong

   • Bthe highest router ID is not the preferred choice; lower values win at this stage
   • Crouter ID is in fact used as a tiebreaker at this stage of the algorithm, contradicting this option
   • Dmatching the local router's own ID is not how the comparison works, since the comparison is between the candidate paths' originating routers
2. Question 2PAN-OS Networking Configuration

   In the later stages of the PAN-OS BGP path selection algorithm, what does comparing the IGP metric to the next hop help determine?

   • AWhich route was learned first, based purely on chronological arrival order
   • BWhich route belongs to the peer with the largest AS number value
   • CWhich peer has configured the strongest available authentication mechanism for the session
   • DWhich candidate path has the lowest IGP cost to reach the route's next hopCorrect
   ✓ Correct answer: D

   When earlier criteria still leave multiple candidate paths tied, PAN-OS looks at the IGP metric needed to reach each path's next hop, preferring the path whose next hop is reachable at the lowest interior cost, before moving on to remaining tiebreakers like router ID.

   Why the other options are wrong

   • Achronological order of learning is not one of the documented path selection criteria
   • Bthe numeric size of an AS number plays no role in path selection
   • Cauthentication strength is not a factor considered anywhere in the path selection algorithm
3. Question 3PAN-OS Networking Configuration

   What is the primary purpose of the Flood Protection settings within a zone protection profile?

   • ATo detect and limit excessive connection-per-second rates of certain packet typesCorrect
   • BTo detect reconnaissance activity such as port scans and host sweeps entering the zone
   • CTo validate that IP and TCP header fields conform to expected packet structure
   • DTo restrict which IP protocols, such as GRE or ICMP, are permitted into the zone
   ✓ Correct answer: A

   Flood Protection lets an administrator configure alarm, activate, and maximum rate thresholds, measured in connections per second, for packet types such as SYN, ICMP, and UDP. When those thresholds are exceeded, the firewall begins mitigating the excess traffic to protect resources behind the zone.

   Why the other options are wrong

   • BDetecting reconnaissance activity such as port scans and host sweeps is handled by the Reconnaissance Protection tab of the same zone protection profile, not Flood Protection.
   • CValidating IP and TCP header structure is handled by the Packet Based Attack Protection tab of the zone protection profile, a separate section from Flood Protection.
   • DRestricting which IP protocols may enter the zone is controlled by the Protocol Protection tab of the zone protection profile, not Flood Protection.
4. Question 4PAN-OS Networking Configuration

   How does a virtual wire interface pair typically handle Bridge Protocol Data Units (BPDUs) received from connected switches?

   • AIt silently drops every BPDU frame at the interface pair unless an administrator creates a custom App-ID or content signature to permit them
   • BIt passes BPDUs through transparently by default so the adjacent switches can maintain their own spanning tree topology across the linkCorrect
   • CIt strips the VLAN tags from BPDU frames before forwarding them onward, so switches on either side see only untagged bridging traffic
   • DIt participates fully in Spanning Tree Protocol itself, calculating its own port cost, priority, and forwarding state for each interface
   ✓ Correct answer: B

   Because virtual wire does not act as a switching device itself, it does not calculate its own spanning tree state; it simply forwards BPDUs so the switches on either side can continue their normal spanning tree negotiation.

   Why the other options are wrong

   • AThere is no default requirement for a custom App-ID signature to allow BPDUs through a virtual wire.
   • CVirtual wire does not strip VLAN tags from BPDUs as part of its default handling.
   • DVirtual wire does not run its own Spanning Tree Protocol instance or calculate port cost and priority.
5. Question 5PAN-OS Networking Configuration

   By default, how is traffic handled between two interfaces that are members of the same security zone, absent any explicit security rule?

   • AIt is permitted by the intrazone-default ruleCorrect
   • BIt is dropped unless a virtual router route is added first
   • CIt is denied until a specific allow rule is created
   • DIt requires a NAT rule before any traffic can pass
   ✓ Correct answer: A

   PAN-OS includes a default intrazone-default rule that allows traffic between interfaces within the same security zone unless it is overridden or a more specific rule changes that behavior. This differs from traffic between different zones, which is denied by default until explicitly permitted.

   Why the other options are wrong

   • BA routing table entry existing is necessary for reachability but does not by itself change the default intrazone allow behavior.
   • CDenial by default describes interzone traffic behavior, not intrazone traffic.
   • DNAT rules are not required simply because traffic stays within the same zone.
6. Question 6PAN-OS Device Setting Configuration

   Which PAN-OS dynamic administrator role grants full read-write access to the firewall, including the ability to create and manage other administrator accounts?

   • AVirtual System Administrator, limited to its assigned virtual systems only
   • BDevice Administrator - broad configuration access without account management
   • CSuperuser (Read Only), granting configuration visibility without any changes
   • DSuperuser, granting full read-write access and account management rightsCorrect
   ✓ Correct answer: D

   Superuser is the highest-privilege predefined role in PAN-OS and includes full rights to configure every feature, commit changes, and create, modify, or delete other administrator accounts and roles. It applies across the whole device rather than being limited to a virtual system.

   Why the other options are wrong

   • AVirtual System Administrator is restricted to the virtual systems it is assigned to and cannot manage administrator accounts.
   • BDevice Administrator has broad configuration access but cannot create or manage administrator accounts or roles.
   • CSuperuser (Read Only) can view the full configuration but cannot make changes or manage accounts.
7. Question 7PAN-OS Device Setting ConfigurationSelect all that apply

   Which two capabilities does SNMPv3 provide that are not available with SNMPv2c? (Choose two.)

   • AAbility to generate traps toward a management station device
   • BPer-user authentication with unique credentialsCorrect
   • CData encryption, also called privacy, for SNMP payloadsCorrect
   • DUse of a shared, plaintext community string for access
   • EAbility to poll object identifiers for device statistics
   ✓ Correct answer: B, C

   SNMPv2c relies solely on a shared, plaintext community string with no encryption. SNMPv3 introduces individual user accounts with configurable authentication and privacy (encryption) protocols, substantially improving the confidentiality and integrity of SNMP communications.

   Why the other options are wrong

   • ABoth SNMPv2c and SNMPv3 support generating traps to a management station.
   • DCommunity strings are a feature of SNMPv1/v2c, not an SNMPv3 capability, SNMPv3 uses per-user credentials instead.
   • EBoth SNMPv2c and SNMPv3 support polling object identifiers for statistics.
8. Question 8PAN-OS Device Setting Configuration

   Where within PAN-OS is an additional authentication factor, such as a one-time code from a multi-factor authentication vendor, configured for use after primary credentials are validated?

   • AWithin the certificate profile used to validate client certificates
   • BOn the Lockout tab of an authentication profile's failure settings
   • CWithin the Admin Role Profile's WebUI feature access settings
   • DOn the Factors settings of an authentication profile itselfCorrect
   ✓ Correct answer: D

   After a user's primary credentials are validated, PAN-OS can prompt for one or more additional factors defined here, referencing a multi-factor authentication server profile configured for a supported vendor, before authentication is considered complete.

   Why the other options are wrong

   • ACertificate profile configuration deals with validating client certificates, not multi-factor authentication factors.
   • BThe Lockout tab governs failed-attempt thresholds and lockout duration, not additional authentication factors.
   • CThe Admin Role Profile's WebUI settings control feature-level access, not authentication factors.
9. Question 9Integration and Automation

   What is the primary function of the init-cfg.txt file in a VM-Series bootstrap package?

   • AIt stores the authorization code and license key data used to activate a support entitlement
   • BIt contains the complete day-1 security policy and configuration content expressed in XML format
   • CIt supplies day-0 parameters, including the management IP address and hostname, read at first bootCorrect
   • DIt defines the content and threat signature update schedule and download frequency settings used later
   ✓ Correct answer: C

   During bootstrapping, the firewall mounts the /config folder and reads init-cfg.txt for parameters such as hostname, IP address, default gateway, DNS servers, and the Panorama server address, letting it become reachable without console access. The complete day-1 policy configuration, when supplied, instead resides in bootstrap.xml within the same folder.

   Why the other options are wrong

   • ALicense authorization is handled through the /license folder or an external licensing service, not init-cfg.txt.
   • BThe full day-1 policy configuration in XML form belongs in bootstrap.xml, not init-cfg.txt.
   • DContent and threat signature scheduling is managed through the /content folder and update settings, not init-cfg.txt.
10. Question 10Integration and Automation

    Which PAN-OS XML API request type is commonly used to retrieve items such as the device configuration file, certificates, or tech-support files from the firewall?

    • Aop, which executes operational commands such as show, request, or clear against the firewall
    • Bimport, which uploads files such as certificates or software images onto the firewall
    • Clog, which retrieves matching log records such as traffic, threat, or system entries
    • Dexport, which retrieves files such as configurations or certificates from the firewallCorrect
    ✓ Correct answer: D

    An export request specifies a category, such as configuration or certificate, and returns the corresponding file from the firewall in the API response, allowing it to be saved by the client.

    Why the other options are wrong

    • AThe op request type executes operational commands rather than exporting files.
    • BThe import request type uploads items to the firewall rather than retrieving them.
    • CThe log request type retrieves log records rather than files such as certificates or configurations.

Related Palo Alto resources

• NGFW-Engineer study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• CyberSec-Practitioner practice examRelated
• XDR-Engineer practice examRelated
• NetSec-Pro practice examRelated

NGFW-Engineer practice exam FAQ