Domain 1: PAN-OS Networking Configuration
- A Layer3 interface participates in policy and routing only when it is assigned both a security zone and a virtual router; missing either breaks matching or forwarding.
- In BGP best-path selection, once all higher attributes tie, the path from the router with the lowest router ID wins, and the router ID also uniquely identifies the BGP speaker.
- AS-path prepending artificially lengthens the AS-path so neighboring autonomous systems are less likely to prefer that route, steering inbound traffic to a shorter alternate path.
- PAN-OS conditional advertisement with a non-exist filter advertises a backup route only when a monitored (tracked) route is absent from the routing table, enabling failover advertising.
- OSPF adjacency on broadcast links fails when interface subnet masks disagree, because mismatched masks put the neighbors on different logical subnets; Exstart is where neighbors negotiate master/slave before exchanging DBD packets.
- Manually setting the OSPF or BGP router ID gives stability that automatic address-based selection does not guarantee, and OSPF graceful restart lets a restarting router keep its learned routes valid during the outage.
- LACP system priority uses lower-value-equals-higher-priority, so lowering the number increases a device's aggregation priority; a duplex mismatch produces errors and reduced throughput.
- A packet with no matching route and no configured default route is dropped for lack of a route to its destination.
- A tap zone only receives a passively mirrored copy of traffic and therefore cannot block, while bump-in-the-wire (virtual wire) inspects and enforces policy while staying invisible to neighboring L3 devices with no IP or routing changes.
- GRE does not encrypt its payload by default and must be paired with IPSec for confidentiality; GlobalProtect can authenticate via RADIUS, LDAP, or SAML and supports split tunneling scoped by access-route subnets, domains, or applications.
- An interface management profile controls which management services (such as HTTPS or ping) and source addresses can reach the firewall on that interface, and active/passive HA relies on the HA1 control link and HA2 data link.
Domain 2: PAN-OS Device Setting Configuration
- An authentication profile defines how credentials are verified (Local, RADIUS, TACACS+, LDAP, Kerberos, or SAML), while an authentication sequence tries each listed profile in order until one succeeds.
- Generating a certificate creates a new key pair and certificate locally on the firewall, whereas importing brings in an externally produced certificate and optionally its key pair; OCSP checks revocation with a real-time query for one specific certificate.
- WebUI HTTPS access is secured by an SSL/TLS certificate assigned to the management interface, and client-certificate authentication for the WebUI is enabled by applying a certificate profile in the management authentication settings.
- Without Terminal Services (TS) agent port mapping, every session on a shared Remote Desktop Services host appears to the firewall as one source IP, so User-ID cannot distinguish individual users.
- DNS Proxy rules are evaluated top-down and the first matching domain rule handles the query; static FQDN-to-IP entries are answered directly and take precedence over cached or forwarded records.
- DNS Security categories accept actions of alert, allow, block, or sinkhole, where sinkhole substitutes a controlled IP for the resolution instead of blocking the query outright.
- Log storage quotas allocate a percentage of finite local disk to each log type (such as Traffic or Threat) so one high-volume type cannot crowd out others and shorten retention.
- The System log records system-level events such as HA state changes and certificate-expiration warnings, and PAN-OS can schedule automatic content updates to check, download, and install new releases on a recurrence.
- A Log Forwarding profile match-list entry can add or remove a tag on a source or destination address or a source user, feeding Dynamic Address Groups and Dynamic User Groups for automated response.
- An HTTP Server Profile forwards logs as customizable HTTP requests to third-party systems, while an Email Server Profile requires an SMTP server address plus sender and recipient addresses.
- The default predefined admin account holds the Superuser dynamic role (not Device Administrator); a Virtual System Administrator (Read Only) role is view-only within its assigned vsys and generally cannot create or edit Shared objects.
Domain 3: Integration and Automation
- Firewalls are added to Panorama by serial number on the Managed Devices page, after which each firewall or vsys is assigned to exactly one device group plus templates and a Collector Group.
- Templates and template stacks centrally manage network and device settings (interfaces, zones, virtual routers), while device groups manage policy and objects; a rule in the Shared location applies to every device group in the hierarchy.
- Moving a device group to a new parent changes which parent-level rules and objects its firewalls inherit, so hierarchy placement directly drives rule inheritance.
- A commit that is not scoped by an admin or location filter can also include other administrators' pending candidate changes, which is why partial or filtered commits matter in multi-admin environments.
- init-cfg.txt in a bootstrap package supplies day-0 settings such as hostname, IP, gateway, DNS, and the Panorama server address that a VM-Series firewall reads on first boot; full day-1 policy lives in bundle files.
- Panorama supports active/passive HA between two management servers, synchronizing device groups, templates, and managed-device information between peers, with one peer active and the other ready to take over.
- PAN-OS REST API endpoints embed a version identifier so requests align with a specific release's object schema and feature set, and interface management profiles govern which services and source addresses can reach the API.
- In the XML API, a get action returns configuration data without altering it, a success status means the request completed with any data in the response body, and log queries run as jobs polled by a returned job ID.
- The target parameter identifies which managed firewall a Panorama-issued API request is directed to, and Panorama can retrieve and deploy license or subscription activations to managed firewalls.
- A Log Collector receives and stores logs forwarded by managed firewalls, and Log Forwarding profiles can auto-tag a session's source or destination address for downstream dynamic grouping.
- The VM-Series firewall runs on supported public clouds and hypervisors, on AWS commonly as an Auto Scaling group behind a Gateway Load Balancer or a standalone Marketplace-AMI EC2 instance; terraform plan previews changes without applying them.
NGFW-Engineer exam tips
- Treat every question as a hands-on config scenario: know the exact GUI path and object dependencies (zone plus virtual router on an interface, certificate profile in management settings) rather than just the concept name.
- Memorize the low-value-wins conventions that trip candidates up: lowest router ID wins BGP ties, lower LACP system priority means higher priority, and OSPF mask mismatches block adjacency.
- Be able to distinguish look-alike actions and objects quickly: generate vs import certificates, sinkhole vs block in DNS Security, tap (passive) vs virtual wire (inline) zones, and static vs forwarded DNS Proxy entries.
- For Panorama and automation items, keep the hierarchy straight: templates carry network/device settings, device groups carry policy/objects, Shared applies everywhere, and each firewall or vsys maps to exactly one device group.
- The exam is 90 minutes for a large pool, so pace yourself and flag configuration edge cases (multi-admin commits, HA link roles, User-ID on shared hosts) for review instead of stalling.
Study guide FAQ
What experience does the NGFW-Engineer exam assume?
It targets experienced firewall engineers who already deploy and operate PAN-OS next-generation firewalls, so it expects real hands-on configuration skill across networking, device settings, and Panorama or API automation rather than introductory knowledge.
What is the passing score and exam length?
The exam uses a scaled passing score of 700 and runs for 90 minutes; the question pool is large (around 769 items) so expect scenario-based configuration questions across all three domains.
Which domain carries the most weight?
PAN-OS Networking Configuration is the largest area, closely followed by Device Setting Configuration, with Integration and Automation the smallest of the three. Prioritize interfaces, routing, HA, certificates, User-ID, and Panorama fundamentals.
Do I need to know Panorama, APIs, and tools like Terraform and Ansible?
Yes. The Integration and Automation domain covers Panorama device groups, templates, and HA, the REST and XML APIs, VM-Series cloud deployment, and infrastructure-as-code tools such as Terraform (for example, terraform plan) and Ansible.