Free Palo Alto Networks NGFW-Engineer Exam Questions
Try our Free Demo Practice Tests for Comprehensive NGFW-Engineer Exam Preparation
-
Palo Alto Networks NGFW-Engineer Exam Questions
-
Provided By: Palo Alto Networks
- Exam: Palo Alto Networks Next-Generation Firewall Engineer
- Certification: Palo Alto Networks Certified Software Firewall Engineer
-
Total Questions: 126
-
Updated On: Jul 02, 2026
-
Rated: 4.9 |
-
Online Users: 252
-
Question 1
-
A company is enabling SSL Forward Proxy to inspect encrypted traffic. A security engineer generates a new
certificate on the firewall and flags it with the "Forward Trust" certificate property.
What is the critical next step that must be performed for decryption to function correctly without causing
security warnings for end users?
Answer: D
-
A company is enabling SSL Forward Proxy to inspect encrypted traffic. A security engineer generates a new
certificate on the firewall and flags it with the "Forward Trust" certificate property.
What is the critical next step that must be performed for decryption to function correctly without causing
security warnings for end users?
-
Question 2
-
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE)
interface on a Palo Alto Networks high availability (HA) active/passive pair?
Answer: C
-
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE)
interface on a Palo Alto Networks high availability (HA) active/passive pair?
-
Question 3
-
A holding company has recently acquired two new businesses, each with its own Okta identity provider. The
holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three
organizations’ firewalls. However, for legal reasons, the firewalls of Company A must only receive identity
data from Company A's Okta instance, and the firewalls of Company B must only receive data from Company
B's Okta instance.
Which configuration in CIE supports this requirement with highest operational efficiency?
Answer: A
-
A holding company has recently acquired two new businesses, each with its own Okta identity provider. The
holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three
organizations’ firewalls. However, for legal reasons, the firewalls of Company A must only receive identity
data from Company A's Okta instance, and the firewalls of Company B must only receive data from Company
B's Okta instance.
Which configuration in CIE supports this requirement with highest operational efficiency?
-
Question 4
-
Which statement applies to the relationship between Panorama-pushed Security policy and local
firewall Security policy?
Answer: B
-
Which statement applies to the relationship between Panorama-pushed Security policy and local
firewall Security policy?
-
Question 5
-
Which statement applies to the relationship between Panorama-pushed Security policy and local
firewall Security policy?
Answer: B
-
Which statement applies to the relationship between Panorama-pushed Security policy and local
firewall Security policy?