NGFW-Engineer試験無料問題集（52題）「Palo Alto Networks Next-Generation Firewall Engineer 認定」

出題：1

Which statement applies to Log Collector Groups?

A. Log redundancy is available only if each Log Collector has the same amount of total disk storage.

B. The maximum number of Log Collectors in a Log Collector Group is 18 plus two hot spares.

C. Enabling redundancy increases the log processing traffic in a Collector Group by 50%.

D. In any single Collector Group, all the Log Collectors must run on the same Panorama model.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

A. It acts as a logging service for NGFW performance metrics.

B. It manages threat intelligence data synchronization with NGFWs.

C. It orchestrates real-time traffic inspection for network segments.

D. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

Which two zone types are valid when configuring a new security zone? (Choose two.)

A. Internal

B. Intrazone

C. Virtual Wire

D. Tunnel

正解：C,D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must be minimized.
What is the recommended upgrade process for minimal disruption in this high availability (HA) scenario?

A. Push the new PAN-OS version simultaneously to both firewalls, having them upgrade and reboot in parallel. Rely on automated HA reconvergence to restore normal operations without manually failing over traffic.

B. Isolate both firewalls from the production environment and upgrade them in a separate, offline setup. Reconnect them only after validating the new software version, resuming HA functionality once both units are fully upgraded and tested.

C. Suspend the active firewall to trigger a failover to the passive firewall. With traffic now running on the former passive unit, upgrade the suspended (now passive) firewall and confirm proper operation. Then fail traffic back and upgrade the remaining firewall.

D. Shut down the currently active firewall and upgrade it offline, allowing the passive firewall to handle all traffic. Once the active firewall finishes upgrading, bring it back online and rejoin the HA cluster. Finally, upgrade the passive firewall while the newly upgraded unit remains active.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.
How does the GlobalProtect agent process the authentication flow on Windows endpoints?

A. Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.

B. GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.

C. The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.

D. The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

NGFW-Engineer試験無料問題集「Palo Alto Networks Next-Generation Firewall Engineer 認定」