2025年更新のNGFW-Engineer問題集合格保証付きで合格できます！
NGFW-Engineer試験問題集を試そう！ベストNGFW-Engineer試験問題トレーニングを提供しています
Palo Alto Networks NGFW-Engineer 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
質問 # 23
Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)
- A. The IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy.
- B. For incoming and outgoing traffic through the tunnel, creating separate rules for each direction is optional.
- C. The IKE negotiation and IPSec/ESP packets are denied by default via the interzone default deny policy.
- D. For incoming and outgoing traffic through the tunnel, separate rules must be created for each direction.
正解：C、D
解説：
Separate rules must be created for each direction: Palo Alto Networks firewalls enforce security policies based on traffic direction. To allow bidirectional communication through the IPSec tunnel, two separate rules are required - one for incoming and one for outgoing traffic.
IKE negotiation and IPSec/ESP packets are denied by default: Palo Alto Networks firewalls use an interzone default deny policy, meaning that unless an explicit policy allows IKE (UDP 500/4500) and ESP (protocol 50) traffic, the firewall will block these packets, preventing tunnel establishment. Therefore, administrators must create explicit rules permitting IKE and IPSec/ESP traffic to the firewall's external interface.
質問 # 24
An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?
- A. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
- B. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups.
- C. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.
- D. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.
正解：A
解説：
To begin sending logs to Strata Logging Service while continuing to forward them to Panorama log collectors, the necessary configuration is to enable Cloud Logging. This option is configured in the Cloud Logging section under Device → Setup → Management in the appropriate templates. Once enabled, this ensures that logs are directed both to the Strata Logging Service (cloud) and to the Panorama log collectors.
質問 # 25
Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)
- A. Select IKE v2 Preferred, enable the Advanced Options * PQ KEM, then add one or more "Rounds."
- B. Select IKE v2, enable the Advanced Options * PQ PPK, then set a 64+ character string for the post-quantum pre shared key.
- C. Select IKE v2, enable the Advanced Options * PQ KEM, then create an IKE Crypto Profile with Advanced Options adding one or more "Rounds."
- D. Ensure Authentication is set to "certificate," then import a post-quantum derived certificate.
正解：A、C
解説：
To implement post-quantum cryptography (PQC) in VPNs between Palo Alto Networks NGFWs, you would enable the PQ KEM (Post-Quantum Key Encapsulation Mechanism) in the IKE gateway configuration. This enables the firewall to use quantum-resistant encryption for key exchange, which is an essential part of securing communications against the potential future threats posed by quantum computing.
By selecting IKE v2 Preferred and enabling the PQ KEM option under Advanced Options, you can add specific Rounds for the post-quantum cryptography process, which will help in implementing quantum-resistant key exchange methods.
This option similarly selects IKE v2 and enables PQ KEM while also creating a dedicated IKE Crypto Profile with the necessary Rounds configured for post-quantum cryptography.
質問 # 26
What is a result of enabling split tunneling in the GlobalProtect portal configuration with the "Both Network Traffic and DNS" option?
- A. It allows users to access internal resources when connected locally and external resources when connected remotely using the same FQDN.
- B. lt allows devices on a local network to access blocked websites by changing which DNS server resolves certain domain names.
- C. It specifies when the secondary DNS server is used for resolution to allow access to specific domains that are not managed by the VPN.
- D. It specifies which domains are resolved by the VPN-assigned DNS servers and which domains are resolved by the local DNS servers.
正解：D
解説：
When split tunneling is enabled with the "Both Network Traffic and DNS" option in the GlobalProtect portal configuration, it allows the firewall to control which traffic is sent over the VPN tunnel and which is not. Specifically, it determines which domains are resolved by the VPN-assigned DNS servers (for domains requiring VPN access) and which are resolved by local DNS servers (for domains that can be accessed without the VPN tunnel).
質問 # 27
An engineer at a managed services provider is updating an application that allows its customers to request firewall changes to also manage SD-WAN. The application will be able to make any approved changes directly to devices via API.
What is a requirement for the application to create SD-WAN interfaces?
- A. XML API's "sdwanprofiles/interfaces" parameter on a Panorama device
- B. REST API's "sdwanInterfaceprofiles" parameter on a Panorama device
- C. XML API's "InterfaceProfiles/sdwan" parameter on a firewall device
- D. REST API's "sdwanInterfaces" parameter on a firewall device
正解：D
解説：
To create SD-WAN interfaces through an API, the correct approach is to use the REST API's "sdwanInterfaces" parameter on a firewall device. This parameter allows you to configure SD-WAN interfaces directly on the firewall devices via API, ensuring that the required interfaces are set up and managed for SD-WAN functionality.
質問 # 28
Which forwarding methods can be used on the Objects tab when configuring the Log Forwarding profile?
- A. Panorama, syslog, email
- B. SNMP, HTTP, RADIUS
- C. Syslog, HTTP, NetFlow
- D. Panorama, ADEM, syslog
正解：A
解説：
When configuring the Log Forwarding profile on a Palo Alto Networks firewall, the forwarding methods available include:
Panorama: For forwarding logs to a Panorama management system.
Syslog: For forwarding logs to a syslog server.
Email: For sending logs via email.
質問 # 29
In a hybrid cloud deployment, what is the primary function of Ansible in managing Palo Alto Networks NGFWs?
- A. It enables centralized log collection and correlation for NGFWs.
- B. It automates NGFW policy updates and configurations through playbooks.
- C. It facilitates dynamic updates to NGFW threat databases.
- D. It provides a web interface for managing NGFW hardware clusters.
正解：B
解説：
In a hybrid cloud deployment, Ansible is primarily used for automating configurations and policy updates on Palo Alto Networks Next-Generation Firewalls (NGFWs). Through the use of playbooks, Ansible can automate the process of deploying security policies, updating configurations, and managing the firewall's state, which enhances efficiency and consistency across multiple NGFWs in a large or hybrid cloud environment.
質問 # 30
An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must be minimized.
What is the recommended upgrade process for minimal disruption in this high availability (HA) scenario?
- A. Suspend the active firewall to trigger a failover to the passive firewall. With traffic now running on the former passive unit, upgrade the suspended (now passive) firewall and confirm proper operation. Then fail traffic back and upgrade the remaining firewall.
- B. Isolate both firewalls from the production environment and upgrade them in a separate, offline setup. Reconnect them only after validating the new software version, resuming HA functionality once both units are fully upgraded and tested.
- C. Shut down the currently active firewall and upgrade it offline, allowing the passive firewall to handle all traffic. Once the active firewall finishes upgrading, bring it back online and rejoin the HA cluster. Finally, upgrade the passive firewall while the newly upgraded unit remains active.
- D. Push the new PAN-OS version simultaneously to both firewalls, having them upgrade and reboot in parallel. Rely on automated HA reconvergence to restore normal operations without manually failing over traffic.
正解：A
解説：
In an active/passive HA setup, the recommended process for upgrading involves minimizing downtime and ensuring traffic continuity by using the failover process:
Suspend the active firewall: This triggers a failover to the passive unit, making it the active unit.
Upgrade the former passive (now active) unit: With traffic now running on the previously passive unit, upgrade the suspended unit while the active unit continues handling traffic.
Confirm proper operation: Once the upgrade is complete, verify that the upgraded unit is functioning properly.
Fail traffic back: Once the upgraded firewall is confirmed to be working, fail the traffic back to the original active unit and upgrade the remaining firewall.
質問 # 31
Which zone type allows traffic between zones in different virtual systems (VSYS), without the traffic leaving the firewall?
- A. External
- B. Isolated
- C. Transient
- D. Internal
正解：C
解説：
The Transient zone type is used to allow traffic between zones in different virtual systems (VSYS) on a Palo Alto Networks firewall without the traffic leaving the firewall. It provides a way for virtual systems to communicate with each other by acting as a temporary or intermediary zone. Traffic can pass through the firewall between the virtual systems without requiring physical interfaces or leaving the device.
質問 # 32
What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?
- A. Profiling, Policy Generation, Enforcement, Reporting
- B. Policy Generation, Discovery, Enforcement, Logging
- C. Scanning, Isolation, Whitelisting, Logging
- D. Discovery, Deployment, Detection, Prevention
正解：D
解説：
The phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution are designed to help identify and protect against potential threats in real time by using AI to detect and prevent malicious activities within the network.
Discovery: Identifying applications, services, and behaviors within the network to understand baseline activity.
Deployment: Implementing the solution into the network and integrating with existing security measures.
Detection: Monitoring traffic and activities to identify abnormal or malicious behavior.
Prevention: Taking action to stop threats once detected, such as blocking malicious traffic or stopping exploit attempts.
質問 # 33
Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)
- A. User Authentication
- B. NAT tables
- C. GlobalProtect Gateways
- D. GlobalProtect Portal
正解：C、D
解説：
Palo Alto Networks Next-Generation Firewalls (NGFWs) use SSL/TLS profiles to secure connections for services such as GlobalProtect Gateways and GlobalProtect Portals. These profiles are used to manage the SSL/TLS encryption and decryption for secure communication between the firewall and clients (such as VPN clients for GlobalProtect). This helps ensure the confidentiality and integrity of the data during transmission.
質問 # 34
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?
- A. Set "Enable in HA Passive State."
- B. Set Transmission Rate to "fast."
- C. Set LACP mode to "Active."
- D. Set passive link state to "Auto."
正解：A
解説：
In a High Availability (HA) active/passive pair configuration, when setting up an Aggregate Ethernet (AE) interface, enabling the "Enable in HA Passive State" option allows the interface to participate in LACP (Link Aggregation Control Protocol) even when the system is in the passive state. This ensures that the pre-negotiation of the LACP link occurs, allowing the link aggregation to be ready as soon as the firewall becomes active.
質問 # 35
A PA-Series firewall with all licensable features is being installed. The customer's Security policy requires that users do not directly access websites. Instead, a security device must create the connection, and there must be authentication back to the Active Directory servers for all sessions.
Which action meets the requirements in this scenario?
- A. Deploy the Next-Generation Firewalls as normal and install the User-ID agent.
- B. Deploy the Advanced URL Filtering license and captive portal.
- C. Deploy the transparent proxy with Web Cache Communications Protocol (WCCP).
- D. Deploy the explicit proxy with Kerberos authentication scheme.
正解：D
解説：
In this scenario, the customer requires that users do not directly access websites and that a security device (the firewall) manages the connection, while also ensuring that there is authentication back to the Active Directory (AD) servers for all sessions. The explicit proxy with Kerberos authentication is the best solution because:
The explicit proxy allows the firewall to intercept user web traffic and manage the connections on behalf of users.
Kerberos authentication ensures that the user's identity is validated against the Active Directory servers before the session is allowed, fulfilling the authentication requirement.
質問 # 36
In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.
What function do certificate profiles serve in this context?
- A. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
- B. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
- C. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.
- D. They allow the firewall to bypass certificate validation entirely, focusing only on username / password-based authentication.
正解：B
解説：
In the context of GlobalProtect with certificate-based authentication, certificate profiles are used to ensure proper validation of the certificates. They perform the following functions:
Define trust anchors, which are the root and intermediate Certificate Authorities (CAs) that the firewall trusts to authenticate certificates.
Specify revocation checks, such as CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol), to ensure that the certificates being used have not been revoked.
Map certificate attributes, such as the Common Name (CN), which helps in authenticating users and devices based on their certificates.
質問 # 37
Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?
- A. It provides Infrastructure-as-Code (IaC) to automate NGFW deployment.
- B. It orchestrates real-time traffic inspection for network segments.
- C. It manages threat intelligence data synchronization with NGFWs.
- D. It acts as a logging service for NGFW performance metrics.
正解：A
解説：
Terraform is an Infrastructure-as-Code (IaC) tool that automates the provisioning and management of infrastructure resources, including Palo Alto Networks Next-Generation Firewalls (NGFWs). By using Terraform configuration files, administrators can define and deploy NGFW instances across cloud environments (such as AWS, Azure, and GCP) efficiently and consistently.
Terraform enables:
Automated firewall deployment in cloud environments.
Configuration of security policies and networking settings in a declarative manner.
Scalability and repeatability, reducing manual intervention in firewall provisioning.
質問 # 38
......
最新100%合格率保証付きの素晴らしいNGFW-Engineer試験問題PDF：https://www.goshiken.com/Palo-Alto-Networks/NGFW-Engineer-mondaishu.html
実践サンプルと問題集指導には2025年最新のNGFW-Engineer有効なテスト問題集：https://drive.google.com/open?id=1T433xbRKdDv-8a7vxxNMAnoApvGc-jzS