[Q72-Q92] Exam Passing Guarantee Apr 24, 2026 NGFW-Engineer Exam with Accurate Quastions!

NEW QUESTION 72
What are two valid zone types that can be selected from the zone configuration menu, per Palo Alto Networks best practices? (Choose two answers)

Layer 3

Layer 2

Management

DMZ

NEW QUESTION 73
A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency.
Which approach best addresses these requirements while maintaining consistent policy enforcement?

Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CA. Turn off certificate revocation checks for lower overhead, rely on IP-based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices.

Distribute the root and intermediate CA certificates via Panorama as shared objects to ensure all firewalls have a consistent trust chain. Configure OCSP responder profiles on each firewall to offload revocation checks to an internal OCSP server while keeping CRL checks as a fallback.
Maintain separate certificate profiles for user and device authentication and use an automated enrollment method ?such as Group Policy or SCEP ?to deploy certificates to endpoints.

Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall’s local certificate store for authentication.

Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency.

NEW QUESTION 74
Which set of options is available for detailed logs when building a custom report on a Palo Alto Networks NGFW?

Traffic, User-ID, URL

Traffic, threat, data filtering, User-ID

GlobalProtect, traffic, application statistics

Threat, GlobalProtect, application statistics, WildFire submissions

NEW QUESTION 75
Which configuration in the LACP tab will enable pre-negotiation for an Aggregate Ethernet (AE) interface on a Palo Alto Networks high availability (HA) active/passive pair?

Set Transmission Rate to “fast.”

Set passive link state to “Auto.”

Set “Enable in HA Passive State.”

Set LACP mode to “Active.”

NEW QUESTION 76
What are the phases of the Palo Alto Networks AI Runtime Security: Network Intercept solution?

Scanning, Isolation, Whitelisting, Logging

Discovery, Deployment, Detection, Prevention

Policy Generation, Discovery, Enforcement, Logging

Profiling, Policy Generation, Enforcement, Reporting

NEW QUESTION 77
Which two services are configured by applying an SSL/TLS service profile? (Choose two answers)

GlobalProtect portal

Log forwarding to Strata Logging Service

Forward-Trust certificate

Syslog server monitoring

NEW QUESTION 78
Which two zone types are valid when configuring a new security zone? (Choose two.)

Tunnel

Intrazone

Internal

Virtual Wire

NEW QUESTION 79
An administrator is configuring a GlobalProtect pre-logon VPN. The administrator has already imported the necessary internal certificate authority (CA) certificates for issuing machine certificates onto the firewall.
Which configuration is required on the GlobalProtect Gateway to enable pre-logon using these machine certificates?

Create a device-based Security policy that allows traffic from the pre-logon user to an internal management zone.

Create an authentication profile that points to the machine certificate’s CA and assign it by using the client authentication settings of the GlobalProtect Portal.

Create a certificate profile that trusts the machine certificate’s CA and assign it within the Gateway Agent –> Client Authentication settings.

Configure the Gateway Agent –> Tunnel Settings to use IPSec with machine certificate authentication for the pre- logon tunnel.

NEW QUESTION 80
An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned.
The company wants both authentication types to be running in parallel during the transition to SAML.
Which two actions meet the criteria? (Choose two.)

Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.

Create an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.

Create and apply an authentication profile with the “SAML Identity Provider” Server Profile.

Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the “RADIUS” Server Profile.

NEW QUESTION 81
An engineer is implementing a new rollout of SAML for administrator authentication across a company’s Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML.
Which two actions meet the criteria? (Choose two.)

Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.

Create an authentication sequence that includes both the “RADIUS” Server Profile and “SAML Identity Provider” Server Profile to run the two services in tandem.

Create and apply an authentication profile with the “SAML Identity Provider” Server Profile.

Create and add the “SAML Identity Provider” Server Profile to the authentication profile for the
“RADIUS” Server Profile.

NEW QUESTION 82
In an enterprise network, security administrators want to control traffic based on application behavior rather than only using IP addresses and TCP/UDP ports.
Which NGFW capability MOST directly enables this requirement?

Static routing

Network Address Translation (NAT)

Application Identification using Deep Packet Inspection

VLAN segmentation

NEW QUESTION 83
What is the function of a Certificate Revocation List (CRL) in a PKI?

Lists expired certificates

Lists certificates that have been revoked before their expiration date

Lists all issued certificates

Lists certificates pending renewal

NEW QUESTION 84
An NGFW policy allows general web browsing but blocks access to known malicious or high-risk websites.
Which NGFW security function is MOST directly responsible for this behavior?

Intrusion Prevention System (IPS)

URL filtering

Antivirus scanning

Network Address Translation (NAT)

NEW QUESTION 85
A network security engineer needs to permit traffic between two distinct VSYS that reside on one Palo Alto Networks firewall. This traffic will not egress the firewall to an external device.
Which zone type must be configured to act as the logical source and destination for this traffic flow?

External

TAP

Layer 3

Layer 2

NEW QUESTION 86
Which initial action is required to configure logical routers?

Changing the virtual router type from “default” to “advanced”

Activating an advanced routing subscription

Committing a new advanced routing software module

Checking “advanced routing” in general settings

NEW QUESTION 87
A network engineer observes that after a primary link recovers, the firewall immediately switches traffic back from the backup static route to the primary static route. The engineer checks the path monitoring configuration for the primary route.
Which value is configured for the preemptive hold time to cause this behavior?

Lowest possible value greater than 0

0

Default value

Feature disabled

NEW QUESTION 88
For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

Use of dynamic routing protocols

Tunnel monitoring

Use of peer IP

Redistribution of User-ID

NEW QUESTION 89
A firewall administrator uses Panorama to manage a fleet of firewalls. After successfully onboarding the firewalls to Strata Logging Service and enabling cloud logging via a template, the security operations team reports that they can no longer see new logs on the on-premises Panorama log collectors. Logs are appearing correctly in Strata Logging Service. Which setting was likely missed in the Panorama template configuration?

The device certificates for the Panorama log collectors were not renewed after enabling the cloud logging connection.

Duplicate logging (cloud and on-premises) is disabled under Device # Setup # Management.

The Log Forwarding profile was modified to send logs only to the Strata Logging Service and no longer includes the on-premises Panorama log collectors.

The Panorama log collectors were not defined as primary destinations within the collector group configuration for the managed firewalls.

NEW QUESTION 90
What is a valid configurable limit for setting resource quotas when defining a new VSYS on a Palo Alto Networks firewall?

Percentage of total CPU utilization

Maximum number of SSL decryption rules

Maximum number of virtual routers

Disk space allocation for logs

NEW QUESTION 91
A government agency needs to ensure that all user web access is explicitly mediated and authenticated. The agency has the following requirements:
– Client browsers must be manually configured to send traffic to the
firewall’s IP address and a specific port.
– The firewall must support seamless single sign-on (SSO) with the
users’ existing Active Directory credentials.
Which feature set should the engineer configure to meet the agency’s requirements?

Web proxy in explicit mode with an Authentication policy by using Kerberos

Decryption policy that redirects users to a SAML identity provider for authentication

Web proxy in transparent mode with an Authentication policy by using multi-factor authentication (MFA)

User-ID agent integration with Authentication Portal for authentication

NEW QUESTION 92
An organization has configured GlobalProtect in a hybrid authentication model using both certificate-based authentication for the pre-logon stage and SAML-based multi-factor authentication (MFA) for user logon.
How does the GlobalProtect agent process the authentication flow on Windows endpoints?

The GlobalProtect agent uses the machine certificate to establish a pre-logon tunnel; upon user sign-in, it prompts for SAML-based MFA credentials, ensuring both device and user identities are validated before granting full access.

The GlobalProtect agent uses the machine certificate during pre-logon for initial tunnel establishment, and then seamlessly reuses the same machine certificate for user-based authentication without requiring MFA.

Once the machine certificate is validated at pre-logon, the Windows endpoint completes MFA on behalf of the user by passing existing Windows Credential Provider details to the GlobalProtect gateway without prompting the user.

GlobalProtect requires the user to log in first for SAML-based MFA before establishing the pre-logon tunnel, rendering the pre-logon certificate authentication (CA) flow redundant.

Leave a Reply Cancel reply