About this exam
NGFW-Engineer is the Palo Alto Networks exam Next-Generation Firewall Engineer.
Paid practice material for this exam is not available yet, but you can try its free sample questions.
- Exam code
- NGFW-Engineer
- Vendor
- Palo Alto Networks
- Practice questions
- Not available yet
- Free sample questions
- 8
- Question bank last updated
- Not available yet
Try 2 sample questions
Taken from the free sample set for NGFW-Engineer.
Question 1
An engineer is configuring a GlobalProtect portal and wants to enable split tunneling. The requirement is to route DNS queries for "https://www.google.com/search?q=corp.internal.com" to the DNS servers assigned by the VPN, while allowing all other DNS queries to be resolved by the client's locally configured DNS.
What is the effect of configuring this split DNS policy?
- AOption A:
It provides selective DNS resolution, with specified domains resolved through the tunnel, optimizing performance for other lookups.
- BOption B:
It blocks access to all domains that are not explicitly listed in the split tunnel configuration.
- COption C:
It forces all applications to use the corporate DNS servers, regardless of the split tunnel settings for IP traffic.
- DOption D:
It creates a DNS proxy on the client endpoint that forwards all queries to the firewall for inspection.
Show answer and explanation
Correct answer: A
Basic Concept: Split DNS lets GlobalProtect resolve selected domains through VPN DNS while leaving other names to local DNS. This improves performance without breaking internal name resolution.
Why A is Correct: The policy selectively resolves listed corporate domains through the tunnel and leaves all other lookups local.
Why B is Wrong: It blocks access to all domains that are not explicitly listed in the split tunnel configuration. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why C is Wrong: It forces all applications to use the corporate DNS servers, regardless of the split tunnel settings for IP traffic. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Why D is Wrong: It creates a DNS proxy on the client endpoint that forwards all queries to the firewall for inspection. relates to VPN configuration, but it does not address the specific PAN-OS requirement for selectors, tunnel interface functions, routing, or Security policy in this scenario.
Question 2
By default, which type of traffic is configured by service route configuration to use the management
interface?
- AOption A:
Security zone
- BOption B:
IPSec tunnel
- COption C:
Virtual system (VSYS)
- DOption D:
Autonomous Digital Experience Manager (ADEM)
Show answer and explanation
Correct answer: D
By default, the Autonomous Digital Experience Manager (ADEM) traffic is configured to use the
management interface in a Palo Alto Networks firewall. The management interface is typically used
for management-related traffic, such as monitoring and logging, and it is configured to handle
ADEM-related traffic for the optimal performance of digital experience monitoring features.
This default configuration helps ensure that ADEM traffic does not interfere with regular traffic that
may traverse other interfaces, such as traffic from security zones or IPSec tunnels.
See all 8 free sample questions