NGFW-Engineer試験無料問題集（52題）「Palo Alto Networks Next-Generation Firewall Engineer 認定」

出題：1

A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency.
Which approach best addresses these requirements while maintaining consistent policy enforcement?

A. Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CA. Turn off certificate revocation checks for lower overhead, rely on IP-based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices.

B. Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency.

C. Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall's local certificate store for authentication.

D. Distribute the root and intermediate CA certificates via Panorama as shared objects to ensure all firewalls have a consistent trust chain. Configure OCSP responder profiles on each firewall to offload revocation checks to an internal OCSP server while keeping CRL checks as a fallback. Maintain separate certificate profiles for user and device authentication and use an automated enrollment method - such as Group Policy or SCEP - to deploy certificates to endpoints.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)

A. NAT tables

B. GlobalProtect Portal

C. GlobalProtect Gateways

D. User Authentication

正解：B,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

A. Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.

B. Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device --> Setup --> Management in the appropriate templates.

C. Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups.

D. Select the "Enable Cloud Logging" option in the Cloud Logging section under Device --> Setup --> Management in the appropriate templates.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

An NGFW engineer is configuring multiple Layer 2 interfaces on a Palo Alto Networks firewall, and all interfaces must be assigned to the same VLAN. During initial testing, it is reported that clients located behind the various interfaces cannot communicate with each other.
Which action taken by the engineer will resolve this issue?

A. Configure each interface to belong to the same Layer 2 zone and enable IP routing between them.

B. Assign each interface to the appropriate Layer 2 zone and configure Security policies for interfaces not assigned to the same zone.

C. Assign each interface to the appropriate Layer 2 zone and configure a policy that allows traffic within the VLAN.

D. Enable IP routing between the interfaces and configure a Security policy to allow traffic between interfaces within the VLAN.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which type of firewall resource can be assigned when configuring a new firewall virtual system (VSYS)?

A. Security profile limit

B. ICPU

C. Memory

D. Sessions limit

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

NGFW-Engineer試験無料問題集「Palo Alto Networks Next-Generation Firewall Engineer 認定」