100% Free Palo Alto Networks NGFW-Engineer Practice Test Questions and Answers 2026

Start Learning with the Latest and Real 100% Free Palo Alto Networks NGFW-Engineer Exam Questions

Page: 1 / 26

Total 126 Questions | Updated On: Jun 05, 2026

Add To Cart

Question 1

Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

A : Import the new subordinate CA certificate into the trust stores of all client devices.

B : Set the subordinate CA certificate as the default routing certificate for all network traffic.

C : Configure the subordinate CA to issue certificates with indefinite validity periods.

D : Disable all existing SSL decryption rules until the new certificate is fully propagated.

Answer: A

Question 2

Which statement applies to the relationship between Panorama-pushed Security policy and local firewall Security policy?

A : When a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.

B : Local firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.

C : Panorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.

D : The order of policy evaluation can be configured differently in different device groups.

Answer: B

Question 3

What is a result of enabling split tunneling in the GlobalProtect portal configuration with the œBoth Network Traffic and DNS option?

A : It specifies when the secondary DNS server is used for resolution to allow access to specific domains that are not managed by the VPN.

B : It allows users to access internal resources when connected locally and external resources when connected remotely using the same FQDN.

C : lt allows devices on a local network to access blocked websites by changing which DNS server resolves certain domain names.

D : It specifies which domains are resolved by the VPN-assigned DNS servers and which domains are resolved by the local DNS servers.

Answer: D

Question 4

A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit. Which two Security policy requirements must be included in the implementation plan? (Choose two answers)

A : The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer.

B : A pair of policies is required to control the flow of data traffic into and out of the security zone assigned to the tunnel interface.

C : A policy must explicitly permit only the IKE application between the external-facing zone and local zone.

D : A policy must explicitly permit the IPSec container application between the external-facing zone and local zone.

Answer: B,D

Question 5

When configuring a Zone Protection profile, in which section (protection type) would an NGFW engineer configure options to protect against activities such as spoofed IP addresses and split handshake session establishment attempts?

A : Flood Protection

B : Protocol Protection

C : Packet-Based Attack Protection

D : Reconnaissance Protection

Answer: B

Page: 1 / 26

Total 126 Questions | Updated On: Jun 05, 2026

Add To Cart