Home Certifications Editorials

Exam overview and study plan

NGFW Engineer 270-412 Practice Questions

Next-Generation Firewall (NGFW) Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 92 free questions

92 questions in this view

Page 1 of 16

Question 1

Configuration of an Advanced Routing Engine topology is needed for vsys2. However, the "Network" tab contains a Virtual Routers node instead of a Logical Routers node.

Which step is required to make logical routers available in the management interface?

Activate the Advanced Routing Engine feature at the device setup level.
Grant logical router access rights inside the user's Admin Role profile.
Assign a dedicated logical router interface directly to vsys2.
Convert the existing virtual router into a logical router inside vsys2.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

An organization uses GlobalProtect with both user- and machine-based certificate authentication and requires pre-logon, Online Certificate Status Protocol (OCSP) checks, and minimal user disruption. Multiple firewalls are managed via Panorama and domain-issued machine certificates are deployed via Group Policy.

Which approach ensures continuous, secure connectivity and consistent policy enforcement for this organization?

Distribute root and intermediate certificate authorities (CAs) via Panorama template, use distinct certificate profiles for user versus machine certs, reference an internal OCSP responder, and automate certificate deployment with Group Policy.
Deploy self-signed certificates on each firewall, allow IP address-based authentication to override certificate checks, and use default GlobalProtect settings for user / machine identification.
Configure a single certificate profile for both user and machine certificates. Rely solely on certificate revocation lists (CRLs) for revocation to minimize complexity.
Use a wildcard certificate from a public CA, disable all revocation checks to reduce latency, and manage certificate renewals manually on each firewall.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.

Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

Select the "Enable Duplicate Logging" option in the Cloud Logging section under Device → Setup → Management in the appropriate templates.
Select the "Enable Cloud Logging" option in the Cloud Logging section under Device → Setup → Management in the appropriate templates.
Enable the "Panorama/Cloud Logging" option in the Logging and Reporting Settings section under Device → Setup → Management in the appropriate templates.
Modify all active Log Forwarding profiles to select the "Cloud Logging" option in each profile match list in the appropriate device groups.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

An administrator is designing a public key infrastructure (PKI) integration for a large-scale deployment with thousands of users authenticating via client certificates. A key design goal is to ensure that certificate revocation status is checked efficiently with minimal impact on firewall performance and minimal delay for the connecting user.

What is the primary advantage of using the Online Certificate Status Protocol (OCSP) instead of certificate revocation lists (CRLs) in this scenario?

OCSP bundles all certificate statuses into a single, digitally signed file for faster downloads by the firewall.
OCSP allows the firewall to act as its own certificate authority (CA), and it simplifies certificate management.
OCSP is an older, more widely supported protocol than CRLs, ensuring compatibility with all client devices.
OCSP provides real-time status for a certificate on demand, is more scalable, and uses less firewall memory.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A firewall with multi-vsys enabled routes traffic directly between vsys2 and vsys1. Traffic logs indicate that packets successfully egress vsys2 but are dropped upon entering vsys1.

Which configuration causes this packet drop?

An explicit Security policy rule permitting the traffic was configured in vsys2 but omitted in vsys1.
An explicit NAT policy rule translating the source IP address was configured in vsys2 but omitted in vsys1.
An explicit NAT policy rule translating the source IP address was configured in vsys1 but omitted in the Shared Gateway.
An explicit Security policy rule permitting the traffic was configured in vsys1 but omitted in vsys2.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

An IKEv2 site-to-site tunnel requires a hybrid post-quantum key exchange that combines a traditional Diffie-Hellman group with a post-quantum key encapsulation mechanism (KEM).

Which combination of firewall configuration settings implements this protection?

Set IKE Gateway to PQ KEM mode, and assign both a classical Diffie-Hellman group and a post-quantum KEM in the IKE Crypto profile.
Set IKE Gateway to post-quantum pre-shared key (PQ PPK) mode, then assign both a classical Diffie-Hellman group and a post-quantum KEM in the IKE Crypto profile.
Set IKE Gateway to PQ KEM mode, and assign both a classical Diffie-Hellman group and a post-quantum KEM in the IPSec Crypto profile.
Set IKE Gateway to post-quantum pre-shared key (PQ PPK) mode, then assign both a classical Diffie-Hellman group and a post-quantum KEM in the IPSec Crypto profile.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Page 1 of 16

Build confidence for exam day with expert-reviewed questions and realistic practice. Your next certification starts here.

Company

About Contact Our Authors FAQ

Trust and policies

Methodology Editorial policy Terms and conditions Privacy policy

Contact

ExamPrepare LLC5203 Juan Tabo Blvd STE 2BAlbuquerque, NM 87111[email protected]

© 2026 ExamPrepare LLC. All rights reserved. All certification names, exam codes and logos are the property of their respective owners. All associated trademark and copyright rights belong to those owners. ExamPrepare is not affiliated with, endorsed by, or sponsored by any certification vendor.