Home Certifications Editorials

Exam overview and study plan

NGFW Engineer Practice Questions

Next-Generation Firewall (NGFW) Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 72 free questions

72 questions in this view

Page 1 of 12

Question 1

An administrator wants to use User-ID to enforce Security policies based on group membership defined in a central directory. After configuring the firewall to map IP addresses to usernames, the administrator navigates to the policy editor but cannot select any directory groups as source or destination criteria.

Which foundational component must be configured on the firewall to query the directory server for group information?

Authentication Portal policy
LDAP server profile
RADIUS server profile
Certificate profile

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A firewall administrator is configuring inter-VSYS routing to allow traffic from VSYS_Sales to reach a server in VSYS_Finance on the same device.

To create the Security policy rule, which type of zone must the administrator create within each VSYS to represent the source and destination?

Virtual wire
Tunnel
External
Layer 3

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

An administrator is configuring a GlobalProtect pre-logon VPN. The administrator has already imported the necessary internal certificate authority (CA) certificates for issuing machine certificates onto the firewall.

Which configuration is required on the GlobalProtect Gateway to enable pre-logon using these machine certificates?

Create an authentication profile that points to the machine certificate's CA and assign it by using the client authentication settings of the GlobalProtect Portal.
Create a device-based Security policy that allows traffic from the pre-logon user to an internal management zone.
Create a certificate profile that trusts the machine certificate's CA and assign it within the Gateway Agent → Client Authentication settings.
Configure the Gateway Agent → Tunnel Settings to use IPSec with machine certificate authentication for the pre-logon tunnel.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

To forward packets to the HA peer during session setup and asymmetric traffic flow
To exchange hellos, heartbeats, HA state information, and management plane synchronization for routing and User-ID information
To perform session cache synchronization among all HA peers having the same cluster ID
To synchronize sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in an HA pair

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A network architect is planning the deployment of a new IPSec VPN tunnel to connect a local data center to a cloud environment. The plan must include all necessary Security policy configurations for both tunnel negotiation and data transit.

Which two Security policy requirements must be included in the implementation plan? (Choose two.)

A pair of policies is required to control the flow of data traffic into and out of the security zone assigned to the tunnel interface.
A policy must explicitly permit only the IKE application between the external-facing zone and local zone.
The default interzone-default security policy is sufficient to allow the tunnel negotiation traffic between the firewall and the remote peer.
A policy must explicitly permit the IPSec container application between the external-facing zone and local zone.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

A Panorama administrator configures a pre-rule that blocks access to all social media applications across all managed firewalls. The marketing department, which sits behind a single firewall, requires a temporary exception to this rule. The firewall's local administrator is asked to implement this exception without modifying the Panorama configuration.

Why will a local rule allowing social media applications for the marketing department fail to work?

The Panorama pre-rule is evaluated first and will block the traffic before the local exception rule is checked.
The firewall must be moved to a different device group in Panorama to have a separate policy.
A local pre-rule and application filter are required to create an exception.
Local security rules are unable to override any rules pushed from Panorama.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Page 1 of 12

Build confidence for exam day with expert-reviewed questions and realistic practice. Your next certification starts here.

Company

About Contact Our Authors FAQ

Trust and policies

Methodology Editorial policy Terms and conditions Privacy policy

Contact

ExamPrepare LLC5203 Juan Tabo Blvd STE 2BAlbuquerque, NM 87111[email protected]

© 2026 ExamPrepare LLC. All rights reserved. All certification names, exam codes and logos are the property of their respective owners. All associated trademark and copyright rights belong to those owners. ExamPrepare is not affiliated with, endorsed by, or sponsored by any certification vendor.