Revision Guide · Certified Next-Generation Firewall (NGFW) Engineer

Capstone Practice Exam

68 questions spanning all 14 modules, weighted roughly by module size (Access & Identity and VM-Series & Public Cloud carry the most questions since they're the largest modules). This is a self-assessment tool for this guide, not a copy of or substitute for the real Certified NGFW Engineer exam — use it to find which modules need another pass, not to memorize exact wording. Answer everything, click Check Answers, and you'll get both an overall score and a per-module breakdown below the questions.

~68 questions · allow 45–60 min

Practice Exam

Foundations

1. A security rule permits only the "web-browsing" application on TCP/8080. Traffic analysis shows a proprietary database-replication protocol tunneling over that same port and being correctly blocked. Which mechanism identified the mismatch between the rule's intent and the traffic's actual identity?

NAT policy rewrote the destination port before the security rule was evaluated The service object bound to the rule overrode the application match App-ID classifies traffic using signatures, protocol decoding, and heuristics regardless of the port in use Content-ID silently reassigned the session's zone

App-ID determines the actual application from payload behavior, not the port — that's why traffic on a "web" port was still correctly classified as something else.

2. An engineer enables Threat Prevention, WildFire, and URL Filtering on the same security rule and is concerned about added latency from each subscription re-inspecting the packet. Under Single-Pass Parallel Processing (SP3), what actually happens?

Each subscription re-parses the packet independently, so passes multiply with each added service The traffic is classified once, and all relevant security services act on that single classified stream in parallel Only the highest-priority subscription actually inspects the packet; the others are advisory Each subscription must be bound to a separate physical interface to avoid conflicts

SP3's core advantage is single-pass classification with services layered on that one pass, unlike chained UTM designs that re-parse per engine.

3. A customer is sizing a firewall for a link where they plan to enable decryption, App-ID, and full threat inspection on all traffic. Which two factors should most directly influence platform selection? (Choose two.)

Available dataplane CPU/throughput once decryption and content inspection are enabled, since deep inspection is CPU-intensive The number of administrator accounts that will manage the device Which content-inspection subscriptions (Threat Prevention, WildFire, etc.) are actually being enabled, since each adds processing load The color scheme configured for the web UI

Decryption and full content inspection are the most CPU-intensive operations on an NGFW — undersized dataplane hardware throttles once everything is turned on.

Traffic Classification

4. A custom internal application isn't recognized by any built-in App-ID signature. How will the firewall most likely classify its traffic by default?

It will be silently dropped regardless of policy It will inherit the App-ID of the most similar known app It will be blocked by Content-ID automatically It will show up as unknown-tcp or unknown-udp until a custom App-ID object is defined

Unrecognized traffic surfaces as unknown-tcp/udp — a common reason to build a custom App-ID object.

5. A group of users share a single IP address on a Citrix XenApp/RDP terminal server, and standard IP-to-user mapping techniques (login monitoring, WMI probes) all report the same address for every session. Which two User-ID sources are designed to correctly disambiguate individual users on a shared IP? (Choose two.)

The Terminal Server (Citrix/RDP) agent, which assigns a port range per user session on the shared host Captive Portal, which forces an explicit per-session login before mapping the source IP to a user A standard LDAP group lookup against Active Directory GlobalProtect HIP checks

The Terminal Server agent and Captive Portal both handle shared-IP disambiguation directly; LDAP lookups just resolve group membership once a user is already known, and HIP checks assess endpoint posture, not identity.

6. What does Content-ID add on top of what App-ID and User-ID already establish about a session?

It re-verifies which port the application is using It replaces the need for a security policy rulebase It inspects the stream itself for threats, sensitive data, and malicious URLs in real time It authenticates the user against Active Directory

App-ID/User-ID say what and who; Content-ID looks at what's actually inside the payload.

7. An internal application evades App-ID's signature-based classification by mimicking normal HTTP behavior over port 80. Which two App-ID mechanisms work together to eventually reclassify this kind of evasive traffic? (Choose two.)

Heuristics-based behavioral analysis of the traffic pattern Protocol decoders that keep probing for further application signatures inside the already-identified base protocol (e.g. HTTP) NAT policy re-evaluation DHCP relay

App-ID layers signatures, protocol decoding, and heuristics; when signatures alone don't catch evasive traffic, continued protocol decoding and heuristics are what eventually flag it. NAT and DHCP relay play no role in classification.

8. Content-ID's stream-based scanning is valuable primarily because:

It only scans files after they finish downloading It requires no signature updates It bypasses decryption entirely It avoids the latency penalty of buffering an entire file before inspecting it

Stream-based inspection avoids the "wait for the whole file" latency hit that full-buffering engines incur.

Encrypted Traffic

9. Which decryption mode is used for outbound user traffic, where the firewall presents a certificate signed by an internal enterprise CA?

SSL Inbound Inspection SSL Forward Proxy SSH Proxy NAT64

Forward Proxy is the man-in-the-middle mode for outbound traffic to arbitrary internet destinations.

10. Why does SSL Inbound Inspection not require re-signing traffic with a forward-trust CA, unlike Forward Proxy?

Inbound traffic is never encrypted It uses SSH keys instead of certificates The firewall holds the actual server's private key, so it can decrypt directly without impersonating anyone Clients are pre-configured to trust the firewall automatically

Inbound Inspection decrypts traffic to your own servers using their real private key — no impersonation needed.

11. An architect is defining SSL Decryption exclusions before a broad decryption rollout. Which two categories of traffic are commonly excluded from decryption because inspecting them causes practical problems? (Choose two.)

Traffic to certificate-pinned mobile apps, which break the connection when a MITM certificate is presented Traffic to regulatory-sensitive URL categories (e.g. finance, health) that are often excluded for privacy/compliance reasons Standard corporate web browsing to uncategorized general websites Telnet traffic to internal network devices

Certificate pinning and regulatory/privacy-sensitive categories are the classic decryption exclusion cases — pinned apps simply fail closed, and compliance rules often bar inspecting certain data categories at all.

12. Why should a forward-trust CA certificate ideally chain to an enterprise root CA rather than stand alone?

It's required for SSH Proxy to function It disables the need for decryption policy rules It automatically renews itself Endpoints that already trust the enterprise root will silently trust the forward-trust cert too, avoiding browser warnings

Chaining to an already-trusted root avoids having to manually distribute a standalone cert to every endpoint.

Policy & Segmentation

13. Two security policy rules could both match a session: a broad "allow any" rule near the top, and a specific deny rule further down. What happens?

Both rules apply and the stricter one wins The firewall evaluates all matching rules and logs a conflict The broad rule wins because rules are evaluated top-to-bottom, first match applies The most recently modified rule always wins

First-match-wins is why rule order matters so much — a broad rule placed too high can silently shadow specific ones below it.

14. A NAT rule performs destination NAT, translating a public IP to an internal server's private IP. Which two statements correctly describe how PAN-OS evaluates the corresponding Security Policy rule for this session? (Choose two.)

Security Policy is evaluated using the original (pre-NAT) source and destination IP addresses as sent by the client The destination zone used for Security Policy zone matching is determined by where the post-NAT address routes to, not the pre-NAT address Security Policy is evaluated using the fully post-NAT source and destination IP addresses NAT is applied before Security Policy evaluation, so only the translated addresses ever matter

PAN-OS matches Security Policy addresses against the original (pre-NAT) IPs, but the destination zone lookup is based on where the post-NAT address routes — a classic source of misconfigured DNAT rules.

15. What is DIPP (dynamic-IP-and-port) oversubscription primarily used for?

Letting one public IP serve many internal hosts by sharing the port pool Load-balancing traffic across multiple firewalls Encrypting NAT'd sessions Automatically discovering internal subnets

DIPP lets many internal hosts share a smaller pool of public IPs by multiplexing ports — but push it too hard and you exhaust the pool under load.

16. What is the default behavior for intrazone vs. interzone traffic when no explicit rule matches?

Both intrazone and interzone traffic are denied by default Both intrazone and interzone traffic are allowed by default Interzone traffic is allowed, intrazone is denied Intrazone traffic is allowed, interzone traffic is denied

Default rules allow intrazone and deny interzone — a blind spot if a zone spans multiple trust levels.

17. Which two statements accurately distinguish Zone Protection profiles from DoS Protection profiles/rules? (Choose two.)

Zone Protection is applied per ingress zone and defends broadly against flood, reconnaissance, and packet-based attacks entering that zone DoS Protection profiles/rules are typically applied to specific critical hosts or subnets via policy, offering more granular, per-destination thresholds DoS Protection requires no security policy rule; it is a per-zone setting only Zone Protection and DoS Protection cannot both be active on the same firewall at the same time

Zone Protection is broad, per-zone perimeter defense; DoS Protection is granular, rule-based protection for specific high-value destinations. Both run simultaneously as layered defense.

Firewall Fundamentals & Admin

18. An admin makes several configuration edits but hasn't clicked Commit. Which two statements correctly describe the state of the configuration at this point? (Choose two.)

The edits exist only in the candidate configuration and have zero effect on live traffic until committed Because the candidate configuration is shared, another administrator logging in at the same time would see those same uncommitted edits reflected in the candidate view, even though they aren't yet enforced All traffic is already enforced under the new configuration NAT rules take effect immediately while security rules require a commit

Candidate config is a shared working draft with zero traffic impact until Commit is run — other admins see the same pending edits, but nothing is enforced yet.

19. What does "Validate" do during the commit workflow that "Preview" does not?

Runs a syntax/semantic check with zero traffic impact, without showing a diff against running config Pushes the change live immediately Restarts the dataplane Deletes the candidate configuration

Validate checks correctness only; Preview shows you the color-coded diff; Commit is the one that goes live.

20. A custom Role Based admin profile was scoped last year. PAN-OS has since added a new feature area. What happens to that admin's access to the new feature?

It's automatically granted, matching Dynamic role behavior The firewall emails the admin a warning The feature is disabled globally until profiles are updated The admin does NOT automatically get access — custom Role Based profiles don't auto-inherit new features

Unlike Dynamic roles, custom Role Based profiles need manual maintenance as new features ship.

21. Which two characteristics make Virtual Wire interface mode a good fit for inserting a firewall into an existing network with zero re-addressing, such as for a migration or POC? (Choose two.)

The two bound interfaces act as a transparent Layer 1/2 bump-in-the-wire, requiring no IP address changes on either side It still allows full Layer 7 App-ID, Content-ID, and User-ID inspection despite having no routed IP interface of its own It automatically load-balances traffic across multiple physical links It requires the firewall to participate in OSPF or BGP with adjacent routers

Virtual Wire is transparent at Layer 1/2 — no re-addressing or routing changes — while still delivering full NGFW Layer 7 inspection, unlike a passive Tap interface.

22. Why can't a Virtual System administrator role configure interfaces, VLANs, or virtual routers?

Those objects don't exist on multi-vsys firewalls It's a licensing restriction Those are shared network objects, outside the scope of any single virtual system Only Superuser accounts can log in at all

Shared network resources sit above individual vsys scope — a common "why can't I configure this" ticket.

Threat & Content Services

23. What does Advanced Threat Prevention add specifically on top of standard Threat Prevention?

An inline, cloud-based deep-learning engine for evasive/unknown C2 traffic Antivirus signatures Basic vulnerability protection (IPS) DNS sinkholing

Advanced Threat Prevention's differentiator is the inline ML/deep-learning engine aimed at evasive, signature-resistant C2.

24. A brand-new, never-before-seen executable crosses the firewall. Which two techniques does WildFire use to determine whether it's malicious? (Choose two.)

Detonating the file in a cloud-based sandbox and observing its dynamic runtime behavior Static analysis of the file's structure and code characteristics alongside detonation Comparing its hash only against a static, pre-existing blocklist Ignoring it automatically because it has no existing signature

WildFire combines static analysis with dynamic sandbox detonation to judge genuinely new files — it doesn't rely purely on hash blocklists or skip unknowns.

25. What does Advanced WildFire's Intelligent Run-time Memory Analysis specifically target?

Static file signatures Highly evasive malware that detects and hides from standard sandboxing DNS-based command and control only URL category classification

Memory analysis is specifically built to catch sandbox-aware malware that behaves differently under detonation.

26. What does Advanced URL Filtering add beyond the base URL Filtering (PAN-DB category) subscription?

Category-based access control SafeSearch enforcement Credential submission logging A cloud-based ML engine inspecting pages in real time, catching newly-created phishing/exploit pages a crawled database hasn't seen yet

Advanced URL Filtering's edge is real-time ML inspection versus relying solely on a pre-categorized database.

27. What license is a prerequisite for DNS Security?

Threat Prevention GlobalProtect SD-WAN No license is required

DNS Security requires a Threat Prevention license as its base.

28. Which two reasons explain why decryption is a practical prerequisite for most of Content-ID's threat-facing services (Threat Prevention, WildFire, URL Filtering) to be fully effective? (Choose two.)

The large majority of traffic today is encrypted (HTTPS/TLS), so payload contents are invisible to inspection engines without decryption Threat Prevention, WildFire, and URL Filtering all need visibility into the actual stream/file contents to apply signatures, sandboxing, and category checks Decryption is only required to support DNS Security specifically Content-ID can fully inspect TLS-encrypted payloads without decrypting them first

"You can't block what you don't inspect" — encrypted payloads hide from every content-inspection engine until decryption restores visibility.

AI-Powered Security

29. What is the primary purpose of the Discovery stage in Prisma AIRS / AI Runtime Security?

Actively blocking malicious prompts in real time Passively identifying AI apps, models, and data flows already in use across the environment Deploying new LLM infrastructure Rotating API keys for AI services

Discovery is about visibility first — finding shadow-AI usage before you can secure it.

30. Which Prisma AIRS stage is responsible for actively inspecting and blocking malicious prompts, responses, and agent actions in real time?

Defend Discovery Deploy Overview only, no active component exists

Defend is the active runtime protection layer — prompts, responses, and agent actions all get inspected there.

31. Which two AI/LLM-specific risks does Prisma AIRS address that conventional network-layer Threat Prevention/IPS signatures are not designed to catch? (Choose two.)

Prompt injection attacks that manipulate a model's behavior through crafted input text Sensitive data leakage embedded in a model's generated output/response Classic buffer-overflow exploits against unpatched network services Standard volumetric DDoS floods against a web server

Prompt injection and output-based data leakage are risks specific to how LLMs process and generate content — not the packet/exploit patterns traditional IPS signatures target.

32. What must an organization typically decide during the Deploy stage of AI Runtime Security?

Which enforcement mode and integration points (API, gateway, SDK) fit each AI application discovered earlier Whether to disable Discovery entirely Which Panorama template stack to use for HA Which NAT rule to apply to LLM API traffic

Deploy is about choosing how protection gets inserted into each AI app's specific architecture, based on what Discovery found.

Access & Identity

33. What is the primary purpose of GlobalProtect in the context of User-ID?

It replaces the need for Security Policy entirely It provides both remote-access VPN connectivity and a reliable identity source, since users authenticate to connect It only works for site-to-site tunnels It is exclusively a certificate management tool

GlobalProtect is both a remote-access VPN and a strong User-ID source, since the user must authenticate to connect.

34. What's the difference between an Authentication Profile and an Authentication Sequence?

A Sequence is only for admin accounts, a Profile is only for end users A Profile requires MFA, a Sequence never does There is no difference, they're interchangeable terms A Profile defines one authentication method/server; a Sequence tries multiple Profiles in order until one succeeds

Sequences chain multiple Profiles together, trying each in turn — useful when users might live in different backends.

35. Which factor category does Multi-Factor Authentication add beyond username/password on the firewall?

An additional verification factor, such as a push notification, OTP, or hardware token, tied to an MFA vendor integration A second username/password pair A mandatory certificate installed on every client A CAPTCHA challenge

MFA layers in a genuinely separate factor (something you have/are), not just another knowledge-based credential.

36. How does Credential Phishing Prevention typically restrict where corporate credentials can be submitted?

It blocks all HTTPS traffic by default It only works with GlobalProtect connected It detects credential submissions and restricts which URL categories are allowed to receive them It requires disabling SSL decryption

It's enforced at the URL-category level — corporate creds are blocked from going to categories like newly-registered or high-risk sites.

37. Which two roles does the Cloud Identity Engine play for organizations with both on-prem AD and cloud directories like Azure AD/Okta? (Choose two.)

It syncs and centralizes identity data from multiple sources into a unified identity store consumable by firewalls and Prisma Access It can coexist with and complement on-prem AD/LDAP rather than requiring their replacement It is a mandatory physical appliance required at every branch office It functions solely as a certificate revocation checker

Cloud Identity Engine unifies identity from multiple sources and is designed to coexist with — not replace — existing on-prem AD/LDAP.

38. What does SCIM provisioning automate in this context?

Firewall software upgrades IPSec tunnel rekeying WildFire signature distribution User/group lifecycle sync (create, update, deactivate) from an identity provider into the platform automatically

SCIM is specifically about automated user/group provisioning and deprovisioning from an IdP.

39. In a large multi-vsys or multi-firewall environment, which two reasons explain why User-ID Redistribution is needed? (Choose two.)

So IP-to-user mappings learned by one firewall with direct access to an identity source can be propagated to other firewalls that lack that direct access So every enforcement point in a distributed deployment can apply consistent, up-to-date user-based policy without each needing its own direct agent/LDAP connection To permanently disable User-ID on all firewalls except the central one To convert dynamic user groups into static address objects

Redistribution's purpose is propagating identity mappings across firewalls that don't all have direct identity-source connectivity, keeping policy enforcement consistent fleet-wide.

40. When implementing User-ID in policy, which two of the following can the Source User field match against? (Choose two.)

Individual usernames resolved via User-ID mapping, or static AD/LDAP groups Dynamic User Groups (DUGs) driven by tag-based membership Only raw IP addresses with no identity context Only MAC addresses

Source User can match individual users and group constructs, including tag-driven Dynamic User Groups — it's identity-based, not limited to IP or MAC matching.

VPN & Connectivity

41. In an IKE/IPSec site-to-site VPN, what do Proxy IDs primarily define?

The pre-shared key rotation schedule The interesting traffic (local/remote subnets) that the tunnel is allowed to carry The physical interface speed The DNS servers pushed to remote clients

Proxy IDs (or traffic selectors) define which subnet pairs are considered "interesting traffic" for that particular SA.

42. Which two factors make manually configuring many individual site-to-site IPSec tunnels a poor fit for branch-heavy deployments? (Choose two.)

Per-tunnel configuration and maintenance overhead (proxy IDs, PSKs/certs, routing) grows roughly linearly with every new branch added Adding, removing, or re-keying tunnels at scale becomes an operationally heavy, error-prone manual process without hub-and-spoke automation IPSec hard-caps every firewall at exactly two tunnels regardless of platform Each additional tunnel requires its own dedicated physical WAN interface

The scaling pain is operational — linear config overhead and manual tunnel lifecycle management — which is exactly what GlobalProtect LSVPN-style hub-and-spoke automation solves.

43. What risk does Quantum-Ready VPN specifically aim to mitigate?

DDoS attacks against the VPN gateway Misconfigured proxy IDs "Harvest now, decrypt later" attacks, where encrypted traffic captured today could be decrypted once quantum computing breaks current cryptography Certificate expiration

Quantum-Ready VPN is about hardening key exchange against future quantum-capable decryption of data captured now.

Software Firewalls: Containers & Kubernetes

44. What networking characteristic of Kubernetes makes traditional perimeter-only firewalls insufficient for east-west traffic inside a cluster?

Kubernetes doesn't use IP addressing Pods communicate directly with each other inside the cluster, often bypassing any north-south perimeter device entirely Kubernetes clusters never span more than one host Kubernetes traffic is always pre-encrypted end-to-end

Pod-to-pod east-west traffic often never crosses a perimeter firewall, which is exactly the gap CN-Series fills.

45. Which two things does CN-Series bring into a Kubernetes cluster that differentiate it from relying on native Kubernetes network policies alone? (Choose two.)

The same App-ID/User-ID/Content-ID policy model used on physical and VM-Series firewalls, applied to pod-to-pod traffic Layer 7 threat inspection (e.g. Threat Prevention, WildFire) of east-west container traffic, which native Kubernetes NetworkPolicy objects don't provide Complete replacement of kube-proxy's Layer 3/4 service routing function Elimination of the need for any Kubernetes network policies going forward

CN-Series adds genuine Layer 7 NGFW inspection and the familiar App-ID/Content-ID model to east-west traffic — capabilities native L3/L4 NetworkPolicy objects don't provide — without replacing core Kubernetes networking components.

46. In CN-Series architecture, what two main components typically work together to enforce policy?

Panorama and GlobalProtect only WildFire and DNS Security only A management plane component and dataplane firewall pods/containers deployed alongside the workloads A single monolithic VM outside the cluster

CN-Series splits management and dataplane responsibilities, with dataplane components running close to the workloads they protect.

47. What does CN-Series deployment tie together from the earlier architecture discussion?

Only the licensing model Only the Panorama console UI Only DNS Security integration The architecture pieces (management/dataplane components) into an actual working cluster deployment

Deployment is where the architectural pieces come together operationally inside a real Kubernetes cluster.

Software Firewalls: VM-Series & Public Cloud

48. In a hub-and-spoke cloud network security design, why route spoke VPC/VNet traffic through a central security VPC/VNet?

To centralize inspection and policy enforcement for all spokes through one consistent NGFW layer To reduce the number of subnets required per spoke Because spokes cannot have their own route tables To eliminate the need for security groups

Hub-and-spoke centralizes inspection so every spoke's traffic passes through one consistently policed choke point.

49. Which two factors primarily determine VM-Series instance sizing and licensing requirements in a public cloud deployment? (Choose two.)

Expected throughput and session-count requirements for the workloads being protected Which content-inspection subscriptions (Threat Prevention, WildFire, etc.) are enabled, since each adds dataplane load The cloud provider's default VM size, regardless of workload The specific region the VM is deployed in, independent of any other factor

Same logic as physical appliances — throughput/session load and which subscriptions are enabled drive both sizing and licensing in the cloud.

50. What's a common VM-Series traffic flow design for inbound internet-facing workloads in the cloud?

Bypassing the firewall entirely for inbound traffic Routing inbound traffic through the VM-Series via a load balancer before it reaches backend workloads Only inspecting outbound traffic, never inbound Deploying VM-Series only in a separate, disconnected cloud account

Inbound designs typically front the VM-Series with a load balancer so traffic is inspected before it reaches the actual workloads.

51. Which two capabilities does AWS Gateway Load Balancer (GWLB) integration with VM-Series provide? (Choose two.)

Transparent insertion of a scalable, auto-scaling fleet of VM-Series firewalls into the traffic path using GENEVE encapsulation Avoiding complex per-VPC routing changes to insert inspection, compared to manually chaining route tables Automatic elimination of the need for any VM-Series licensing Built-in encryption of all inter-VPC traffic regardless of firewall policy

GWLB's value is transparent, auto-scaling insertion via GENEVE without per-VPC route surgery — it doesn't touch licensing or provide its own encryption layer.

52. What is the Azure equivalent design pattern to AWS Gateway Load Balancer for inserting VM-Series transparently?

Azure Gateway Load Balancer Azure Front Door only Azure DNS zones Azure Bastion

Azure GWLB serves the same transparent-insertion role in Azure that AWS GWLB serves in AWS.

53. On GCP, what capability does Google Cloud Intrusion Detection provide relative to VM-Series?

It replaces VM-Series entirely with a native GCP-only engine It only detects DDoS attacks It's a managed mirroring-based IDS offering built on Palo Alto threat detection technology, usable alongside or instead of a full inline VM-Series deployment It requires no GCP networking configuration at all

Cloud IDS on GCP is a managed, mirror-based detection service built on Palo Alto's threat engine, distinct from a full inline VM-Series deployment.

54. What use case does VM-Series on NSX-T primarily address?

Public cloud-only workloads with no on-prem presence Inserting NGFW-grade inspection into VMware NSX-T software-defined datacenter environments Kubernetes-only environments Replacing NSX-T's own micro-segmentation entirely

VM-Series on NSX-T extends NGFW inspection into VMware's software-defined networking fabric, typically alongside NSX-T's native segmentation.

55. Which two benefits come from deploying VM-Series consistently across AWS, Azure, GCP, and on-prem/NSX-T rather than mixing different vendors' firewalls per environment? (Choose two.)

A single, consistent NGFW policy model (App-ID/User-ID/Content-ID) that behaves the same way regardless of the underlying cloud Centralized management and visibility across every environment, typically through Panorama Automatically free licensing above a certain deployment scale Removal of the need for any cloud-native security tooling

The value is consistent policy semantics plus centralized management across heterogeneous environments — not free licensing or eliminating native cloud tooling.

Resilience & Scale

56. In an active/passive HA pair, what state does NOT automatically sync between the two firewalls?

Configuration Most session table state Decrypted SSL/TLS session state Runtime routing tables via the HA link

Decrypted session state is the well-known exception that doesn't sync — failover drops and re-establishes those sessions.

57. Which two capabilities does NGFW Clustering provide beyond what a standard two-node active/passive HA pair offers? (Choose two.)

Horizontal scale-out across more than two nodes, sharing session load rather than just providing failover The ability to add cluster capacity by adding nodes, rather than being capped at a single pair A cheaper licensing model that eliminates the need to license each node Automatic decryption of all HA-synced sessions with zero session loss on failover

Clustering's differentiator is genuine multi-node horizontal scale-out and elastic capacity, not licensing changes or solving the decrypted-session-sync limitation.

58. What is the primary use case for Virtual Systems (vsys) on a single physical firewall?

Encrypting traffic between two datacenters Logically partitioning one firewall into multiple independent administrative/policy domains (e.g. for MSSPs or business units) Increasing raw throughput beyond hardware limits Automatically load-balancing across cloud regions

Vsys is about multi-tenancy — carving one box into isolated logical firewalls, common for MSSPs and shared-tenant environments.

59. Which shared network resources can a Virtual System administrator NOT configure, per the platform's RBAC model?

Security policy rules within their vsys NAT rules within their vsys Objects scoped to their vsys Interfaces, VLANs, virtual routers, and other shared network-level objects

Shared network objects live above any single vsys's scope, regardless of that vsys admin's role.

Management & Ops

60. What is Panorama's core role in a multi-firewall deployment?

Centralized configuration, policy management, and log aggregation across a fleet of firewalls Replacing the need for individual firewall licenses Performing decryption on behalf of managed firewalls Acting as a DNS resolver for managed devices only

Panorama centralizes management and visibility, not inspection itself — the firewalls still do the actual traffic processing.

61. Which two reasons commonly justify forwarding firewall logs to an external SIEM in addition to keeping them in Panorama/Strata Logging Service? (Choose two.)

Integrating firewall telemetry into broader SOC tooling, correlation rules, and incident-response workflows that live outside the Palo Alto ecosystem Meeting long-term retention or compliance requirements that the org's SIEM already handles across all its data sources Panorama is fundamentally incapable of storing any logs Log Forwarding disables local logging on the firewall once enabled

SIEM forwarding is about cross-tool correlation and org-wide retention/compliance — not a workaround for a logging limitation in Panorama.

62. What does Strata Logging Service provide that changes the traditional on-prem log-collector model?

It removes the need for any logging license Cloud-based, scalable log storage and retention that firewalls, Panorama, and CN-Series can forward to once licensed It only stores decryption keys It replaces WildFire entirely

Strata Logging Service moves log storage/retention to the cloud, decoupling it from on-prem log collector sizing.

63. When reading a Traffic log entry, what does the Action field combined with the Session End Reason together tell you?

Only the source zone Only the App-ID assigned to the session Nothing useful for troubleshooting Whether the session was allowed/denied and why it actually terminated (e.g. policy deny, threat, tcp-rst-from-client, aged-out)

Action plus Session End Reason together are core to diagnosing why a session behaved the way it did.

64. Which two categories of data does Device Telemetry upload to Palo Alto Networks by design? (Choose two.)

Product usage and device health statistics Threat-related data that feeds back into Palo Alto's threat intelligence and ML detection models (e.g. WildFire, Advanced Threat Prevention) Full packet captures of all customer traffic by default Administrator passwords, for backup purposes

Telemetry is usage/health/threat data feeding Palo Alto's ML pipeline — not raw customer packet captures or credentials.

65. What does Platform Security / Intelligent Malware Analysis (IMA) primarily add to the platform's own operational security?

User-facing MFA prompts DNS Security signatures Continuous integrity/behavior monitoring of the platform itself to detect tampering or compromise of the device Site-to-site VPN key rotation

Platform Security/IMA is about protecting and monitoring the firewall device itself, not the traffic passing through it.

Licensing & Summary

66. Which two capabilities ship on every NGFW at no additional subscription cost, unlike Advanced Threat Prevention, Advanced WildFire, or Advanced URL Filtering? (Choose two.)

App-ID application classification Basic Zone Protection / DoS Protection defenses Advanced WildFire cloud sandbox detonation Advanced URL Filtering's real-time ML inline inspection

App-ID and basic Zone/DoS Protection are built into every NGFW; the "Advanced" subscription tiers (WildFire, URL Filtering, Threat Prevention) are separately licensed.

67. A customer wants inline ML-based catching of brand-new phishing pages, not just PAN-DB category blocking. Which subscription do they need?

DNS Security only Basic URL Filtering (standalone) is sufficient GlobalProtect Advanced URL Filtering

Real-time ML inspection of new/unknown pages is specifically an Advanced URL Filtering capability; base URL Filtering isn't sold standalone anymore.

68. What is the single biggest recurring trade-off called out across this entire guide's pros/cons summaries?

NGFWs cannot be centrally managed App-ID requires a separate license from every other feature Deeper inspection (decryption, threat scanning, ML analysis) consistently costs CPU/dataplane resources and often requires additional paid subscriptions NGFWs cannot be deployed in the cloud

The recurring theme across nearly every module: more visibility and protection depth costs both compute and subscription budget.