Certification Exam Prep · Palo Alto Networks

Palo Alto Next-Gen Firewall Engineer Practice Exam

Practicing with updated exam questions ensures you’re ready for both knowledge-based and hands-on challenges across all official exam domains.

66 scenario-based questions · 90 min time limit

Why Focus on Palo Alto Next-Gen Firewall Engineer Exam Questions?

The exam is not just about theory. It includes scenario-based questions that test your ability to configure firewalls, troubleshoot networking issues, and integrate automation tools. Practicing with updated exam questions ensures you’re ready for both knowledge-based and hands-on challenges.

Palo Alto NGFW Engineer Exam Details

Format	Multiple-choice & scenario-based
Number of Questions	~75 (66 in this strict blueprint mock)
Time Limit	90 minutes
Passing Score	Around 70% (860 on a 300–1000 scale)
Cost	$250 USD
Language	English
Delivery	Pearson VUE (online proctored or test center)

Key Domains Covered in the Exam

The Palo Alto Next-Gen Firewall (NGFW) Exam Questions 2026 are divided into three domains:

1. PAN-OS Networking Configuration (38%)

Interfaces (Layer 2, Layer 3, Virtual Wire, Tunnel, Aggregate Ethernet)
Security zones, routing, and HA (High Availability: Active/Passive & Active/Active) setup
VPNs: IPSec, GRE, and GlobalProtect

2. PAN-OS Device Setting Configuration (38%)

Authentication profiles, PKI, decryption policies
Logging and monitoring with Strata Logging Service
Virtual systems (VSYS) and certificate management

3. Integration & Automation (24%)

Panorama management (templates, device groups, pre/post rules)
APIs, Terraform, and Ansible automation
Deployments across PA-Series, VM-Series, CN-Series, and Cloud NGFW

How to Prepare with Palo Alto NGFW Exam Questions

Use Practice Tests – Take full-length mock exams to get familiar with the structure and timing.
Hands-On Labs – Configure firewalls in a test environment (VM-Series is ideal for practice).
Official Training – Enroll in Palo Alto’s “Firewall Essentials: Configuration and Management (EDU-210).”
Community Resources – Join forums like Palo Alto Live Community or Reddit for peer discussions.
Review Exam Questions Regularly – Repetition helps reinforce key concepts and troubleshooting steps.

Benefits of Passing the NGFW Engineer Exam

Recognized globally as a specialist-level Palo Alto certification
Demonstrates expertise in firewall deployment, operations, and automation
Boosts career opportunities as a firewall engineer, security administrator, or cloud security specialist

Final Thoughts

Practicing with Palo Alto Next-Generation Firewall Engineer exam questions is the most effective way to prepare for this certification. By combining hands-on experience, official training, and updated mock tests, you can confidently approach the exam and earn this valuable credential.

Useful Resources & Exam Links:
• Check out other Palo Alto Certifications here: Skillcertpro Palo Alto Certifications
• Know more about the exam here: Official Palo Alto NGFW Engineer Guide

Practice Exam Questions

Domain 1: PAN-OS Networking Configuration (38%)

Covers interfaces (L2, L3, Virtual Wire, Tunnel, Aggregate Ethernet), security zones, dynamic routing, High Availability (Active/Passive & Active/Active), IPSec, GRE, and GlobalProtect VPNs.

1. A NAT rule performs destination NAT, translating a public IP to an internal server's private IP. Which two statements correctly describe how PAN-OS evaluates the corresponding Security Policy rule for this session? (Choose two.)

Security Policy is evaluated using the original (pre-NAT) source and destination IP addresses as sent by the client The destination zone used for Security Policy zone matching is determined by where the post-NAT address routes to, not the pre-NAT address Security Policy is evaluated using the fully post-NAT source and destination IP addresses, matching what the server sees NAT is applied before Security Policy evaluation, so only the translated addresses ever matter

PAN-OS matches Security Policy addresses against the original (pre-NAT) IPs, but the destination zone lookup is based on where the post-NAT address routes — a classic source of misconfigured DNAT rules.

2. What is DIPP (dynamic-IP-and-port) oversubscription primarily used for?

Letting one public IP serve many internal hosts by sharing the port pool Load-balancing translated sessions evenly across multiple firewalls in a cluster Encrypting NAT'd sessions before they leave the oversubscribed public IP Automatically discovering internal subnets that need address translation applied

DIPP lets many internal hosts share a smaller pool of public IPs by multiplexing ports — but push it too hard and you exhaust the pool under load.

3. What is the default behavior for intrazone vs. interzone traffic when no explicit rule matches?

Both intrazone and interzone traffic are denied by default Both intrazone and interzone traffic are allowed by default Interzone traffic is allowed, intrazone is denied Intrazone traffic is allowed, interzone traffic is denied

Default rules allow intrazone and deny interzone — a blind spot if a zone spans multiple trust levels.

4. Which two statements accurately distinguish Zone Protection profiles from DoS Protection profiles/rules? (Choose two.)

Zone Protection is applied per ingress zone and defends broadly against flood, reconnaissance, and packet-based attacks entering that zone DoS Protection profiles/rules are typically applied to specific critical hosts or subnets via policy, offering more granular, per-destination thresholds DoS Protection requires no security policy rule; it is a per-zone setting only Zone Protection and DoS Protection cannot both be active on the same firewall at the same time

Zone Protection is broad, per-zone perimeter defense; DoS Protection is granular, rule-based protection for specific high-value destinations. Both run simultaneously as layered defense.

5. Which two characteristics make Virtual Wire interface mode a good fit for inserting a firewall into an existing network with zero re-addressing, such as for a migration or POC? (Choose two.)

The two bound interfaces act as a transparent Layer 1/2 bump-in-the-wire, requiring no IP address changes on either side It still allows full Layer 7 App-ID, Content-ID, and User-ID inspection despite having no routed IP interface of its own It automatically load-balances traffic across multiple physical links without any manual link configuration It requires the firewall to participate in OSPF or BGP with adjacent routers on both sides

Virtual Wire is transparent at Layer 1/2 — no re-addressing or routing changes — while still delivering full NGFW Layer 7 inspection, unlike a passive Tap interface.

6. In an IKE/IPSec site-to-site VPN, what do Proxy IDs primarily define?

The pre-shared key rotation schedule negotiated during IKE phase 1 The interesting traffic (local/remote subnets) that the tunnel is allowed to carry The physical interface speed the tunnel endpoint negotiates The DNS servers pushed to remote clients connecting over the tunnel

Proxy IDs (or traffic selectors) define which subnet pairs are considered "interesting traffic" for that particular SA.

7. Which two factors make manually configuring many individual site-to-site IPSec tunnels a poor fit for branch-heavy deployments? (Choose two.)

Per-tunnel configuration and maintenance overhead (proxy IDs, PSKs/certs, routing) grows roughly linearly with every new branch added Adding, removing, or re-keying tunnels at scale becomes an operationally heavy, error-prone manual process without hub-and-spoke automation IPSec hard-caps every firewall at exactly two tunnels regardless of platform Each additional tunnel requires its own dedicated physical WAN interface

The scaling pain is operational — linear config overhead and manual tunnel lifecycle management — which is exactly what GlobalProtect LSVPN-style hub-and-spoke automation solves.

8. What risk does Quantum-Ready VPN specifically aim to mitigate?

DDoS attacks that flood the VPN gateway's key-exchange process Misconfigured proxy IDs that silently drop legitimate tunnel traffic "Harvest now, decrypt later" attacks, where encrypted traffic captured today could be decrypted once quantum computing breaks current cryptography Certificate expiration causing an unexpected tunnel outage

Quantum-Ready VPN is about hardening key exchange against future quantum-capable decryption of data captured now.

9. In an active/passive HA pair, what state does NOT automatically sync between the two firewalls?

Configuration Most session table state Decrypted SSL/TLS session state Runtime routing tables via the HA link

Decrypted session state is the well-known exception that doesn't sync — failover drops and re-establishes those sessions.

10. An administrator enables Packet Buffer Protection on the Untrust zone profile, but during a flood attack, early drops never trigger. What is the cause?

Packet Buffer Protection is only supported on internal zones. Virtual Wire mode does not support queue monitoring. Packet Buffer Protection must also be enabled globally under Device > Setup > Session. A separate profile must be bound directly to the physical interface.

Packet Buffer Protection and Layer 3/4 Header Inspection must be enabled BOTH globally (Device > Setup > Session) and inside the specific Zone profile.

11. Which statement correctly describes how interfaces can be mapped to security zones?

An interface can belong to multiple zones if they are all Layer 3. Multiple interfaces can belong to the same zone, but an interface can belong to only one zone. Each zone can contain only a single physical interface. Interfaces mapped to Virtual Routers do not require zone assignments.

Multiple interfaces (e.g. ISP-A and ISP-B) can share a zone, but an interface can only belong to one zone at a time.

12. What is the maximum number of Aggregate Ethernet (AE) groups supported on a PA-440 platform?

2 4 8 16

The PA-440 supports up to 4 Aggregate Ethernet groups (AE1 to AE4).

13. How should an admin prevent a daily Nessus vulnerability scanner from triggering Host Sweep Reconnaissance blocks?

Disable Reconnaissance Protection on the zone. Add the Nessus scanner IP to the Source Address Exclusion list in the profile. Create a Security Policy rule allowing the scanner. Enable Packet Buffer Protection globally.

Add the authorized scanner IP to the Source Address Exclusion list inside the Reconnaissance Protection profile.

14. An active/passive HA pair fails over, but all active user TCP sessions immediately disconnect. What was missing?

Preemption was disabled. The HA2 session synchronization link was not configured. Active/Active mode was required. A separate HA license was missing.

HA2 synchronizes active TCP/UDP session tables. Without HA2, the passive firewall takes over with an empty session table, dropping existing flows.

15. Does Active/Active HA double overall firewall throughput?

Yes, because both data planes process packets simultaneously. No, average throughput is slightly lower due to HA3 packet forwarding and session sync overhead. Yes, but only for UDP traffic. Yes, but only in Virtual Wire mode.

Active/Active HA introduces synchronization and packet-forwarding overhead over HA3, resulting in slightly lower average throughput than Active/Passive.

16. How does an HA pair prevent split-brain when the primary HA1 control link fails?

Both firewalls suspend themselves. The passive firewall takes over immediately without checking. The passive firewall sends backup heartbeat messages over the management network. Traffic is automatically routed to a third standby box.

Management network backup heartbeats allow the passive peer to verify whether the active unit is still alive before taking over blindly.

17. In Active/Active HA, which setting determines which firewall performs security inspection for a flow based on receiving the initial packet?

Session Owner: First Packet Session Owner: Primary Device Session Setup: IP Modulo Session Setup: Hash

Session Owner: First Packet designates the firewall receiving the first packet as the owner of Layer 7 security inspection.

18. What primary structural change occurs when switching to the Advanced Routing Engine (ARE)?

Virtual Routers are replaced by Logical Routers, and settings move into Profiles. Dynamic routing protocols are disabled. Interfaces inherit management interface default routes. BGP is managed strictly via CLI.

ARE replaces Virtual Routers with Logical Routers and decouples settings (Auth, BFD, timers) into reusable Profiles.

19. How can an admin monitor an upstream public IP (e.g. 8.8.8.8) to remove a primary static default route if internet reachability drops?

BFD Path Monitoring on the static route Redistribution Profiles Link Monitoring with AND logic

Path Monitoring pings destination IPs to verify upstream path reachability for static routes. BFD requires a cooperative neighbor router.

20. What configuration object is required to advertise BGP-learned routes into OSPF?

OSPF Area Profile Redistribution Profile bound to OSPF Export rules BFD Profile Administrative Distance override

A Redistribution Profile defines the source protocol (BGP) and filters, and must be bound to the export rules of the target protocol (OSPF).

21. Why does a GlobalProtect Gateway commit fail when IP pools are configured globally AND in Client Settings?

Global Gateway IP pools and Agent Client Setting IP pools are mutually exclusive. Dual-stack IPv6 is required. The IP pool must match the management subnet. Tunnel mode requires a paid license.

PAN-OS enforces mutual exclusivity: IP pools can be defined globally OR in Client Settings, but configuring both causes a commit error.

22. Which GlobalProtect split tunneling feature strips YouTube video streams from the VPN tunnel using payload signatures?

Domain Exclusion List Video Traffic Exclusion (using App-ID) Clientless VPN Proxy HIP Notification Balloon

Video Traffic Exclusion under Gateway split tunneling leverages App-ID signatures to identify and bypass video streaming traffic.

Domain 2: PAN-OS Device Setting Configuration (38%)

Covers authentication profiles, PKI, decryption policies & modes, logging & Strata Logging Service, Virtual Systems (VSYS), software updates, User-ID & Cloud Identity Engine, and Web Proxy.

23. A group of users share a single IP address on a Citrix XenApp/RDP terminal server, and standard IP-to-user mapping techniques (login monitoring, WMI probes) all report the same address for every session. Which two User-ID sources are designed to correctly disambiguate individual users on a shared IP? (Choose two.)

The Terminal Server (Citrix/RDP) agent, which assigns a port range per user session on the shared host Captive Portal, which forces an explicit per-session login before mapping the source IP to a user A standard LDAP group lookup against Active Directory, which resolves a known username to its group memberships GlobalProtect HIP checks, which evaluate the posture of the endpoint tied to the already-mapped IP address

The Terminal Server agent and Captive Portal both handle shared-IP disambiguation directly; LDAP lookups just resolve group membership once a user is already known, and HIP checks assess endpoint posture, not identity.

24. Which decryption mode is used for outbound user traffic, where the firewall presents a certificate signed by an internal enterprise CA?

SSL Inbound Inspection SSL Forward Proxy SSH Proxy NAT64

Forward Proxy is the man-in-the-middle mode for outbound traffic to arbitrary internet destinations.

25. Why does SSL Inbound Inspection not require re-signing traffic with a forward-trust CA, unlike Forward Proxy?

Inbound traffic is never encrypted, so there is nothing for the firewall to decrypt in the first place It uses SSH keys instead of certificates, since the session is negotiated over an SSH-wrapped channel The firewall holds the actual server's private key, so it can decrypt directly without impersonating anyone Clients are pre-configured to trust the firewall automatically, skipping the certificate validation step entirely

Inbound Inspection decrypts traffic to your own servers using their real private key — no impersonation needed.

26. An architect is defining SSL Decryption exclusions before a broad decryption rollout. Which two categories of traffic are commonly excluded from decryption because inspecting them causes practical problems? (Choose two.)

Traffic to certificate-pinned mobile apps, which break the connection when a MITM certificate is presented Traffic to regulatory-sensitive URL categories (e.g. finance, health) that are often excluded for privacy/compliance reasons Standard corporate web browsing to uncategorized general websites, since those sites change category too often to track Telnet traffic to internal network devices, since Telnet's cleartext protocol is incompatible with SSL decryption engines

Certificate pinning and regulatory/privacy-sensitive categories are the classic decryption exclusion cases — pinned apps simply fail closed, and compliance rules often bar inspecting certain data categories at all.

27. Why should a forward-trust CA certificate ideally chain to an enterprise root CA rather than stand alone?

It's required for SSH Proxy to function, since SSH Proxy validates against the same trust chain It disables the need for decryption policy rules, since chained certs are trusted implicitly It automatically renews itself once it is chained to a root CA, avoiding manual reissuance Endpoints that already trust the enterprise root will silently trust the forward-trust cert too, avoiding browser warnings

Chaining to an already-trusted root avoids having to manually distribute a standalone cert to every endpoint.

28. An admin makes several configuration edits but hasn't clicked Commit. Which two statements correctly describe the state of the configuration at this point? (Choose two.)

The edits exist only in the candidate configuration and have zero effect on live traffic until committed Because the candidate configuration is shared, another admin logging in would see the same uncommitted edits, though nothing is enforced yet All traffic is already enforced under the new configuration, since candidate edits apply live as they're typed NAT rules take effect immediately while security rules require a separate commit step to activate

Candidate config is a shared working draft with zero traffic impact until Commit is run — other admins see the same pending edits, but nothing is enforced yet.

29. What does "Validate" do during the commit workflow that "Preview" does not?

Runs a syntax/semantic check with zero traffic impact, without showing a diff against running config Pushes the change live immediately, skipping the syntax/semantic check entirely Restarts the dataplane so the new configuration can be loaded cleanly Deletes the candidate configuration and reverts to the last running config

Validate checks correctness only; Preview shows you the color-coded diff; Commit is the one that goes live.

30. A custom Role Based admin profile was scoped last year. PAN-OS has since added a new feature area. What happens to that admin's access to the new feature?

It's automatically granted, since custom Role Based profiles inherit new features the same way Dynamic roles do The firewall emails the admin a warning that their profile needs to be updated for the new feature The feature is disabled globally for every admin until all Role Based profiles are manually updated The admin does NOT automatically get access — custom Role Based profiles don't auto-inherit new features

Unlike Dynamic roles, custom Role Based profiles need manual maintenance as new features ship.

31. Why can't a Virtual System administrator role configure interfaces, VLANs, or virtual routers?

Those objects don't exist on multi-vsys firewalls It's a licensing restriction tied to the multi-vsys feature license Those are shared network objects, outside the scope of any single virtual system Only Superuser accounts can log in at all on a multi-vsys firewall

Shared network resources sit above individual vsys scope — a common "why can't I configure this" ticket.

32. What is the primary purpose of GlobalProtect in the context of User-ID?

It replaces the need for Security Policy entirely once users are authenticated to it It provides both remote-access VPN connectivity and a reliable identity source, since users authenticate to connect It only works for site-to-site tunnels between fixed gateway endpoints It is exclusively a certificate management tool for issuing client certs

GlobalProtect is both a remote-access VPN and a strong User-ID source, since the user must authenticate to connect.

33. What's the difference between an Authentication Profile and an Authentication Sequence?

A Sequence is only for admin accounts, a Profile is only for end users A Profile always requires MFA, while a Sequence never enforces a second factor There is no difference, they're interchangeable terms for the same object A Profile defines one authentication method/server; a Sequence tries multiple Profiles in order until one succeeds

Sequences chain multiple Profiles together, trying each in turn — useful when users might live in different backends.

34. Which factor category does Multi-Factor Authentication add beyond username/password on the firewall?

An additional verification factor, such as a push notification, OTP, or hardware token, tied to an MFA vendor integration A second username/password pair checked against a separate directory A mandatory certificate installed on every client before login is permitted A CAPTCHA challenge shown before the credential form loads

MFA layers in a genuinely separate factor (something you have/are), not just another knowledge-based credential.

35. How does Credential Phishing Prevention typically restrict where corporate credentials can be submitted?

It blocks all HTTPS traffic by default until a site is explicitly whitelisted It only works with GlobalProtect connected and inactive for on-network users It detects credential submissions and restricts which URL categories are allowed to receive them It requires disabling SSL decryption to see the raw login form contents

It's enforced at the URL-category level — corporate creds are blocked from going to categories like newly-registered or high-risk sites.

36. Which two roles does the Cloud Identity Engine play for organizations with both on-prem AD and cloud directories like Azure AD/Okta? (Choose two.)

It syncs and centralizes identity data from multiple sources into a unified identity store consumable by firewalls and Prisma Access It can coexist with and complement on-prem AD/LDAP rather than requiring their replacement It is a mandatory physical appliance required at every branch office It functions solely as a certificate revocation checker for endpoint client certs

Cloud Identity Engine unifies identity from multiple sources and is designed to coexist with — not replace — existing on-prem AD/LDAP.

37. What does SCIM provisioning automate in this context?

Firewall software upgrades scheduled from a central IdP-driven policy IPSec tunnel rekeying between the firewall and identity provider WildFire signature distribution to firewalls that support SCIM User/group lifecycle sync (create, update, deactivate) from an identity provider into the platform automatically

SCIM is specifically about automated user/group provisioning and deprovisioning from an IdP.

38. In a large multi-vsys or multi-firewall environment, which two reasons explain why User-ID Redistribution is needed? (Choose two.)

So IP-to-user mappings learned by one firewall with direct access to an identity source can be propagated to other firewalls that lack that direct access So every enforcement point in a distributed deployment can apply consistent, up-to-date user-based policy without each needing its own direct agent/LDAP connection To permanently disable User-ID on all firewalls except the one central collector firewall To convert dynamic user groups into static address objects for faster policy lookups

Redistribution's purpose is propagating identity mappings across firewalls that don't all have direct identity-source connectivity, keeping policy enforcement consistent fleet-wide.

39. When implementing User-ID in policy, which two of the following can the Source User field match against? (Choose two.)

Individual usernames resolved via User-ID mapping, or static AD/LDAP groups Dynamic User Groups (DUGs) driven by tag-based membership updated in real time Only raw IP addresses with no identity context attached to them Only MAC addresses learned from the local ARP table

Source User can match individual users and group constructs, including tag-driven Dynamic User Groups — it's identity-based, not limited to IP or MAC matching.

40. What is the primary use case for Virtual Systems (vsys) on a single physical firewall?

Encrypting traffic between two datacenters over a shared physical link Logically partitioning one firewall into multiple independent administrative/policy domains (e.g. for MSSPs or business units) Increasing raw throughput beyond the physical hardware's rated limits Automatically load-balancing sessions across firewalls in different cloud regions

Vsys is about multi-tenancy — carving one box into isolated logical firewalls, common for MSSPs and shared-tenant environments.

41. Which shared network resources can a Virtual System administrator NOT configure, per the platform's RBAC model?

Security policy rules scoped only to their own vsys NAT rules scoped only to their own vsys Address and service objects scoped to their own vsys Interfaces, VLANs, virtual routers, and other shared network-level objects

Shared network objects live above any single vsys's scope, regardless of that vsys admin's role.

42. Which two reasons commonly justify forwarding firewall logs to an external SIEM in addition to keeping them in Panorama/Strata Logging Service? (Choose two.)

Integrating firewall telemetry into broader SOC tooling, correlation rules, and incident-response workflows that live outside the Palo Alto ecosystem Meeting long-term retention or compliance requirements that the org's SIEM already handles across all its data sources Panorama is fundamentally incapable of storing any logs on its own Log Forwarding disables local logging on the firewall once it's enabled

SIEM forwarding is about cross-tool correlation and org-wide retention/compliance — not a workaround for a logging limitation in Panorama.

43. What does Strata Logging Service provide that changes the traditional on-prem log-collector model?

It removes the need for any logging license across the deployed fleet Cloud-based, scalable log storage and retention that firewalls, Panorama, and CN-Series can forward to once licensed It only stores decryption keys used for SSL Forward Proxy sessions It replaces WildFire entirely as the malware detonation engine

Strata Logging Service moves log storage/retention to the cloud, decoupling it from on-prem log collector sizing.

44. When reading a Traffic log entry, what does the Action field combined with the Session End Reason together tell you?

Only the source zone the session originated from Only the App-ID assigned to the session by Content-ID Nothing useful, since both fields are populated after the session already ended Whether the session was allowed/denied and why it actually terminated (e.g. policy deny, threat, tcp-rst-from-client, aged-out)

Action plus Session End Reason together are core to diagnosing why a session behaved the way it did.

45. Which two categories of data does Device Telemetry upload to Palo Alto Networks by design? (Choose two.)

Product usage and device health statistics collected from the management plane Threat-related data that feeds back into Palo Alto's threat intelligence and ML detection models (e.g. WildFire, Advanced Threat Prevention) Full packet captures of all customer traffic, uploaded by default for every session Full configuration backups, including locally stored certificates and private keys

Telemetry is usage/health/threat data feeding Palo Alto's ML pipeline — not raw customer packet captures or credentials.

46. On which zone should User-ID mapping lookups be enabled to optimize CPU processing?

Ingress user zones (e.g. Workstations) using Include Lists to restrict subnets. Egress internet zones to catch external traffic. Server and database zones with static service accounts. Management interface only.

User-ID should only be enabled on ingress client zones with Include Lists to avoid wasting CPU scanning server/IoT subnets.

Domain 3: Integration & Automation (24%)

Covers Panorama centralized management (templates, device groups, pre/post rules), automation via APIs/Terraform/Ansible, and deployments across PA-Series, VM-Series, CN-Series, Cloud NGFW, and AI Runtime Security.

47. A customer is sizing a firewall for a link where they plan to enable decryption, App-ID, and full threat inspection on all traffic. Which two factors should most directly influence platform selection? (Choose two.)

Available dataplane CPU/throughput once decryption and content inspection are enabled, since deep inspection is CPU-intensive The number of administrator accounts that will manage the device, since more concurrent admin sessions add control-plane overhead Which content-inspection subscriptions (Threat Prevention, WildFire, etc.) are actually being enabled, since each adds processing load Which management-access method (console, out-of-band Ethernet, or in-band) is configured, since that determines how much dataplane throughput remains for inspection

Decryption and full content inspection are the most CPU-intensive operations on an NGFW — undersized dataplane hardware throttles once everything is turned on.

48. Two security policy rules could both match a session: a broad "allow any" rule near the top, and a specific deny rule further down. What happens?

Both rules apply and the stricter, more specific one automatically takes precedence The firewall evaluates all matching rules and logs a conflict for the admin to resolve The broad rule wins because rules are evaluated top-to-bottom, first match applies The most recently modified rule always wins, regardless of its position in the rulebase

First-match-wins is why rule order matters so much — a broad rule placed too high can silently shadow specific ones below it.

49. What is the primary purpose of the Discovery stage in Prisma AIRS / AI Runtime Security?

Actively blocking malicious prompts and responses in real time as they cross the runtime Passively identifying AI apps, models, and data flows already in use across the environment Deploying new LLM infrastructure into environments that don't already run one Rotating API keys for AI services on a fixed schedule

Discovery is about visibility first — finding shadow-AI usage before you can secure it.

50. Which Prisma AIRS stage is responsible for actively inspecting and blocking malicious prompts, responses, and agent actions in real time?

Defend, the runtime enforcement stage Discovery, the passive visibility stage Deploy, the integration-planning stage Overview only, no active component exists

Defend is the active runtime protection layer — prompts, responses, and agent actions all get inspected there.

51. Which two AI/LLM-specific risks does Prisma AIRS address that conventional network-layer Threat Prevention/IPS signatures are not designed to catch? (Choose two.)

Prompt injection attacks that manipulate a model's behavior through crafted input text Sensitive data leakage embedded in a model's generated output/response Classic buffer-overflow exploits against unpatched network services Standard volumetric DDoS floods against a web server

Prompt injection and output-based data leakage are risks specific to how LLMs process and generate content — not the packet/exploit patterns traditional IPS signatures target.

52. What must an organization typically decide during the Deploy stage of AI Runtime Security?

Which enforcement mode and integration points (API, gateway, SDK) fit each AI application discovered earlier Whether to disable Discovery entirely now that enforcement is in place Which Panorama template stack to use for HA failover of the AI runtime Which NAT rule to apply to outbound LLM API traffic from each app

Deploy is about choosing how protection gets inserted into each AI app's specific architecture, based on what Discovery found.

53. What networking characteristic of Kubernetes makes traditional perimeter-only firewalls insufficient for east-west traffic inside a cluster?

Kubernetes doesn't use IP addressing, relying on hostnames for every pod instead Pods communicate directly with each other inside the cluster, often bypassing any north-south perimeter device entirely Kubernetes clusters never span more than one physical or virtual host Kubernetes traffic is always pre-encrypted end-to-end by the container runtime

Pod-to-pod east-west traffic often never crosses a perimeter firewall, which is exactly the gap CN-Series fills.

54. Which two things does CN-Series bring into a Kubernetes cluster that differentiate it from relying on native Kubernetes network policies alone? (Choose two.)

The same App-ID/User-ID/Content-ID policy model used on physical and VM-Series firewalls, applied to pod-to-pod traffic Layer 7 threat inspection (e.g. Threat Prevention, WildFire) of east-west container traffic, which native Kubernetes NetworkPolicy objects don't provide Complete replacement of kube-proxy's Layer 3/4 service routing function inside the cluster Elimination of the need for any native Kubernetes network policies going forward

CN-Series adds genuine Layer 7 NGFW inspection and the familiar App-ID/Content-ID model to east-west traffic — capabilities native L3/L4 NetworkPolicy objects don't provide — without replacing core Kubernetes networking components.

55. In CN-Series architecture, what two main components typically work together to enforce policy?

Panorama and GlobalProtect only, managing policy from outside the cluster WildFire and DNS Security only, inspecting traffic entirely in the cloud A management plane component and dataplane firewall pods/containers deployed alongside the workloads A single monolithic VM outside the cluster handling all traffic centrally

CN-Series splits management and dataplane responsibilities, with dataplane components running close to the workloads they protect.

56. What does CN-Series deployment tie together from the earlier architecture discussion?

Only the licensing model that applies to per-pod firewall instances Only the Panorama console UI used to view logs afterward Only DNS Security integration for pod-level domain lookups The architecture pieces (management/dataplane components) into an actual working cluster deployment

Deployment is where the architectural pieces come together operationally inside a real Kubernetes cluster.

57. In a hub-and-spoke cloud network security design, why route spoke VPC/VNet traffic through a central security VPC/VNet?

To centralize inspection and policy enforcement for all spokes through one consistent NGFW layer To reduce the number of subnets required inside each spoke VPC/VNet Because spokes cannot have their own route tables in a hub-and-spoke design To eliminate the need for cloud-native security groups on spoke resources

Hub-and-spoke centralizes inspection so every spoke's traffic passes through one consistently policed choke point.

58. Which two factors primarily determine VM-Series instance sizing and licensing requirements in a public cloud deployment? (Choose two.)

Expected throughput and session-count requirements for the workloads being protected Which content-inspection subscriptions (Threat Prevention, WildFire, etc.) are enabled, since each adds dataplane load The cloud provider's default VM size, regardless of workload The specific region the VM is deployed in, independent of any other factor

Same logic as physical appliances — throughput/session load and which subscriptions are enabled drive both sizing and licensing in the cloud.

59. What's a common VM-Series traffic flow design for inbound internet-facing workloads in the cloud?

Bypassing the firewall entirely for inbound traffic to reduce latency Routing inbound traffic through the VM-Series via a load balancer before it reaches backend workloads Only inspecting outbound traffic, never inbound, since inbound is pre-filtered by the cloud provider Deploying VM-Series only in a separate, disconnected cloud account

Inbound designs typically front the VM-Series with a load balancer so traffic is inspected before it reaches the actual workloads.

60. Which two capabilities does AWS Gateway Load Balancer (GWLB) integration with VM-Series provide? (Choose two.)

Transparent insertion of a scalable, auto-scaling fleet of VM-Series firewalls into the traffic path using GENEVE encapsulation Avoiding complex per-VPC routing changes to insert inspection, compared to manually chaining route tables Automatic elimination of the need for any VM-Series licensing Built-in encryption of all inter-VPC traffic regardless of firewall policy

GWLB's value is transparent, auto-scaling insertion via GENEVE without per-VPC route surgery — it doesn't touch licensing or provide its own encryption layer.

61. What is the Azure equivalent design pattern to AWS Gateway Load Balancer for inserting VM-Series transparently?

Azure Gateway Load Balancer Azure Front Door only Azure DNS zones Azure Bastion

Azure GWLB serves the same transparent-insertion role in Azure that AWS GWLB serves in AWS.

62. On GCP, what capability does Google Cloud Intrusion Detection provide relative to VM-Series?

It replaces VM-Series entirely with a native GCP-only detection engine It only detects DDoS attacks against GCP load balancers It's a managed mirroring-based IDS offering built on Palo Alto threat detection technology, usable alongside a full inline deployment It requires no GCP networking configuration at all to start detecting threats

Cloud IDS on GCP is a managed, mirror-based detection service built on Palo Alto's threat engine, distinct from a full inline VM-Series deployment.

63. What use case does VM-Series on NSX-T primarily address?

Public cloud-only workloads with no on-prem presence Inserting NGFW-grade inspection into VMware NSX-T software-defined datacenter environments Kubernetes-only environments with no VMware components at all Replacing NSX-T's own native micro-segmentation capability entirely

VM-Series on NSX-T extends NGFW inspection into VMware's software-defined networking fabric, typically alongside NSX-T's native segmentation.

64. Which two benefits come from deploying VM-Series consistently across AWS, Azure, GCP, and on-prem/NSX-T rather than mixing different vendors' firewalls per environment? (Choose two.)

A single, consistent NGFW policy model (App-ID/User-ID/Content-ID) that behaves the same way regardless of the underlying cloud Centralized management and visibility across every environment, typically through Panorama A single shared license pool that automatically covers session capacity for every environment once one instance is licensed Removal of the need for any cloud-native security tooling

The value is consistent policy semantics plus centralized management across heterogeneous environments — not free licensing or eliminating native cloud tooling.

65. What is Panorama's core role in a multi-firewall deployment?

Centralized configuration, policy management, and log aggregation across a fleet of firewalls Replacing the need for individual firewall licenses Performing decryption on behalf of managed firewalls Acting as a DNS resolver for managed devices only

Panorama centralizes management and visibility, not inspection itself — the firewalls still do the actual traffic processing.

66. What requirement is specific to deploying VM-Series HA in AWS?

Physical fiber transceivers must be attached. Active/Active HA must be enabled. An IAM role must be attached, HA1 uses Management, and HA2 uses ethernet1/1. Link and Path monitoring must be configured for all VPC subnets.

AWS VM-Series HA requires an IAM role for route/ENI updates, uses MGT for HA1, and ethernet1/1 for HA2 (Active/Active and Link/Path monitoring are unsupported).