Free NGFW Engineer Exam Flashcards

Use it when the firewall should switch Ethernet frames within a Layer 2 domain. Assign it to a Layer 2 zone and VLAN rather than giving it a routed IP identity.

A Layer 3 interface has IP-layer configuration and participates in routing; a Layer 2 interface forwards frames within a VLAN and does not route by itself.

It inserts the firewall transparently between two network points so traffic can be inspected without redesigning IP addressing or making the firewall a routed hop.

The tunnel interface gives decrypted tunnel traffic a logical Layer 3 endpoint that can belong to a zone and participate in routing and policy enforcement.

It combines compatible physical links into one logical interface, providing added bandwidth and link redundancy when the peer is configured for the same aggregation method.

It is intended for administrative access and management services, keeping control-plane administration separate from user data-plane forwarding.

A zone groups interfaces with a common trust or functional role. Security policy evaluates traffic using source and destination zones rather than only physical port names.

Active/passive normally has one forwarding peer and one standby peer. Active/active allows both peers to process traffic and therefore requires more deliberate session ownership and network design.

It watches selected local interfaces or link groups. A configured link failure can contribute to an HA state change or failover decision.

It tests reachability to specified network destinations, detecting upstream or downstream path failure even when the local interface remains physically up.

Redistribution selectively moves routes learned from one source or protocol into another. Filters and attributes prevent unintended route propagation.

It associates the route with reachability probes so PAN-OS can remove or alter use of the route when the monitored path fails.

It provides the modern routing architecture and workflow for dynamic protocols, policy controls, and scalable logical routing functions on supported PAN-OS platforms.

The portal supplies client configuration and gateway information; the gateway authenticates endpoints and terminates protected user tunnels.

It tries authentication profiles in a defined order. User-domain matching helps select the applicable profile, and enabling Exit on Fail stops the sequence after that profile rejects the user instead of trying later profiles.

It determines which endpoint traffic enters the corporate tunnel and which traffic uses the endpoint's local path, based on the configured inclusion and exclusion criteria.

In IKEv1, Phase 1 establishes the IKE SA and Phase 2 negotiates IPsec SAs. IKEv2 instead establishes an IKE SA and then one or more Child SAs that protect data traffic; it does not use the IKEv1 phase terminology.

The RFC 8784 post-quantum preshared key (PPK) method mixes an additional shared secret into IKEv2 key derivation, reducing future quantum risk to the public-key exchange. Both VPN peers must share and configure compatible PPK settings.

GRE is a general routing encapsulation mechanism useful for carrying routed traffic between compatible peers. It does not inherently provide the confidentiality and authentication supplied by IPsec.

Routing determines the egress path and destination zone; security policy determines whether the resulting interzone or intrazone session is permitted and inspected.

A profile defines one authentication service and its settings. A sequence orders multiple profiles so PAN-OS can try them according to a controlled fallback plan.

It limits which management functions an administrator can view or change, supporting least-privilege access to the web interface, CLI, or XML API.

A VSYS creates a logical firewall instance with its own interfaces or subinterfaces, zones, routing context, policies, and administrative boundaries on a shared platform.

VSYS boundaries are enforcement boundaries. Traffic must have a valid path between the virtual systems and must match the applicable policies on that path.

It maintains routing information and makes Layer 3 forwarding decisions for assigned interfaces. The exact construct depends on the routing architecture in use.

It provides cloud-delivered log storage and access for supported Palo Alto Networks deployments, enabling centralized retention and use of telemetry beyond local firewall storage.

It selects log types and match conditions and sends matching records to configured destinations such as logging services, Panorama, syslog, email, or other supported receivers.

A Log Collector receives and stores logs. A Collector Group organizes collectors and defines how managed firewalls distribute logs across them.

Required intermediate releases, compatibility checks, content versions, backups, and HA sequencing protect configuration compatibility and reduce outage or rollback risk.

It lets PAN-OS establish trust chains, validate presented certificates, and use enterprise certificate authorities for authentication, TLS services, and decryption workflows.

It identifies the server certificate and permitted TLS protocol settings used when a PAN-OS management or service endpoint presents TLS to a client.

Forward Trust signs certificates for decrypted sites whose original certificate is trusted. Forward Untrust signals that the original server certificate failed trust validation.

It defines which certificate authorities and validation settings PAN-OS uses when authenticating a presented client or device certificate.

Forward Proxy decrypts outbound client sessions by acting between users and external servers. Inbound Inspection uses the protected server's certificate and key to inspect traffic destined for that server.

It imports directory group membership so policy can target users and groups instead of relying only on IP addresses.

It associates a learned identity with an observed IP address so PAN-OS can apply identity-aware policy to sessions from that address.

Redistribution shares mappings with other authorized firewalls or identity consumers, extending consistent identity context beyond the device that learned it.

It provides cloud-delivered directory and identity context that supported Palo Alto Networks services can use for consistent user and group-based policy.

It enables supported explicit or transparent proxy handling so web requests can be directed through PAN-OS policy and inspection with the appropriate proxy workflow.

Decryption establishes an inspection path, while certificate validation decides whether the original peer is trustworthy. Separating them can permit inspection without enforcing the intended trust decision.

Use a hardware appliance when the design calls for dedicated physical interfaces, appliance capacity, and on-premises or colocated enforcement.

VM-Series fits virtualized or cloud infrastructure where firewall capacity should be deployed as software and integrated with the environment's networking and lifecycle tools.

It brings Palo Alto Networks enforcement into Kubernetes environments so container and cluster traffic can be secured using cloud-native deployment patterns.

Cloud NGFW is delivered as a cloud-integrated managed firewall service, while VM-Series is a firewall virtual machine whose deployment and lifecycle remain under the customer's control.

Prisma AIRS AI Runtime Security applies security controls and visibility to AI application and model traffic. The engineer integrates the supported deployment option into the surrounding network and policy architecture.

An idempotent workflow converges repeatedly on the intended configuration without creating duplicates or unintended changes, making deployment safer and easier to audit.

Terraform compares declarative configuration with managed state recorded in a state file. Ansible commonly runs playbooks without persistent Terraform-style state. Both still need controlled credentials, repeatable design, and validation.

Templates and template stacks manage device and network settings; device groups organize policy and objects for inheritance across managed firewalls.

Pre-rules enforce centralized policy before local rules; post-rules provide centralized policy after local rules. Their placement supports governance while preserving controlled local administration.

ACC provides interactive visibility for exploring current application, user, threat, and traffic patterns; custom reports produce repeatable views for defined operational or compliance questions.