Purchase Palo Alto Networks : NGFW-Engineer Exam Materials and then pass exam easily

An engineer is configuring a site-to-site IPSec VPN to a partner network. The IKE Gateway and IPSec tunnel configurations are complete, and the tunnel interface has been assigned to a security zone. However, the tunnel fails to establish, and no application traffic passes through it once it is up.
Which two Security policy configurations are required to allow tunnel establishment and data traffic flow in this scenario? (Choose two.)

• A. A security rule is needed to allow IKE and IPSec traffic between the zone where the physical interface resides and the zone of the partner gateway.
• B. Security rules must be configured to permit application traffic from the local zone to the tunnel zone, and from the tunnel zone to the local zone.
• C. An Application Override policy is needed to allow both the IKE negotiation and the encapsulated data traffic.
• D. A single bidirectional security rule must be configured to manage traffic flowing through the tunnel interface.

An NGFW engineer is establishing bidirectional connectivity between the accounting virtual system (VSYS) and the marketing VSYS. The traffic needs to transition between zones without leaving the firewall (no external physical connections). The interfaces for each VSYS are assigned to separate virtual routers (VRs), and inter-VR static routes have been configured. An external zone has been created correctly for each VSYS.
Security policies have been added to permit the desired traffic between each zone and its respective external zone. However, the desired traffic is still unable to successfully pass from one VSYS to the other in either direction.
Which additional configuration task is required to resolve this issue?

• A. Create Security policies to allow the traffic between the two external zones.
• B. Create a transit VSYS and route all inter-VSYS traffic through it.
• C. Add each VSYS to the list of visible virtual systems of the other VSYS.
• D. Enable the "allow inter-VSYS traffic" option in both external zone configurations.

For which two purposes is an IP address configured on a tunnel interface? (Choose two.)

• A. Tunnel monitoring
• B. Use of peer IP
• C. Redistribution of User-ID
• D. Use of dynamic routing protocols

In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

• A. To exchange hellos, heartbeats, HA state information, and management plane synchronization for routing and User-ID information
• B. To perform session cache synchronization among all HA peers having the same cluster ID
• C. To synchronize sessions, forwarding tables, IPSec security associations, and ARP tables between firewalls in an HA pair
• D. To forward packets to the HA peer during session setup and asymmetric traffic flow

An organization is deploying VM-Series firewalls in Microsoft Azure to secure its VNets. A key requirement is that the security infrastructure must be resilient to the failure of an entire Azure Availability Zone.
What is the recommended method to achieve this goal?

• A. Implement a Terraform configuration that automatically redeploys the firewall in a new zone if the original one fails.
• B. Use Azure Traffic Manager to direct traffic to a primary VM-Series firewall, with a second firewall in another zone as a failover target.
• C. Configure PAN-OS active/passive high availability (HA) between two VM-Series instances in separate Availability Zones using HA links over a VNet peering connection.
• D. Deploy multiple, independent VM-Series firewalls in different Availability Zones and use an Azure Load Balancer to distribute traffic to them.