Free Palo Alto Networks NGFW-Engineer Exam Dumps Questions & Answers

When an engineer creates a new VSYS on a supported firewall platform, which resource can be explicitly limited in the VSYS configuration to control its capacity?

• A.  Maximum number of admin accounts
• B.  Maximum number of NAT rules
• C.  Maximum number of log entries
• D.  Dedicated data plane memory

According to dynamic updates best practices, what is the recommended threshold value for content updates in a mission- critical network?

• A.  16 hours
• B.  48 hours
• C.  32 hours
• D.  8 hours

A holding company has recently acquired two new businesses, each with its own Okta identity provider. The holding company wants to use a single Cloud Identity Engine (CIE) instance to provide User-ID for all three organizations' firewalls. However, for legal reasons, the firewalls of Company A must only receive identity data from Company A's Okta instance, and the firewalls of Company B must only receive data from Company B's Okta instance.
Which configuration in CIE supports this requirement with highest operational efficiency?

• A.  Configure a CIE tenant, connect Okta, and create segments.
• B.  Create a master CIE tenant for the holding company and peer it with two subordinate tenants, one for each acquired business.
• C.  Push all identity data to Panorama and use Panorama's group mapping include/exclude lists to control what each firewall learns.
• D.  Configure the firewalls for each company to query their respective Okta IdPs directly, bypassing CIE for redistribution.

An engineer is implementing a new rollout of SAML for administrator authentication across a company's Palo Alto Networks NGFWs. User authentication on company firewalls is currently performed with RADIUS, which will remain available for six months, until it is decommissioned. The company wants both authentication types to be running in parallel during the transition to SAML.
Which two actions meet the criteria? (Choose two.)

• A.  Create and add the "SAML Identity Provider" Server Profile to the authentication profile for the
  "RADIUS" Server Profile.
• B.  Create a testing and rollback plan for the transition from Radius to SAML, as the two authentication profiles cannot be run in tandem.
• C.  Create and apply an authentication profile with the "SAML Identity Provider" Server Profile.
• D.  Create an authentication sequence that includes both the "RADIUS" Server Profile and "SAML Identity Provider" Server Profile to run the two services in tandem.

An administrator enables SSL Forward Proxy decryption using a self-signed certificate on a Palo Alto Networks firewall as the forward trust certificate. Shortly after, users report receiving "Your connection is not private" browser errors for all external websites.
What is the most likely cause of these widespread certificate errors?

• A.  The firewall's self-signed CA certificate is not deployed to the trusted certificate store on client endpoints.
• B.  The external websites are using TLS 1.3, which cannot be decrypted by the firewall without a specific license.
• C.  The firewall's forward untrust certificate has expired, preventing it from identifying untrusted sites.
• D.  The decryption policy is configured with a "no-decrypt" action, which causes browsers to reject the connection.