Palo Alto Networks NGFW-Engineer : Palo Alto Networks Next-Generation Firewall Engineer

A government agency needs to ensure that all user web access is explicitly mediated and authenticated.
The agency has the following requirements:
* Client browsers must be manually configured to send traffic to the firewall's IP address and a specific port.
* The firewall must support seamless single sign-on (SSO) with the users' existing Active Directory credentials.
Which feature set should the engineer configure to meet the agency's requirements?

• A. User-ID agent integration with Authentication Portal for authentication
• B. Web proxy in transparent mode with an Authentication policy by using multi-factor authentication (MFA)
• C. Web proxy in explicit mode with an Authentication policy by using Kerberos
• D. Decryption policy that redirects users to a SAML identity provider for authentication

An administrator is designing a public key infrastructure (PKI) integration for a large-scale deployment with thousands of users authenticating via client certificates. A key design goal is to ensure that certificate revocation status is checked efficiently with minimal impact on firewall performance and minimal delay for the connecting user.
What is the primary advantage of using the Online Certificate Status Protocol (OCSP) instead of certificate revocation lists (CRLs) in this scenario?

• A. OCSP provides real-time status for a certificate on demand, is more scalable, and uses less firewall memory.
• B. OCSP allows the firewall to act as its own certificate authority (CA), and it simplifies certificate management.
• C. OCSP is an older, more widely supported protocol than CRLs. ensuring compatibility with all client devices.
• D. OCSP bundles all certificate statuses into a single, digitally signed file for faster downloads by the firewall.

An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an access route. Users report that public web browsing works, but they cannot resolve the names of internal servers. The administrator determines that all DNS queries are being sent to the public DNS servers configured on the users' endpoints.
Which GlobalProtect portal setting should be configured to resolve this issue?

• A. Split tunneling for DNS and specify the internal corporate domains in the "Domain" list
• B. NAT rule to allow DNS traffic from the GlobalProtect clients to the internal DNS servers
• C. DNS Proxy feature on the firewall to point clients to the gateway IP for DNS
• D. "DNS Forwarding" option on the gateway's tunnel interface

Which forwarding methods can be used on the Objects tab when configuring the Log Forwarding profile?

• A. Panorama, syslog, email
• B. Panorama, ADEM, syslog
• C. SNMP, HTTP, RADIUS
• D. Syslog, HTTP, NetFlow

Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)

• A. Select IKE v2, enable the Advanced Options PQ PPK, then set a 64+ character string for the post- quantum pre shared key.
• B. Select IKE v2, enable the Advanced Options PQ KEM, then create an IKE Crypto Profile with Advanced Options adding one or more "Rounds."
• C. Ensure Authentication is set to "certificate," then import a post-quantum derived certificate.
• D. Select IKE v2 Preferred, enable the Advanced Options PQ KEM, then add one or more "Rounds."