(2026) PASS NGFW-Engineer exam with Palo Alto Networks NGFW-Engineer Real Exam Questions [Q62-Q80]

QUESTION 62
An automation engineer is developing a Python script to standardize SD-WAN deployments across multiple customer tenants in Panorama. A key requirement is to programmatically create path quality profiles to monitor link performance based on latency, jitter, and packet loss.
Which API call is required for this task?

QUESTION 63
An administrator needs to perform several maintenance tasks on a managed firewall directly from the Panorama console without using the Context Switch feature.
Which set of tasks can the administrator fully execute from the Panorama UI?

QUESTION 64
Which two services are configured by applying an SSL/TLS service profile? (Choose two answers)

QUESTION 65
A security administrator is creating a new custom report to get a consolidated view of network events and needs to select a database to query for the report data.
Which valid set of databases is available for the task?

QUESTION 66
Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)

QUESTION 67
Which set of options is available for detailed logs when building a custom report on a Palo Alto Networks NGFW?

QUESTION 68
In an active/active high availability (HA) configuration with two PA-Series firewalls, how do the firewalls use the HA3 interface?

QUESTION 69
A large organization has separate production and development environments, each with its own set of firewalls managed by Panorama. The organization uses Cloud Identity Engine (CIE) to consolidate user identities from Active Directory (AD) and Okta.
A security mandate requires that development firewalls must only learn about “DEV” and “QA” user groups, while production firewalls should only see “Prod” user groups.
How can an administrator enforce this separation using CIE with minimal complexity?

QUESTION 70
An engineer is configuring a site-to-site IPSec VPN to a partner network. The IKE Gateway and IPSec tunnel configurations are complete, and the tunnel interface has been assigned to a security zone. However, the tunnel fails to establish, and no application traffic passes through it once it is up.
Which two Security policy configurations are required to allow tunnel establishment and data traffic flow in this scenario? (Choose two.)

QUESTION 71
An administrator is configuring a site-to-site IPSec VPN and assigns an IP address to the tunnel interface.
Which two abilities are enabled by this specific configuration step? (Choose two.)

QUESTION 72
When creating a Log Forwarding profile on a PAN-OS firewall to direct logs to various external and internal systems, which set of methods is available?

QUESTION 73
When multiple routes have the same destination prefix, which attribute does the firewall use first to determine route preference?

QUESTION 74
Which statement describes the role of Terraform in deploying Palo Alto Networks NGFWs?

QUESTION 75
Which two actions in the IKE Gateways will allow implementation of post-quantum cryptography when building VPNs between multiple Palo Alto Networks NGFWs? (Choose two.)

QUESTION 76
An NGFW engineer is configuring multiple Panorama-managed firewalls to start sending all logs to Strata Logging Service. The Strata Logging Service instance has been provisioned, the required device certificates have been installed, and Panorama and the firewalls have been successfully onboarded to Strata Logging Service.
Which configuration task must be performed to start sending the logs to Strata Logging Service and continue forwarding them to the Panorama log collectors as well?

QUESTION 77
Without performing a context switch, which set of operations can be performed that will affect the operation of a connected firewall on the Panorama GUI?

QUESTION 78
When deploying a pair of Palo Alto Networks firewalls in an active/active high availability (HA) cluster what is the dedicated role of the HA3 link?

QUESTION 79
A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency.
Which approach best addresses these requirements while maintaining consistent policy enforcement?

QUESTION 80
An administrator configures a GlobalProtect gateway with split tunneling for network traffic based on an access route. Users report that public web browsing works, but they cannot resolve the names of internal servers. The administrator determines that all DNS queries are being sent to the public DNS servers configured on the users’ endpoints.
Which GlobalProtect portal setting should be configured to resolve this issue?