Palo Alto Networks NGFW-Engineer 考試大綱：

主題	簡介
主題 1	Integration and Automation: This section measures the skills of Automation Engineers in deploying and managing Palo Alto Networks NGFWs across various environments. It includes the installation of PA-Series, VM-Series, CN-Series, and Cloud NGFWs. The use of APIs for automation, integration with third-party services like Kubernetes and Terraform, centralized management with Panorama templates and device groups, as well as building custom dashboards and reports in Application Command Center (ACC) are key topics.
主題 2	PAN-OS Networking Configuration: This section of the exam measures the skills of Network Engineers in configuring networking components within PAN-OS. It covers interface setup across Layer 2, Layer 3, virtual wire, tunnel interfaces, and aggregate Ethernet configurations. Additionally, it includes zone creation, high availability configurations (active active and active passive), routing protocols, and GlobalProtect setup for portals, gateways, authentication, and tunneling. The section also addresses IPSec, quantum-resistant cryptography, and GRE tunnels.
主題 3	PAN-OS Device Setting Configuration: This section evaluates the expertise of System Administrators in configuring device settings on PAN-OS. It includes implementing authentication roles and profiles, and configuring virtual systems with interfaces, zones, routers, and inter-VSYS security. Logging mechanisms such as Strata Logging Service and log forwarding are covered alongside software updates and certificate management for PKI integration and decryption. The section also focuses on configuring Cloud Identity Engine User-ID features and web proxy settings.

參考：https://www.paloaltonetworks.com/services/education/palo-alto-networks-ngfw-engineer

Palo Alto Networks NGFW-Engineer 考試概覽:

認證廠商:	Palo Alto Networks
考試名稱:	Palo Alto Networks 次世代防火牆工程師
考試代碼:	NGFW-Engineer
及格分數:	860 分（標準化分數，範圍 300–1000 分）
證照有效期限:	2 年
支援語言:	English
實際考試題數:	50–60 題
考試費用:	250 美元
考試形式:	配對題, 複選題, 排序題, 情境導向題, 單選題
相關認證:	SD-WAN Engineer Network Security Professional
考試時間:	90 分鐘
推薦課程:	Palo Alto Networks 官方訓練課程
考試報名:	Pearson VUE 報名作業
範例考題:	Palo Alto Networks NGFW-Engineer 範例考題
考試方式:	僅限於 Pearson VUE 考場現場應考（線上遠端監考模式已終止提供）
必備條件:	無強制報考資格要求；建議具備 6–12 個月 Palo Alto NGFW 實務操作經驗，以及基礎網路與資安知識
官方大綱網址:	https://www.paloaltonetworks.com/services/education/certifications/ngfw-engineer

最新的 Network Security Administrator NGFW-Engineer 免費考試真題：

問題 #1

Which initial action is required to configure logical routers?

A. Checking "advanced routing" in general settings
B. Changing the virtual router type from "default" to "advanced"
C. Activating an advanced routing subscription
D. Committing a new advanced routing software module

顯示解答討論 0

答案：A 🗳️

說明：（僅 VCESoft 成員可見）

問題 #2

Which PAN-OS method of mapping users to IP addresses is the most reliable?

A. Port mapping
B. Server monitoring
C. GlobalProtect
D. Syslog

顯示解答討論 0

答案：C 🗳️

說明：（僅 VCESoft 成員可見）

問題 #3

What is a result of enabling split tunneling in the GlobalProtect portal configuration with the "Both Network Traffic and DNS" option?

A. It specifies which domains are resolved by the VPN-assigned DNS servers and which domains are resolved by the local DNS servers.
B. It allows users to access internal resources when connected locally and external resources when connected remotely using the same FQDN.
C. It allows devices on a local network to access blocked websites by changing which DNS server resolves certain domain names.
D. It specifies when the secondary DNS server is used for resolution to allow access to specific domains that are not managed by the VPN.

顯示解答討論 0

答案：A 🗳️

說明：（僅 VCESoft 成員可見）

問題 #4

In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more certificate profiles are configured.
What function do certificate profiles serve in this context?

A. They define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation checks (CRL/OCSP), and map certificate attributes (e.g., CN) for user or device authentication.
B. They store private keys for users and devices, effectively allowing the firewall to issue or reissue certificates if the primary Certificate Authority (CA) becomes unavailable, providing a built-in fallback CA to maintain continuous certificate issuance and authentication.
C. They provide a one-click mechanism to distribute certificates to all endpoints without relying on external enrollment methods.
D. They allow the firewall to bypass certificate validation entirely, focusing only on username / password- based authentication.

顯示解答討論 0

答案：A 🗳️

說明：（僅 VCESoft 成員可見）

問題 #5

An organization's Security policy states that for all outbound web traffic, the TCP session to the external web server must be established by the firewall, not the user's workstation. This requires configuring user web browsers to point to the firewall. Authentication is also required.
Which solution on a PA-Series firewall meets these specific needs?