Palo Alto NetworksCertified Next-Generation Firewall Engineer
Domain 2Objective 5
2.5 Configure Certificates NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 1)
Part of the PAN-OS Device Setting Configuration domain, which accounts for 40% of the NEXT-GENERATION-FIREWALL-ENGINEER exam.
22questions here
5free pages
6concepts
40%of the exam
Questions 1–5
- 1
In PAN-OS, which type of certificate is used to authenticate the firewall itself to external peers or services?
Select an answer first - 2
A firewall is configured for SSL decryption. The security team notices that clients are receiving certificate errors for trusted websites. They suspect the forward trust certificate is not trusted by clients. What is the most likely cause?
Select an answer first - 3
A company uses client certificates for GlobalProtect authentication. They have multiple CAs, and some users have certificates from a CA that is being decommissioned. The security team wants to ensure that certificates from the decommissioned CA are no longer accepted, while still accepting certificates from the other CAs. What is the most efficient way to achieve this?
Select an answer first - 4
A company uses client certificates for GlobalProtect authentication. They want to ensure that only certificates with a specific key usage (e.g., digital signature) are accepted. Which setting in a certificate profile controls this?
Select an answer first - 5
What is the purpose of a forward trust certificate in PAN-OS SSL decryption?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NEXT-GENERATION-FIREWALL-ENGINEER” is a trademark of its owner, used for identification only.