1.6 Configure Tunnels NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   After configuring a GRE tunnel interface on a Palo Alto firewall, what additional configuration is required to send traffic through the tunnel?

   • AA static route or dynamic routing protocol that uses the tunnel interface as the next hop
   • BA NAT policy to translate the tunnel traffic
   • CAn IPSec crypto profile applied to the tunnel interface
   • DA DHCP server on the tunnel interface
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of a GRE tunnel?

   • ATo replace the need for routing protocols in a network
   • BTo provide encryption for all traffic passing through the tunnel
   • CTo compress data to reduce bandwidth usage
   • DTo encapsulate a wide variety of network layer protocols inside an IP tunnel
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which two protocols are the core components of an IPSec tunnel, and what are their primary roles?

   • AIKE for encryption of data and ESP for key exchange
   • BSSL for key exchange and AH for encryption of data
   • CAH for key exchange and IKE for authentication of data
   • DIKE for key exchange and ESP for encryption/authentication of data
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is planning to deploy new IPSec tunnels and wants to protect against future quantum computer attacks. They require that the key exchange mechanism be resistant to quantum cryptanalysis. Which PAN-OS feature should they use?

   • AEnable quantum-resistant cryptography in the IKE crypto profile using post-quantum algorithms.
   • BConfigure the tunnel to use AES-256-GCM encryption.
   • CUse a longer pre-shared key (e.g., 64 characters) to increase security.
   • DDeploy the tunnel over a GRE tunnel to add an extra layer of encryption.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of the tunnel interface in an IPSec configuration on a Palo Alto firewall?

   • AIt assigns a public IP address to the firewall for internet connectivity
   • BIt provides a virtual interface that routes traffic into the IPSec tunnel
   • CIt applies security policies to the encrypted traffic after decryption
   • DIt terminates the IKE negotiation and stores the pre-shared key
   Reveal Solution Discussion Select an answer first