Paloalto Networks Updated NGFW-Engineer Exam Questions and Answers by kasper

Basic Concept: Explicit proxy requires client browsers to point to the firewall's proxy address and port. Kerberos adds seamless Active Directory SSO for user authentication.

Why A is Correct: Web proxy in explicit mode with Kerberos authentication directly matches both manual proxy configuration and seamless AD authentication.

Why B is Wrong: Decryption policy that redirects users to a SAML identity provider for authentication is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Web proxy in transparent mode with an Authentication policy by using multi-factor authentication (MFA) is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: User-ID agent integration with Authentication Portal for authentication is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Basic Concept: CIE can integrate multiple identity providers into one tenant and use segments to control redistribution by business unit or firewall group.

Why A is Correct: A single tenant with Okta connections and segments provides the required isolation with the least operational overhead.

Why B is Wrong: Configure the firewalls for each company to query their respective Okta IdPs directly, bypassing CIE for redistribution. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Push all identity data to Panorama and use Panorama's group mapping include/exclude lists to control what each firewall learns. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: Create a master CIE tenant for the holding company and peer it with two subordinate tenants, one for each acquired business. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.