NGFW Engineer · Domain 2 of 3

NGFW Engineer Domain 2: PAN-OS Device Setting Configuration

Worth 40% of the score, this domain covers how the firewall itself is set up: administrator authentication, virtual systems, logging destinations, software upgrades, certificates for decryption and services, User-ID with the Cloud Identity Engine, and the PAN-OS web proxy.

Exam weight
40%
Official objectives
7
Estimated questions estimate
~24
Suggested study time estimate
25–30 hrs

About 15 min read Reviewed October 2026

Overview

Domain 2 covers device-level configuration that every deployment relies on. It has seven official objectives. Authentication covers admin roles, authentication profiles and sequences. Virtual systems cover VSYS interfaces and zones, virtual and logical routers and inter-VSYS traffic. Logging covers Strata Logging Service, log forwarding and Panorama log collectors and collector groups. Software updates cover PAN-OS upgrade practice. Certificates cover PKI integration, certificate-based authentication, SSL/TLS service profiles, decryption certificates and certificate profiles. User-ID covers group mapping, user-to-IP mapping and redistribution with both on-premises agents and the Cloud Identity Engine. The last objective is the PAN-OS web proxy.

This domain carries 40% of the score, equal to networking. It is broad rather than deep, and many questions turn on choosing the right object type, such as an authentication sequence instead of a profile or a certificate profile instead of an SSL/TLS service profile.

How it's tested

Questions in this domain describe an administrative requirement or a symptom, such as a certificate warning in browsers, unknown users in logs or an admin who can see too much. You choose the object, profile or sequence of steps that resolves it. Many distractors are real PAN-OS objects used for a neighbouring purpose.

  • Pick the right certificate object

    A decryption, portal or client-authentication need is described, and you choose between forward trust, forward untrust, SSL/TLS service profile and certificate profile.

  • Fix identity mapping

    Users show as IP addresses or groups do not match, and you pick the mapping source, group mapping or Cloud Identity Engine setting that fixes it.

  • Order the operational steps

    An upgrade, logging change or VSYS build is described, and you choose the correct sequence or prerequisite.

Reasoning it through

After enabling SSL Forward Proxy, every user sees a browser certificate warning on all HTTPS sites. The firewall is signing re-encrypted sessions with a self-signed certificate that clients do not trust. The fix is to issue a subordinate CA certificate from the enterprise PKI, already trusted by endpoints, and set it as the Forward Trust certificate. The forward untrust certificate should stay untrusted so genuinely bad sites still warn.

Objectives 7

Official objectives from the Palo Alto Networks outline, in outline order.

2.1 Implement authentication roles, profiles, and sequencesAdministrator roles, authentication profiles and authentication sequences.
What it means
This objective covers who can log in to the firewall and what they can do. Authentication profiles point to a method such as local database, LDAP, RADIUS, TACACS+, SAML or Kerberos. Sequences try several profiles in order. Admin roles limit access in the web interface, CLI and APIs.
What to understand
Dynamic roles such as superuser, device administrator and virtual system administrator are predefined and update automatically with new features. Admin role profiles give custom, granular permissions per tab, CLI level and XML or REST API access. An authentication sequence lets an administrator fall back to the local database if RADIUS is unreachable. Profiles can require MFA through a server profile and restrict access with an allow list of users or groups.
How it shows up
Expect a least-privilege requirement or a fallback requirement, and choose a role profile or an authentication sequence.
Common confusion
Using a single profile when the requirement is fallback across several authentication sources; that needs a sequence.
2.2 Configure virtual systems (VSYS)VSYS interfaces and zones, virtual and logical routers, inter-VSYS routing and security.
What it means
Sub-objectives cover interfaces and zones (2.2.1), virtual routers (2.2.2), logical routers (2.2.3) and inter-VSYS routing and security (2.2.4). A virtual system is a separate logical firewall with its own zones, policies, objects and administrators on one physical device.
What to understand
Multi-VSYS capability must be enabled, and models above the base count need a VSYS license. Interfaces and zones belong to one VSYS. Routers can be shared or dedicated. Traffic between virtual systems uses external zones, and Security policy must allow it in each VSYS it crosses. A shared gateway lets several virtual systems use one internet-facing interface. With the Advanced Routing Engine, logical routers replace virtual routers for VSYS routing.
How it shows up
Scenarios ask how to let two tenants communicate, why inter-VSYS traffic is dropped, or how to share one internet link.
Common confusion
Expecting one Security rule to cover inter-VSYS traffic; each virtual system evaluates its own policy.
2.3 Configure loggingStrata Logging Service, log forwarding, log collectors and collector groups.
What it means
Sub-objectives cover Strata Logging Service (2.3.1), log forwarding (2.3.2) and log collectors and log collector groups (2.3.3). Logs can stay local, go to Panorama log collectors, go to the cloud-based Strata Logging Service, or go to syslog, SNMP, email and HTTP servers.
What to understand
Traffic, threat, URL and similar logs are forwarded by attaching a log forwarding profile to Security rules. System, configuration, User-ID and HIP logs are forwarded under Device log settings. Dedicated log collectors join collector groups, and firewalls send logs according to a preference list. Enabling log redundancy keeps two copies across collectors, halving usable storage. Strata Logging Service, formerly Cortex Data Lake, stores logs in the cloud for Strata Cloud Manager and other apps.
How it shows up
Expect questions on where to attach forwarding, how to make logs survive a collector failure, and which destination a cloud-managed design uses.
Common confusion
Thinking a log forwarding profile handles system and configuration logs; those use Device log settings.
2.4 Implement PAN-OS software updatesPlanning and performing PAN-OS upgrades and related content updates.
What it means
This objective covers moving a firewall to a new PAN-OS release safely: checking the upgrade path, downloading and installing images, meeting minimum content release requirements, and handling HA pairs and Panorama-managed firewalls.
What to understand
Install the required Applications and Threats content before the new PAN-OS image. Save and export the configuration first. Panorama must run the same or a later release than the firewalls it manages. In an HA pair, upgrade one peer at a time, typically the passive peer first, with preemption disabled to avoid unplanned failback. Review release notes and known issues, and schedule a maintenance window because the install requires a reboot.
How it shows up
Questions test the correct order of steps and the version relationship between Panorama and managed firewalls.
Common confusion
Upgrading Panorama after its firewalls; Panorama must be upgraded first.
2.5 Configure certificatesPKI integration, authentication, SSL/TLS profiles, decryption and certificate profiles.
What it means
Sub-objectives cover PKI integration (2.5.1), authentication (2.5.2), SSL/TLS profiles (2.5.3), decryption such as subordinate CA and forward trust or untrust (2.5.4) and certificate profiles (2.5.5). Certificates secure the management interface, GlobalProtect, User-ID connections and decryption.
What to understand
An SSL/TLS service profile picks the certificate and allowed TLS versions for a service the firewall hosts. A certificate profile lists trusted CAs and revocation checks for validating certificates presented to the firewall. Forward trust should be a subordinate CA signed by the enterprise PKI so endpoints trust re-signed sites; forward untrust stays untrusted. Inbound inspection uses the protected server's certificate and private key. Certificates can be generated, imported or requested through SCEP.
How it shows up
Expect a decryption warning scenario, a client certificate validation need, or a TLS version hardening requirement.
Common confusion
Confusing the SSL/TLS service profile, which presents a certificate, with the certificate profile, which validates one.
2.6 Configure on-premises and Cloud Identity Engine User-IDGroup mapping, user-to-IP mapping and redistribution with on-premises and cloud identity sources.
What it means
Sub-objectives cover group mapping and directory sync (2.6.1), user-to-IP mapping and user context (2.6.2) and redistribution and segments (2.6.3). User-ID maps IP addresses to users and users to groups so policy and logs use identities.
What to understand
Mapping sources include the PAN-OS integrated agent or Windows User-ID agent reading domain controller security logs, GlobalProtect, Authentication Portal, syslog parsing and the XML API. Group mapping uses LDAP server profiles on-premises. The Cloud Identity Engine syncs directories such as Microsoft Entra ID and Okta, and its user context feature shares mappings across firewalls organised in segments. Redistribution lets one firewall or Panorama collect mappings and share them with others.
How it shows up
Scenarios ask why users show as IP addresses, how to use cloud directory groups in policy, or how to share mappings at scale.
Common confusion
Forgetting that User-ID must be enabled on the source zone before mappings are applied to traffic.
2.7 Configure web proxy on PAN-OSExplicit and transparent web proxy on the firewall.
What it means
This objective covers using the firewall as a web proxy. Supported PAN-OS releases and models can act as an explicit proxy, where browsers are pointed at the proxy, or a transparent proxy, where traffic is intercepted without client settings.
What to understand
Explicit proxy uses a listening interface and port, often distributed with a PAC file, and can authenticate users with Kerberos or SAML. Transparent proxy needs no client configuration but relies on traffic being routed through the firewall. Proxy traffic still needs decryption to inspect HTTPS content, and Security policy still applies. It helps organisations migrating from legacy proxies.
How it shows up
Expect a scenario comparing explicit and transparent proxy or asking what clients need for explicit mode.
Common confusion
Assuming transparent proxy requires browser configuration; only explicit mode does.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Authentication sequence

    Ordered list of authentication profiles tried until one succeeds.

    Remember
    Used for fallback, such as RADIUS then local.
    Tested as
    Admin and user login scenarios.
    Trap
    Choosing a single profile for multi-source login.

  • Admin role profile

    Custom permissions for web UI, CLI and API access.

    Remember
    Dynamic roles cannot be customised.
    Tested as
    Least-privilege admin questions.
    Trap
    Using superuser read-only when write access to one area is needed.

  • Multi-VSYS

    Separate logical firewalls on one device.

    Remember
    Each VSYS has its own zones, policies and objects.
    Tested as
    Multi-tenant designs.
    Trap
    Forgetting the license above the base VSYS count.

  • External zone

    Zone type for traffic between virtual systems.

    Remember
    Policy is needed in both VSYS.
    Tested as
    Inter-VSYS traffic scenarios.
    Trap
    Using a Layer 3 zone between VSYS.

  • Log forwarding profile

    Attached to Security rules to send traffic and threat logs.

    Remember
    System and config logs use Device log settings.
    Tested as
    Logging destination questions.
    Trap
    Expecting it to forward system logs.

  • Collector group

    Set of log collectors sharing storage and redundancy.

    Remember
    Log redundancy halves usable capacity.
    Tested as
    Log resiliency questions.
    Trap
    Assuming redundancy is free in storage.

  • Strata Logging Service

    Cloud log storage, formerly Cortex Data Lake.

    Remember
    Requires a license and onboarding.
    Tested as
    Cloud logging scenarios.
    Trap
    Using the old product name in newer contexts.

  • Upgrade order

    Content first, then PAN-OS; Panorama before firewalls.

    Remember
    Upgrade HA peers one at a time.
    Tested as
    Upgrade sequence questions.
    Trap
    Upgrading both HA peers simultaneously.

  • Forward trust certificate

    Signs re-encrypted certificates for sites with valid certificates.

    Remember
    Best as an enterprise subordinate CA.
    Tested as
    Decryption warning scenarios.
    Trap
    Using a self-signed root that endpoints do not trust.

  • Forward untrust certificate

    Signs certificates for sites with invalid certificates.

    Remember
    Must not be trusted by clients.
    Tested as
    Decryption safety.
    Trap
    Using the same certificate as forward trust.

  • Certificate profile

    Validates presented certificates against trusted CAs and revocation.

    Remember
    Used for client and device authentication.
    Tested as
    GlobalProtect and admin cert auth.
    Trap
    Confusing it with SSL/TLS service profile.

  • Cloud Identity Engine

    Cloud service syncing directories and sharing user context.

    Remember
    Supports Entra ID, Okta and others.
    Tested as
    Cloud directory group mapping.
    Trap
    Assuming LDAP group mapping covers cloud-only directories.

  • User-ID zone setting

    Enables mapping for traffic sourced from that zone.

    Remember
    No setting, no user in logs.
    Tested as
    Users show as IP addresses.
    Trap
    Checking only the agent and not the zone.

  • Explicit vs transparent proxy

    Explicit needs client settings; transparent intercepts routed traffic.

    Remember
    Both are PAN-OS web proxy modes.
    Tested as
    Proxy migration scenarios.
    Trap
    Assuming the proxy removes the need for decryption.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Certificate objects

ConceptMeaningKey differenceCommon trap
SSL/TLS service profile Certificate and TLS versions for a hosted service Presents a certificate Using it to validate clients
Certificate profile Trusted CAs and revocation checks Validates a presented certificate Using it to set TLS versions
Forward trust Signs certs for valid sites Should chain to a trusted enterprise CA Leaving it self-signed
Forward untrust Signs certs for invalid sites Deliberately untrusted Making it trusted by clients

Logging destinations

ConceptMeaningKey differenceCommon trap
Local logs Stored on the firewall disk Limited retention Relying on it for long-term audit
Panorama log collectors On-premises central storage Collector groups and redundancy Ignoring the preference list
Strata Logging Service Cloud log storage Feeds cloud management and apps Calling it Cortex Data Lake in new designs
Syslog, SNMP, email, HTTP External systems via server profiles Integrates with SIEM and ticketing Forgetting the server profile

User-ID approaches

ConceptMeaningKey differenceCommon trap
On-premises User-ID Agent or integrated agent with LDAP group mapping Uses domain controllers and local directories Expecting it to read cloud-only groups
Cloud Identity Engine Cloud directory sync and user context Works with Entra ID, Okta and others Assuming it needs an on-premises agent
Redistribution Sharing mappings between firewalls Hub firewall, Panorama or CIE segments Configuring every firewall to query every source

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Self-signed forward trust

    What candidates pick
    Generating a self-signed root on the firewall for production decryption.
    Why it looks right
    It is quick and works in labs.
    Why it's wrong
    Endpoints do not trust it, causing warnings everywhere; production should use a subordinate CA from the enterprise PKI.

    Clue to watch for Users report certificate warnings on every HTTPS site.

  2. Profile for fallback

    What candidates pick
    Configuring one authentication profile and hoping it falls back.
    Why it looks right
    Profiles feel like the main authentication object.
    Why it's wrong
    Only an authentication sequence tries multiple profiles in order when one fails.

    Clue to watch for A requirement to use local accounts if the RADIUS server is down.

  3. Service profile validates clients

    What candidates pick
    Using an SSL/TLS service profile for client certificate checks.
    Why it looks right
    Both objects involve certificates and TLS.
    Why it's wrong
    Validation of presented certificates uses a certificate profile listing trusted CAs and revocation options.

    Clue to watch for Clients must present a certificate to connect.

  4. Upgrade both peers at once

    What candidates pick
    Installing the new PAN-OS on both HA peers together.
    Why it looks right
    It shortens the maintenance window.
    Why it's wrong
    Upgrading both at once removes redundancy and risks a full outage; upgrade one peer, verify, then the other.

    Clue to watch for The scenario stresses minimal downtime.

  5. One rule for inter-VSYS

    What candidates pick
    Writing a single Security rule for traffic between two virtual systems.
    Why it looks right
    It looks like ordinary zone-to-zone traffic.
    Why it's wrong
    Each virtual system evaluates its own policy, so both need a rule involving the external zone.

    Clue to watch for Traffic leaves one VSYS but is dropped by the other.

  6. Agent fixes everything

    What candidates pick
    Reinstalling the User-ID agent when users show as IPs.
    Why it looks right
    The agent supplies mappings.
    Why it's wrong
    If User-ID is not enabled on the source zone, mappings never apply, whatever the agent does.

    Clue to watch for Mappings exist but logs still show IP addresses.

Answer framework

Classify each device-settings question by the object family involved, then apply these checks in order.

  1. Name the object family first: administrator access, virtual systems, logging, software updates, certificates, User-ID or the PAN-OS web proxy.
  2. For access, decide whether the need is permissions, which points to roles, or fallback, which points to sequences.
  3. For certificates, ask whether the firewall presents, validates or signs a certificate, then pick service profile, certificate profile or forward trust or untrust.
  4. For logs and updates, check prerequisites and order: forwarding profile versus Device log settings, content before PAN-OS, Panorama before firewalls.
  5. For identity and VSYS, confirm the zone settings first, then the mapping source, group source or inter-VSYS policy that completes the path.

Practice question

A company uses Microsoft Entra ID as its only directory and has no on-premises domain controllers. Security policy must match users by their Entra ID groups on several PA-Series firewalls. What should the engineer configure?

Want more like this? The NGFW Engineer practice test has questions for every domain.

Checklist

0 of 15

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split this domain into three study blocks: identity and access, certificates and decryption, and operations. Start with identity because it touches most objectives. In a lab, create admin role profiles and an authentication sequence, then configure User-ID with LDAP group mapping. If you can get a Cloud Identity Engine tenant, connect a trial Entra ID directory and watch groups appear on the firewall.

Next, build a small PKI. Generate a root, issue a subordinate CA for forward trust, create a separate untrusted certificate for forward untrust, and enable SSL Forward Proxy for one test client. Then create an SSL/TLS service profile for the management interface and a certificate profile for client authentication, so you learn the difference by doing it.

Finish with operations. Enable multi-VSYS on a lab firewall that supports it and pass traffic between two virtual systems. Configure a log forwarding profile and a syslog server profile. Read the PAN-OS upgrade checklist and HA upgrade procedure in the administrator guide, and skim the web proxy documentation for explicit and transparent modes. Close with mixed practice questions, noting which certificate or identity objects you confuse.

FAQ

How much of the NGFW Engineer exam is PAN-OS Device Setting Configuration?

PAN-OS Device Setting Configuration is 40% of the score, the same weight as networking, with seven official objectives in the November 2025 datasheet.

Do I need to know the Cloud Identity Engine?

Yes. Objective 2.6 names on-premises and Cloud Identity Engine User-ID together, including directory sync, user context and segments.

What is Strata Logging Service?

The cloud log storage service for Palo Alto Networks products, previously called Cortex Data Lake. It is named in objective 2.3.1.

How deep is decryption on the exam?

The datasheet places decryption under certificates, so focus on forward trust, forward untrust, subordinate CA use and inbound inspection certificates rather than every decryption profile option.

What is the correct upgrade order with Panorama?

Upgrade Panorama first, then log collectors and firewalls. Install the required content release before each PAN-OS image, and upgrade HA peers one at a time.

Is the PAN-OS web proxy widely deployed?

It is a newer feature, but objective 2.7 lists it explicitly. Know the difference between explicit and transparent modes and what each requires.

Are VSYS questions only for large firewalls?

Multi-VSYS runs on many mid-range and high-end models. The exam focuses on configuration logic, such as external zones and inter-VSYS policy, not model limits.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have reviewed authentication, VSYS, logging, upgrades, certificates, User-ID and web proxy. Test yourself on choosing the correct PAN-OS object for each scenario.

Take the NGFW Engineer practice test Check your NGFW Engineer readiness

Keep going