Palo Alto Networks OSPF Quiz (PCNSE Style)

1. Where is OSPF routing primarily configured on a Palo Alto Networks firewall?

• Device > Setup > Services
• Network > Interfaces > [Interface Name]
• Network > Virtual Routers > [VR Name] > OSPF
• Policies > Policy Based Forwarding

2. Which two components are mandatory to enable and establish basic OSPF functionality within a Virtual Router?

• Router ID and at least one configured Area with an interface assigned
• Redistribution Profile and Authentication Profile
• OSPF Export Rules and a defined Area Range
• Virtual Link and a Neighbor ID

3. What is the primary characteristic of a standard OSPF Stub Area?

• It blocks Type 3 LSAs (Inter-Area Summary) entirely.
• It blocks Type 5 LSAs (External) from entering the area.
• It automatically summarizes all routes leaving the area.
• It does not allow any Area Border Routers (ABRs).

4. How does a Totally Stubby Area differ from a standard Stub Area?

• Totally Stubby Areas also block Type 1 (Router) LSAs.
• Totally Stubby Areas block both Type 5 (External) and Type 3 (Inter-Area Summary) LSAs, allowing only a default route.
• Totally Stubby Areas require MD5 authentication on all interfaces.
• Totally Stubby Areas must be directly connected to Area 0 without an ABR.

5. Which type of LSA is generated by every OSPF router to describe its directly connected links and their states within an area?

• Type 1 (Router LSA)
• Type 2 (Network LSA)
• Type 3 (Summary LSA)
• Type 5 (AS External LSA)

6. An Area Border Router (ABR) generates which type of LSA to advertise summaries of networks from one area into another area?

• Type 1 (Router LSA)
• Type 2 (Network LSA)
• Type 3 (Network Summary LSA)
• Type 4 (ASBR Summary LSA)

7. To advertise routes learned via BGP into the OSPF domain on a Palo Alto firewall, which component must be configured?

• An OSPF Import Rule
• An OSPF Export Rule
• A Redistribution Profile referencing BGP routes
• A static route pointing to the BGP next-hop

8. When redistributing external routes into OSPF, what is the default Metric Type assigned on a Palo Alto firewall, and what does it signify?

• Type 1 (E1); the cost includes the internal OSPF cost to reach the ASBR.
• Type 2 (E2); the cost is fixed and represents only the external cost, ignoring internal OSPF path cost.
• Type 1 (E1); the cost is fixed and represents only the external cost.
• Type 2 (E2); the cost includes the internal OSPF cost plus the external cost.

9. On which OSPF network type is a Designated Router (DR) and Backup Designated Router (BDR) election typically NOT held?

• Broadcast
• Non-Broadcast Multi-Access (NBMA)
• Point-to-Point
• Point-to-Multipoint

10. What is the primary purpose of configuring an OSPF Virtual Link?

• To connect two stub areas directly together.
• To connect a disconnected area to the backbone (Area 0) through a transit area.
• To provide authentication between two OSPF areas.
• To create a summary route between two routers.

11. Which OSPF area type allows redistribution of external routes (has an ASBR) but blocks Type 5 LSAs from other areas, using Type 7 LSAs instead?

• Stub Area
• Totally Stubby Area
• Not-So-Stubby Area (NSSA)
• Backbone Area (Area 0)

12. What is the effect of configuring an interface as "Passive" within an OSPF Area configuration on a Palo Alto firewall?

• It completely disables OSPF processing on that interface.
• It prevents OSPF Hello packets from being sent out the interface, thus preventing neighbor adjacencies from forming on that link.
• It filters specific LSAs from being advertised out that interface.
• It sets the administrative distance for routes learned via that interface to 255.

13. What is the default Administrative Distance (AD) for OSPF routes (internal and external) on a Palo Alto Networks firewall?

• 90
• 100
• 110
• 120

14. Which CLI command on PAN-OS would you use to verify the state of OSPF neighbor adjacencies?

• show routing protocol ospf interface
• show routing protocol ospf neighbor
• show routing protocol ospf database
• show routing route type ospf

15. What is the mandatory Area ID for the OSPF backbone area, which all other standard areas must connect to (either directly or via virtual links)?

• Area 0
• Area 1
• The lowest configured Area ID
• There is no mandatory backbone area ID.

16. What is the key difference between an LSA Type 5 (AS-External) and an LSA Type 7 (NSSA External)?

• Type 7 LSAs carry a lower administrative distance.
• Type 5 LSAs are used for inter-area routes, while Type 7 are for intra-area routes.
• Type 7 LSAs originate within an NSSA by an ASBR and are converted to Type 5 LSAs by the NSSA ABR when advertised into other areas.
• Type 5 LSAs are flooded throughout the entire OSPF domain, while Type 7 LSAs are only flooded within Area 0.

17. Where is OSPF authentication (e.g., MD5) typically configured on a Palo Alto firewall?

• Globally under Virtual Router > OSPF > Advanced
• Within the Redistribution Profile used for OSPF
• Under Network > Virtual Routers > [VR Name] > OSPF > Areas > [Area ID] > Interfaces > [Interface Name]
• Under Device > Authentication Profile

18. You want to configure an ABR to advertise a single summary route (e.g., 10.10.0.0/16) into Area 0, representing multiple specific routes existing within Area 1 (e.g., 10.10.1.0/24, 10.10.2.0/24). Which configuration option is used for this inter-area summarization?

• Virtual Router > OSPF > Export Rules
• Virtual Router > OSPF > Areas > Area 1 > Range
• Virtual Router > Redistribution Profile > Summarization
• Virtual Router > OSPF > Advanced > Summary Address

19. Which OSPF neighbor state indicates that databases have been fully synchronized and the routers have established a complete adjacency?

• 2-Way
• ExStart
• Loading
• Full

20. In a standard Palo Alto Networks Active/Passive HA pair, which firewall actively participates in OSPF routing and forms neighbor adjacencies?

• Only the Active firewall
• Only the Passive firewall
• Both the Active and Passive firewalls simultaneously
• Neither, OSPF is not supported in HA configurations.