NetSec-Architect Centralized Management And Security Automation AT Scale Practice Test 3 — 15 Questions

Question 1

An architect is designing an automated workflow using Python and the Palo Alto Networks REST API. The script needs to retrieve operational state data from a managed firewall via Panorama using the XML-to-JSON or native REST endpoints. Which API route format is standard for executing operational commands via the PAN-OS XML/REST API structure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/api/?type=op&cmd=. The standard XML API operational command path format uses /api/?type=op&cmd=...

Answer

/api/?type=report&reporttype=custom

Answer

/restapi/v1.0/config/devices/entry[@name='localhost.localdomain']/deviceconfig

Answer

/api/?type=config&action=get&xpath=/config/devices

Question 2

An administrator wants to configure Panorama to forward system and configuration logs to a syslog server. Where should the administrator define the Syslog Server Profile in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. In Panorama, syslog server profiles are configured at the Panorama level under Panorama > Server Profiles > Syslog. This allows the administrator to define syslog servers that can be referenced in log forwarding profiles applied to managed firewalls or Panorama itself. This is the correct location for centralized syslog forwarding configuration.

Answer

Device > Server Profiles > Syslog

Answer

Panorama > Setup > Services > Syslog

Answer

Monitor > Log Forwarding > Syslog

Question 3

An architect is deploying Panorama in an environment where network interfaces and virtual routers must be configured identically across ten branch firewalls, except for the IP addresses of the WAN interfaces. Which Panorama feature should the architect use to handle this efficiently without creating ten separate templates?

Accepted Answer

Template Variables. Template variables allow administrators to define a single template structure while using variables (such as $WAN_IP) to inject unique values per firewall.

Answer

Dynamic Address Groups

Answer

Log Collector Group Mapping

Answer

Device Group Post-Rules

Question 4

An automation architect is designing a Python script using the PAN-OS Python SDK (pan-os-python) to push bulk security rules to Panorama. During execution, the script encounters a lock contention error ('Configuration lock held by user'). What is the best architectural practice to handle this condition programmatically?

Accepted Answer

Implement an exponential backoff retry loop in the script to wait for the lock to be released before attempting the commit again.. When performing automated configuration changes via API, scripts should implement exponential backoff and retry logic, or explicitly check for and release stale locks if permitted by RBAC.

Answer

Execute 'request system restart management-server' via API to forcefully clear all active locks.

Answer

Disable configuration locking globally in Panorama Setup to allow simultaneous concurrent commits.

Answer

Send an unauthenticated HTTP DELETE request to clear the active session table.

Question 5

An organization is deploying Cortex XSOAR alongside Panorama to automatically quarantine hosts that exhibit anomalous behavior. The playbook requires XSOAR to query Panorama for all firewall logs matching a specific source IP within the last 24 hours. Which API endpoint or query mechanism should XSOAR use to query log data stored on Panorama/Log Collectors?

Accepted Answer

The XML API with 'type=log' and query parameters specifying log type and query syntax.. Palo Alto Networks Panorama and Log Collectors store logs in a proprietary format, and the primary method to query these logs programmatically is through the XML API. The API call uses 'type=log' with parameters specifying the log type (e.g., traffic, threat) and a query string using the PAN-OS query syntax. This allows XSOAR to retrieve logs matching specific criteria, such as source IP and time range.

Answer

The REST API endpoint '/restapi/v1.0/operations/logs/traffic'

Answer

An SNMP GET request targeting the proprietary Palo Alto Networks log MIB.

Answer

Direct SSH connection using SCP to download raw SQLite log database files.

Question 6

An architect is planning a log collection architecture using Panorama Dedicated Log Collectors. The design requires compliance log retention for 3 years, exceeding the local disk capacity of a single log collector. How should the architect design the log storage architecture to scale log retention capacity?

Accepted Answer

Configure a Collector Group containing multiple Log Collectors to pool storage capacity and distribute log indexing load.. A Collector Group in Panorama allows multiple Dedicated Log Collectors to be grouped together, pooling their storage capacity and distributing the log indexing load. This design scales log retention beyond the capacity of a single log collector, meeting the 3-year compliance requirement.

Answer

Configure Panorama to automatically compress all logs into ZIP format and email them daily to an archive mailbox.

Answer

Attach external NFS network shares directly to Panorama's management plane via the CLI.

Answer

Enable Panorama RAID-0 disk striping across all managed firewalls.

Question 7

An administrator needs to verify the health and connection status of all firewalls managed by Panorama. Which tab in the Panorama Web interface provides a comprehensive dashboard view of connected devices, sync status, and software versions?

Accepted Answer

Panorama > Managed Devices > Summary. Panorama > Managed Devices > Summary provides a full inventory and status dashboard for all registered firewalls.

Answer

Panorama > Setup > High Availability

Answer

Device > Setup > Management

Answer

Monitor > System Logs

Question 8

An architect is configuring Panorama to push software updates to firewalls that do not have direct internet access. Panorama has internet access and has downloaded the required PAN-OS base images and hotfixes. How should the architect configure Panorama to distribute these images to the isolated firewalls?

Accepted Answer

Enable Panorama to act as a local update server, allowing managed firewalls to download images directly from Panorama.. Panorama can be configured to act as a local update server so that managed firewalls without internet access download PAN-OS images and content directly from Panorama. This is done by enabling the local update server role and ensuring firewalls point to Panorama for updates. The other options involve unsupported or impractical methods that do not reflect Panorama's native distribution capability.

Answer

Configure an external FTP server in Template settings and instruct firewalls to fetch images from it.

Answer

Export the configuration bundle, embed the PAN-OS binary into the XML, and perform a full device restore.

Answer

Manually SCP the software image to each firewall's root partition and execute a CLI upgrade command.

Question 9

An enterprise is automating security policy generation. A script generates custom URL filtering custom categories and pushes them to Panorama via the XML API. However, after the API call returns a successful status code, the changes are not visible in the Panorama Web UI or on the firewalls. What crucial step was omitted in the automation workflow?

Accepted Answer

Executing a commit API request to promote the candidate configuration to the running configuration.. In PAN-OS and Panorama architecture, API calls that modify the configuration only update the candidate configuration. A separate commit API request must be executed to push changes to the running configuration and target devices.

Answer

Sending a session termination command to clear active admin UI connections.

Answer

Restarting the management server process on Panorama using an operational command API call.

Answer

Generating a new API key because authentication tokens expire upon object creation.

Question 10

An architect is troubleshooting log collection on a Dedicated Log Collector. Firewalls are successfully forwarding logs, but Panorama's monitoring tab is not displaying reports. The architect checks the log collector status and sees that log forwarding from the collector to Panorama is failing. Which service or daemon handles the inter-communication between Dedicated Log Collectors and Panorama?

Accepted Answer

The log-collector and config-d daemons communicating over TCP port 3978 and related control ports.. The Log Collector communicates with Panorama management via the log-collector and collector management daemons, utilizing specific SSL certificates and TCP ports (such as 3978 for logging and management control).

Answer

The syslog-ng daemon operating over UDP port 514.

Answer

The tftpd daemon transferring compressed binary logs.

Answer

The snmpd daemon transmitting traps via UDP port 162.

Question 11

An architect is designing a centralized Panorama log collection architecture with Dedicated Log Collectors. Which TWO of the following design considerations are critical for ensuring high availability and reliable log ingestion? (Choose two)

Accepted Answer

Configuring Log Collector Groups to allow log redundancy and failover handling across multiple collector nodes.. Option A is correct because Log Collector Groups are the Panorama mechanism that provides redundancy and failover for log ingestion; when a collector in the group becomes unavailable, firewalls can continue sending logs to another collector in the group, preserving log availability. Option B is correct because log ingestion is a real-time streaming process, and if the network bandwidth between managed firewalls and the Dedicated Log Collectors cannot sustain the peak log generation rate, logs will be dropped or delayed, undermining reliable ingestion. Option C is incorrect because Panorama Log Collectors store logs in their own internal database (on the collector's local disk or external storage), not by mounting a collector partition onto a firewall via NFS. Option D is incorrect because SNMP v2c is a monitoring protocol for metrics and traps, not a mechanism for querying the log database. Option E is incorrect because firewalls do not use NVRAM as a primary long-term log store, and local storage is not the centralized Dedicated Log Collector design being described.

Answer

Mounting the log collector internal database partition directly onto a local firewall hard drive via NFS.

Answer

Enabling SNMP v2c polling on all log collectors to allow direct log database querying.

Answer

Configuring firewalls to store all logs locally in NVRAM indefinitely as a primary collection method.

Question 12

An automation engineer is developing an incident response script that integrates Cortex XSOAR with Palo Alto Networks firewalls via Panorama. Which THREE of the following tasks can be directly automated using the PAN-OS XML/REST API or XSOAR integrations? (Choose three)

Accepted Answer

Retrieving active session table information from firewalls using operational command API requests.. Option B is correct because the PAN-OS XML/REST API supports operational commands (type=op) such as 'show session all', allowing XSOAR to retrieve the active session table for investigation and enrichment. Option C is correct because Dynamic Address Groups are updated through the User-ID API (type=user-id, register/unregister IP-tag operations), which XSOAR can call to dynamically add or remove IPs as part of containment. Option D is correct because Panorama exposes a commit operation via the XML/REST API (type=commit), enabling XSOAR to trigger a configuration commit that pushes updated policies to managed firewalls. Option A is not valid because the PAN-OS API does not expose kernel memory access or real-time patching capabilities. Option E is not valid because physical hardware replacement or power cycling of failed PSUs cannot be performed through the PAN-OS XML/REST API or XSOAR integrations.

Answer

Directly modifying the underlying PAN-OS kernel memory space to patch zero-day vulnerabilities in real-time.

Answer

Physically replacing failed power supply units in modular firewall chassis via remote API power cycling.

Question 13

An architect is designing a Panorama role-based access control (RBAC) model for a large enterprise. Which TWO of the following capabilities can be restricted using Admin Role Profiles in Panorama? (Choose two)

Accepted Answer

Access to specific Device Groups or Templates, limiting administrators to only manage designated regions.. Option D is correct because Panorama Admin Role Profiles support scoping an administrator's access to specific Device Groups and/or Templates, which is exactly how you restrict a regional admin to only the firewalls and policy objects belonging to their area. Option E is correct because Admin Role Profiles define granular functional permissions (read-only, read-write, or none) across the Panorama and firewall functional areas, including operational tasks such as packet capture, session clearing, commits, and configuration actions. Options A, B, and C are incorrect because Admin Role Profiles govern administrative access to Panorama's management functions and object scopes, not hypervisor CPU scheduling, the appliance's underlying Linux root credentials, or the hardware/license serial number registered to the appliance.

Answer

The physical CPU core allocation assigned to individual management plane worker threads.

Answer

The underlying Linux root password of the Panorama appliance CLI.

Answer

The hardware license serial number registered to the Panorama virtual appliance.

Question 14

An enterprise architect is troubleshooting a synchronization failure between Panorama and a managed firewall. The firewall shows 'Not Synced' status. Which THREE of the following conditions can cause a configuration out-of-sync status between Panorama and a managed firewall? (Choose three)

Accepted Answer

Panorama pushed a configuration referencing an object that exists in Panorama but has not been successfully committed and pushed to that specific device group context.. Option B is correct because Panorama tracks per-device-group configuration state; if a pushed config references an object that was never successfully committed and pushed to that specific device group context, the firewall's running config cannot match Panorama's intended config, so it reports 'Not Synced'. Option D is correct because a failed or partially applied push (e.g., a commit validation error on the firewall) leaves the firewall's candidate/running configuration divergent from Panorama's pushed configuration, which is a classic cause of out-of-sync status. Option E is correct because direct local edits via CLI or WebUI create configuration drift from Panorama's managed configuration, and Panorama detects this as out-of-sync. Option A does not belong because a physical data plane cable disconnect affects traffic forwarding, not the management-plane configuration synchronization state. Option C does not belong because an expired SSL decryption certificate affects decryption functionality, not Panorama-firewall management authentication or config sync status.

Answer

The firewall's physical data plane interface suffered a physical cable disconnect.

Answer

The firewall's SSL decryption certificate expired, causing management plane authentication failure.

Question 15

An architect is designing a high-scale security automation framework using Strata Cloud Manager and Cortex XSOAR. Which THREE architectural best practices should be implemented to ensure reliable, scalable API-driven policy and threat management? (Choose three)

Accepted Answer

Incorporate robust error handling, token caching, and exponential backoff retry mechanisms in automation scripts to manage API rate limits.. Option A is correct because Strata Cloud Manager and Cortex XSOAR APIs enforce rate limits, so scripts must implement token caching (to avoid redundant authentication calls), exponential backoff retries, and robust error handling to remain reliable at high scale. Option B is correct because External Dynamic Lists let firewalls pull high-frequency indicator updates directly from a hosted list, avoiding the latency, API quota consumption, and commit overhead of repeatedly modifying policy rules programmatically. Option E is correct because long-running operations such as large report generation or bulk software pushes are handled asynchronously, returning a job ID that must be polled for status, which prevents timeouts and blocked threads in automation workflows. Option C is incorrect because sending API traffic over unencrypted HTTP exposes credentials and tokens and violates security best practices; TLS overhead is not a valid reason to downgrade. Option D is incorrect because disabling SSL/TLS certificate verification globally enables man-in-the-middle attacks and should never be done, even for performance reasons.

Answer

Route all API traffic through unencrypted HTTP connections to eliminate cryptographic overhead.

Answer

Disable SSL/TLS certificate verification globally in all API client scripts to maximize connection speed.