NGFW-Engineer Practice Test 1 — 25 Questions

Question 1

What is the primary benefit of using Panorama templates for automation?

Accepted Answer

They provide a single point to manage shared network configuration.. Templates allow for centralized network configuration management, ensuring consistency across firewalls.

Answer

They replace the need for API access.

Answer

They automatically update firewall firmware.

Answer

They automate the hardware installation process.

Question 2

Which CLI command displays the API key if already generated for an admin?

Accepted Answer

The API key cannot be retrieved via CLI.. Actually, the API key is never displayed via CLI once created. The admin must regenerate it if forgotten.

Answer

show admin api-key

Answer

show config running

Answer

debug management-plane show-keys

Question 3

Which tool in the Palo Alto Networks ecosystem is designed specifically for automated orchestration of security workflows?

Accepted Answer

Cortex XSOAR. Cortex XSOAR is the industry-leading SOAR platform designed for security orchestration and automation.

Answer

Panorama

Answer

AutoFocus

Answer

Expedition

Question 4

In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?

Accepted Answer

/config/bootstrap/. The VM-Series looks for a specific directory structure on the attached storage device, starting with '/config/bootstrap/'.

Answer

/var/bootstrap/

Answer

/etc/bootstrap/

Answer

/opt/paloalto/

Question 5

An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?

Accepted Answer

panos_security_rule. The 'panos_security_rule' resource is the standard Terraform resource for managing security policies on Palo Alto Networks devices.

Answer

panos_firewall_rule

Answer

panos_policy_rule

Answer

panos_security_policy

Question 6

You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account lacks permissions for the requested object.. A 403 error indicates that the API key provided has insufficient permissions or the admin account associated with the key lacks the necessary role to access the resource.

Answer

The API Key is expired.

Answer

The JSON body is malformed.

Answer

The API endpoint URL is incorrect.

Question 7

Which TWO methods can be used to update the security policy on a Palo Alto Networks NGFW programmatically?

Accepted Answer

REST API.. The XML API and the REST API (on newer versions) are the primary programmatic methods.

Answer

FTP configuration upload.

Answer

SNMP SET commands.

Answer

Serial console access.

Question 8

You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?

Accepted Answer

The XPath in the API call does not correctly specify the Device Group or Vsys context.. The XML API requires precise XPath syntax. If the object exists in the GUI but the API fails, it is often due to the object being nested within a specific Device Group or Vsys that was not properly specified in the XPath.

Answer

The API key does not have the 'Superuser' role.

Answer

The XML document must be wrapped in a <request> tag.

Answer

The API service is disabled on the management interface.

Question 9

In a complex automation environment, how can you ensure the integrity of the firewall configuration across multiple automated runs?

Accepted Answer

Performing periodic 'get' requests to verify current state against the desired state.. Regularly fetching and verifying the 'running-config' against a known-good baseline or source-of-truth is critical for integrity.

Answer

Using only the CLI.

Answer

Disabling the API after every run.

Answer

Using only static IP addresses.

Question 10

You are configuring a new Palo Alto Networks firewall and need to ensure that the management interface is only accessible from a specific subnet. Which configuration component is used to achieve this?

Accepted Answer

Interface Management Profile. Management Interface Settings under Device > Setup > Interfaces allow the restriction of management access via Service Routes and Interface Management Profiles.

Answer

Access Control List (ACL)

Answer

Security Policy

Answer

Service Routes

Question 11

How do you verify if a security policy is actually matching the traffic you expect?

Accepted Answer

Check the Policy Hit Count in the Policies tab. The 'hit count' feature in the policy list provides real-time information on how many sessions have matched a specific rule.

Answer

Run a debug flow filter

Answer

Restart the management plane

Answer

Check the Traffic Log for policy hits

Question 12

What is the primary function of a Security Profile Group?

Accepted Answer

To bundle multiple security profiles into one object. A Security Profile Group allows you to bundle multiple security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) into a single object for easy policy assignment.

Answer

To manage NAT rules

Answer

To apply profiles to specific users

Answer

To group multiple security policies

Question 13

When using the 'pan-os-python' library, which class is primarily used to interact with firewall configuration objects?

Accepted Answer

panos.objects.AddressObject. The 'panos.firewall.Firewall' or 'panos.panorama.Panorama' classes are used to connect, but configuration objects are handled by classes within the 'panos.objects' namespace.

Answer

panos.xapi.Xapi

Answer

panos.network.Interface

Answer

panos.base.PanObject

Question 14

You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?

Accepted Answer

Plain text. EDLs must be text files containing entries separated by newlines, with specific formatting depending on the type (IP, Domain, or URL).

Answer

JSON

Answer

XML

Answer

CSV

Question 15

Which TWO actions are required to successfully integrate a new External Dynamic List (EDL)?

Accepted Answer

Configure the refresh interval.. You must define the source URL and set the update frequency in the EDL object.

Answer

Install an SSL certificate for the list source.

Answer

Enable threat prevention logs.

Answer

Restart the firewall.

Question 16

Which TWO types of files can be included in a bootstrap package?

Accepted Answer

init-cfg.txt. Init-cfg.txt and software images are common components of bootstrap packages.

Answer

Hardware drivers.

Answer

SSL Certificate private key.

Answer

Binary user database.

Question 17

When integrating an NGFW with an external SIEM for log ingestion, which TWO of the following methods are natively supported for log forwarding?

Accepted Answer

SNMP Traps. NGFWs natively support Syslog and SNMP (for traps) to forward log information to external SIEMs.

Answer

REST API push

Answer

FTP file push

Answer

Direct SQL query

Question 18

If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?

Accepted Answer

The Management Plane is overloaded.. A 503 error often indicates that the management plane is overloaded, or the XML API service is busy processing a previous command.

Answer

The endpoint is incorrect.

Answer

The API Key is invalid.

Answer

SSL handshake failed.

Question 19

You are troubleshooting a REST API integration issue where the firewall returns '400 Bad Request'. What should you check first?

Accepted Answer

The request payload syntax.. A 400 error indicates that the request sent by the client is malformed or invalid according to the API schema.

Answer

The server's internal firewall status.

Answer

The network latency between client and firewall.

Answer

The API Key expiry date.

Question 20

An administrator needs to quickly identify if an API call was successful from the firewall side. Which log should be reviewed?

Accepted Answer

System logs. The 'System' logs contain entries for web interface and API interactions.

Answer

Traffic logs

Answer

Threat logs

Answer

URL logs