NGFW-Engineer Practice Test 3 — 10 Questions

Question 1

You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account lacks permissions for the requested object.. A 403 error indicates that the API key provided has insufficient permissions or the admin account associated with the key lacks the necessary role to access the resource.

Answer

The API Key is expired.

Answer

The JSON body is malformed.

Answer

The API endpoint URL is incorrect.

Question 2

What is the default action for the 'interzone-default' security policy?

Accepted Answer

Drop. The default security policy for traffic moving between different zones is to drop it.

Answer

Alert

Answer

Allow

Answer

Reset

Question 3

You need to perform a packet capture on a specific firewall interface. Which tool is used?

Accepted Answer

Monitor > Packet Capture. The Packet Capture tool under Monitor > Packet Capture allows for selecting interfaces and defining filters.

Answer

Policies > Security

Answer

Device > Setup > Logging

Answer

Network > Interfaces

Question 4

If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?

Accepted Answer

The Management Plane is overloaded.. A 503 error often indicates that the management plane is overloaded, or the XML API service is busy processing a previous command.

Answer

The endpoint is incorrect.

Answer

The API Key is invalid.

Answer

SSL handshake failed.

Question 5

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

Accepted Answer

Apply the profile to the zone under Network > Zones.. Option D is correct because a zone protection profile must first be created as an object under Network > Network Profiles > Zone Protection before it can be referenced anywhere; this defines the flood, reconnaissance, and packet-based attack protections. Option B is correct because after the profile exists, it must be attached to the target security zone under Network > Zones (in the Zone Protection Profile field) for the protections to take effect on that zone's ingress traffic. Option A is incorrect because security policy rules control permitted traffic and are not required to bind a zone protection profile to a zone. Option C is incorrect because assigning a zone to a virtual router is part of basic Layer 3 zone configuration, not zone protection profile configuration. Option E is incorrect because 'Strict' mode is not a valid interface setting for enabling zone protection; there is no such required toggle.

Answer

Create a security policy rule.

Answer

Assign the zone to a virtual router.

Answer

Enable the 'Strict' mode on the interface.

Question 6

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

Accepted Answer

Generate an API key on Panorama using an admin account with sufficient privileges.. To automate policy deployment with Panorama, first generate an API key for authentication. Then, after modifying the candidate configuration on Panorama, use the 'commit-all' action to push the changes to the managed firewalls. This ensures the policies are applied to the devices.

Answer

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Answer

Use the 'validate' action to ensure the configuration is valid before committing.

Answer

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Question 7

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Accepted Answer

Include the config and set elements in the API request.. To activate a new security rule created via the XML API, the script must first ensure the rule is added to the candidate configuration by including 'type=config' and 'action=set' in the request. Then, a separate commit request with 'action=commit' is required to push the candidate configuration to the running configuration. Without both steps, the rule will not take effect.

Answer

Use the <key> element to provide the API key for authentication.

Answer

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Answer

Include the <vsys> element to specify the virtual system for the rule.

Question 8

A company uses a SOAR platform to enrich and block indicators of compromise. The SOAR playbook must add malicious IP addresses to an External Dynamic List (EDL) hosted on an internal web server that the firewall already consumes. Which action should the playbook take?

Accepted Answer

Update the file on the internal web server that the firewall retrieves as the EDL source.. External Dynamic Lists are designed for exactly this use case: a firewall retrieves a list from an HTTP or HTTPS URL on a refresh interval, and any change to the source file is picked up automatically without a commit. A SOAR playbook can simply append or rewrite the file on the internal web server, and the firewall will enforce the new indicators after its next refresh. This keeps policy static and indicator management dynamic.

Answer

Use the SOAR platform to push a new security policy rule directly to the firewall for each malicious IP.

Answer

Configure the SOAR platform as a syslog target and send the IPs as log entries for the firewall to parse.

Answer

Call the firewall XML API to create a new address object for each IP and add it to a security policy rule.

Question 9

A security engineer is using the PAN-OS XML API to update the description of an existing address object named 'WebServer' in the 'Shared' location. The API request is sent with the correct API key and the following XPath: /config/shared/address/entry[@name='WebServer']. The server responds with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account used to generate the API key lacks write permission for the 'Shared' location.. The 403 Forbidden response indicates an authorization failure. Even with a valid API key, the admin account's role must have write permission for the target location. In this case, the 'Shared' location requires sufficient privileges to modify address objects. Checking the admin role's permissions and ensuring it includes write access to the relevant configuration area resolves the issue.

Answer

The API request is missing the required 'type=config' parameter.

Answer

The XPath is malformed and does not match any existing object.

Answer

The API key is invalid or expired.

Question 10

An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?

Accepted Answer

Another administrator or automation process changed the candidate configuration between the script's edit and its commit, and the commit included that other change.. The candidate configuration is shared among management sessions, and the commit operation commits whatever is in the candidate at the moment it runs. Without acquiring a config lock, a script's edit can be interleaved with changes from another session, and the subsequent commit will include those other changes. Locking the candidate before editing and releasing it after committing prevents this race condition.

Answer

The firewall rejected the edit because the rule name already existed and the API returned a success code while ignoring the change.

Answer

The edit request was applied to the running configuration instead of the candidate configuration.

Answer

The commit endpoint requires an API key with superuser role, and the script's key lacks the necessary permission, so the commit silently reverted the change.