NGFW-Engineer Hard Questions — 25 Difficult Questions

Question 1

You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?

Accepted Answer

init-cfg.txt. The 'init-cfg.txt' file is required for bootstrapping and contains the Panorama IP and authorization key to register the VM.

Answer

license.txt

Answer

bootstrap.xml

Answer

config.cfg

Question 2

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

Accepted Answer

Create an OSPF area and assign the Layer 3 interface to that area.. The two required steps are enabling OSPF on the virtual router with a router ID, and creating an OSPF area with the interface assigned to it. These steps ensure OSPF is active and the interface participates in the OSPF domain. Without a router ID, OSPF cannot start; without area assignment, the interface will not send or receive OSPF hellos. Other options like virtual links, network type changes, and graceful restart are optional and not needed for basic adjacency and route advertisement.

Answer

Set the interface's OSPF network type to point-to-point.

Answer

Configure a virtual link to the neighboring router's router ID.

Answer

Enable OSPF graceful restart on the virtual router.

Question 3

When troubleshooting a BGP route that is not appearing in the routing table, which command provides the most insight?

Accepted Answer

show routing protocol bgp rib-in. The 'show routing protocol bgp rib-in' command shows the prefixes received from peers before they are filtered and installed in the RIB.

Answer

show interface all

Answer

show system state

Answer

show routing fib

Question 4

You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?

Accepted Answer

The XPath in the API call does not correctly specify the Device Group or Vsys context.. The XML API requires precise XPath syntax. If the object exists in the GUI but the API fails, it is often due to the object being nested within a specific Device Group or Vsys that was not properly specified in the XPath.

Answer

The API key does not have the 'Superuser' role.

Answer

The XML document must be wrapped in a <request> tag.

Answer

The API service is disabled on the management interface.

Question 5

You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account lacks permissions for the requested object.. A 403 error indicates that the API key provided has insufficient permissions or the admin account associated with the key lacks the necessary role to access the resource.

Answer

The API Key is expired.

Answer

The JSON body is malformed.

Answer

The API endpoint URL is incorrect.

Question 6

You need to perform a packet capture on a specific firewall interface. Which tool is used?

Accepted Answer

Monitor > Packet Capture. The Packet Capture tool under Monitor > Packet Capture allows for selecting interfaces and defining filters.

Answer

Policies > Security

Answer

Device > Setup > Logging

Answer

Network > Interfaces

Question 7

If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?

Accepted Answer

The Management Plane is overloaded.. A 503 error often indicates that the management plane is overloaded, or the XML API service is busy processing a previous command.

Answer

The endpoint is incorrect.

Answer

The API Key is invalid.

Answer

SSL handshake failed.

Question 8

A security engineer is automating the deployment of a VM-Series firewall in AWS using Terraform. The bootstrap process requires the firewall to retrieve its license and configuration from a cloud storage bucket. Which bootstrap method should be used to ensure the firewall can automatically retrieve the init-cfg.txt and license files without manual intervention?

Accepted Answer

Configure the firewall to use the AWS S3 bucket for bootstrap by specifying the S3 bucket name, region, and access keys in the init-cfg.txt, and ensure the IAM role attached to the instance has read access to the bucket.. For automated bootstrap in AWS, the VM-Series firewall retrieves its configuration from an S3 bucket specified in the init-cfg.txt. The file must include the S3 bucket name, region, and authentication details, such as access keys or an IAM role. The IAM role attached to the instance must have read permissions to the bucket.

Answer

Use the VM-Series bootstrap package from the AWS Marketplace and provide the S3 bucket name and folder in the init-cfg.txt.

Answer

Use the AWS Systems Manager Parameter Store to store the bootstrap configuration and have the firewall query it via the AWS CLI during first boot.

Answer

Use the AWS S3 bucket as the bootstrap source and configure the instance user data to include the S3 bucket path.

Question 9

An administrator is integrating a Next-Generation Firewall with a cloud-based SIEM using the PAN-OS XML API. The SIEM will periodically query the firewall for threat logs. Which two API request parameters are required to retrieve threat logs via the XML API? (Choose two.)

Accepted Answer

type=log. To retrieve threat logs via the PAN-OS XML API, the request must include 'type=log' to indicate a log query and 'log-type=threat' to specify the threat log type. These two parameters are necessary. Other parameters like API key are for authentication, and query parameters are optional for filtering. The API will return threat logs in XML format, which the SIEM can then parse.

Answer

query=(subtype eq threat)

Answer

key=<API_KEY>

Answer

action=get

Question 10

An automation team is using the PAN-OS XML API to manage security policies across multiple firewalls. They need to ensure that their API calls are authenticated and authorized. The team has generated an API key for a service account with the necessary permissions. Which HTTP header should be included in the API request to authenticate using the API key?

Accepted Answer

Include the API key as a query parameter named 'key' in the URL.. The PAN-OS XML API authenticates requests by requiring the API key to be included as a query parameter named 'key'. This is the documented and supported method. Other methods like Authorization headers or cookies are not used by the API. Therefore, the correct approach is to append the API key to the URL.

Answer

Set the 'apikey' cookie in the HTTP request headers.

Answer

Authorization: Bearer <api_key>

Answer

X-PAN-KEY: <api_key>

Question 11

A DevOps team is automating firewall policy deployment using Panorama. They need to create a new security rule that references an existing address object and a service object. The script uses the pan-os-python library. After running the script, the rule appears in the candidate configuration but references the objects by name. What must the script do to ensure the rule is correctly associated with the objects?

Accepted Answer

Assign the actual address and service object instances to the rule's source and service attributes.. To create proper references in pan-os-python, you must assign the actual object instances to the security rule's attributes. Assigning names as strings results in literal values, not references. The library then generates the correct XML member elements, ensuring the rule is correctly associated with the address and service objects.

Answer

Use the firewall.op() method to commit the rule.

Answer

Ensure the rule's source and destination fields are set to the address object's name, and the service field to the service object's name.

Answer

Use the rule.add() method to automatically link the objects.

Question 12

An engineer is automating the creation of a security policy rule on a Palo Alto Networks next-generation firewall using the XML API. The rule must be placed in the 'Shared' policy and applied to all vsys. Which two parameters are required in the API request to ensure the rule is correctly positioned and applied? (Choose two.)

Accepted Answer

Ensure the XPath includes '/config/shared/rulebase/security/rules' to target the shared rulebase.. To place a security rule in the shared policy, the API request must use the correct XPath targeting the shared rulebase and specify the location as shared. The location parameter ensures the change is applied to the shared context, and the XPath points to the correct rulebase. Other parameters like vsys or type are not used for this purpose.

Answer

Include the 'vsys' parameter set to 'shared' in the API request.

Answer

Use the 'target' parameter to specify the device group or vsys for the rule.

Answer

Set the 'type' parameter to 'security' to indicate the rule type.

Question 13

A security engineer is automating the deployment of a new security policy rule using the PAN-OS XML API. The rule must be placed in the 'Shared' policy and applied to all firewalls managed by Panorama. Which two API operations must be performed to ensure the policy is active on the managed firewalls? (Choose two.)

Accepted Answer

Use the 'set' action to create the security rule in the candidate configuration.. To deploy a security rule via the XML API, you must first add it to the candidate configuration using a 'set' action. Then, you must commit the candidate configuration to apply the changes. On Panorama, a commit also pushes the policy to managed firewalls. Both steps are required to make the rule active.

Answer

Use the 'push' action to send the configuration directly to managed firewalls without committing on Panorama.

Answer

Use the 'edit' action to directly modify the running configuration.

Answer

Use the 'validate' action to check the rule for syntax errors before committing.

Question 14

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

Accepted Answer

Generate an API key on Panorama using an admin account with sufficient privileges.. To automate policy deployment with Panorama, first generate an API key for authentication. Then, after modifying the candidate configuration on Panorama, use the 'commit-all' action to push the changes to the managed firewalls. This ensures the policies are applied to the devices.

Answer

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Answer

Use the 'validate' action to ensure the configuration is valid before committing.

Answer

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Question 15

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Accepted Answer

Include the config and set elements in the API request.. To activate a new security rule created via the XML API, the script must first ensure the rule is added to the candidate configuration by including 'type=config' and 'action=set' in the request. Then, a separate commit request with 'action=commit' is required to push the candidate configuration to the running configuration. Without both steps, the rule will not take effect.

Answer

Use the <key> element to provide the API key for authentication.

Answer

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Answer

Include the <vsys> element to specify the virtual system for the rule.

Question 16

An engineer is integrating a PAN-OS firewall with a cloud-based automation platform using the XML API. The platform requires authentication via API keys. Which two actions must the engineer perform to generate and use an API key securely? (Choose two.)

Accepted Answer

Include the API key in the HTTP header as 'X-PAN-KEY' for each API request.. To securely use the XML API, an engineer must generate an API key using valid admin credentials and then include it in the 'X-PAN-KEY' header for authentication. Other options are either incorrect commands, insecure practices, or unnecessary configurations.

Answer

Generate an API key using the 'request password-hash' command in the CLI.

Answer

Store the API key in plain text in the automation script for simplicity.

Answer

Configure the API key to never expire for continuous automation.

Question 17

A security engineer is automating the creation of a security policy rule using the PAN-OS XML API. The rule must be placed at a specific position in the rulebase. Which API request parameter is used to specify the insertion point?

Accepted Answer

Use the 'insert' attribute with values 'before' or 'after' and specify the reference rule name.. The PAN-OS XML API allows specifying the insertion point for a new security rule by including an 'insert' element with 'before' or 'after' attributes and the name of an existing rule. This ensures the rule is placed exactly where needed in the rulebase, which is critical for correct policy evaluation order. Other methods either do not exist or require additional steps.

Answer

Use the 'position' parameter with an integer index representing the rule's order.

Answer

Use the 'where' parameter with values 'before' or 'after' and the rule name.

Answer

Use the 'move' operation after creation to reorder the rule to the desired location.

Question 18

A DevOps engineer is using the PAN-OS XML API to automate firewall configuration. The engineer needs to ensure that only the changes made by the automation script are committed, without committing other pending changes in the candidate configuration. Which API request parameter allows the commit to be scoped to only the changes made by the script?

Accepted Answer

partial with admin parameter set to the script's admin account. To commit only the changes made by the automation script, the script should use the 'partial' parameter in the commit request along with the 'admin' parameter set to the script's admin account. This limits the commit to changes made by that admin. Other parameters like 'force' commit all changes, and 'admin' alone is not valid. The 'partial' parameter without the correct admin would not target the script's changes.

Answer

admin

Answer

partial

Answer

force

Question 19

An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?

Accepted Answer

Another administrator or automation process changed the candidate configuration between the script's edit and its commit, and the commit included that other change.. The candidate configuration is shared among management sessions, and the commit operation commits whatever is in the candidate at the moment it runs. Without acquiring a config lock, a script's edit can be interleaved with changes from another session, and the subsequent commit will include those other changes. Locking the candidate before editing and releasing it after committing prevents this race condition.

Answer

The firewall rejected the edit because the rule name already existed and the API returned a success code while ignoring the change.

Answer

The edit request was applied to the running configuration instead of the candidate configuration.

Answer

The commit endpoint requires an API key with superuser role, and the script's key lacks the necessary permission, so the commit silently reverted the change.

Question 20

An automation engineer is writing a Python script using the pan-os-python library to update a security policy on a Palo Alto Networks NGFW. The script must ensure that the change is committed to the running configuration and that the script can handle commit failures gracefully. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Use the sync=True parameter when calling commit() to block until the commit job completes and returns the final result.. To programmatically commit and handle failures, the script should call commit() and then check the returned job status, or use sync=True to wait for completion and catch exceptions. Both approaches allow the script to detect and respond to commit errors. The other options either use invalid parameters or do not provide a reliable way to determine commit success.

Answer

Invoke the commit() method without any parameters and then immediately call refresh() to update the local object state.

Answer

Set the commit_all=True parameter to commit changes across all vsys and device groups simultaneously.

Answer

Enable the debug=True flag on the Firewall object to log commit failures to a local file for later analysis.