You are integrating an NGFW with an external SIEM using Syslog. When troubleshooting missing logs, which firewall tool is best to verify that the log forwarding profile is generating packets?
An administrator needs to automate the deployment of security policy updates using Panorama. Which XML API method should be invoked to commit changes to the candidate configuration?
You are integrating an NGFW with Panorama for centralized management. You need to ensure that local firewall configurations are not overwritten when the device is imported into Panorama. Which setting in the Panorama > Setup > Operations tab or import process prevents this?
You are troubleshooting an issue where a third-party SIEM is not receiving logs from your NGFW. You have verified that the syslog server is reachable via ping. What is the next logical step to confirm the firewall is actually sending the packets?
You are deploying a dynamic address group (DAG) that is populated by an external cloud platform. Which feature must be enabled on the NGFW to allow the firewall to receive these updates automatically?
When troubleshooting an automation script that uses the Palo Alto Networks XML API, which THREE of the following are valid methods to identify the cause of the failure?
An engineer is integrating a Palo Alto Networks NGFW with a cloud-based orchestration platform using the PAN-OS XML API. The platform requires that every API call be authenticated and authorized. The engineer wants to avoid embedding admin credentials in scripts. Which method should be used to authenticate API requests?
An automation engineer is writing a Python script that uses the Palo Alto Networks XML API to create a new address object and then reference it in a security policy rule. The script must make the change effective immediately without a separate commit by the administrator. Which API call should the script include after creating the address object and the security rule?
An automation engineer is writing a Python script using the pan-os-python library to create a new address object on a firewall. The script authenticates with an API key and calls the create() method on an Address object. After running the script, the engineer notices that the address object does not appear in the candidate configuration. Which method must be called on the firewall object to make the change visible in the candidate configuration?
A security engineer is automating the deployment of a VM-Series firewall in AWS using Terraform. The bootstrap process requires the firewall to retrieve its license and configuration from a cloud storage bucket. Which bootstrap method should be used to ensure the firewall can automatically retrieve the init-cfg.txt and license files without manual intervention?
A security engineer is using the PAN-OS XML API to retrieve the current running configuration for a specific virtual system. The engineer wants to ensure that the output is in a structured format that can be easily parsed by a Python script. Which API parameter should be used to specify the output format?
An engineer is using the Palo Alto Networks XML API to add a new address object to a device group on Panorama. The API request is sent to /config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG1']/address. The response is an error indicating that the device group does not exist. After verifying that the device group name is correct, what is the most likely cause?
An administrator is using the PAN-OS XML API to retrieve the current running configuration from a firewall. The API response is in XML format. Which API action should be used to get the entire running configuration?
An engineer is building a Python script that must create address objects and a security policy rule on a Palo Alto Networks next-generation firewall using the XML API. The script must authenticate without embedding credentials directly in the source code and must be safe to run from a CI/CD pipeline. (Choose two.)
An engineer needs to configure a PAN-OS firewall to send logs to an external SIEM using a custom log format. The SIEM expects logs in JSON format. Which action should the engineer take?
An administrator is integrating a Next-Generation Firewall with a cloud-based SIEM using the PAN-OS XML API. The SIEM will periodically query the firewall for threat logs. Which two API request parameters are required to retrieve threat logs via the XML API? (Choose two.)
An administrator is integrating a Palo Alto Networks NGFW with Ansible to enforce security policies. The playbook must retrieve the current running configuration in a structured, machine-readable format for auditing. Which Ansible module or approach should be used to accomplish this?
An administrator is automating firewall policy updates using the PAN-OS XML API. The script must modify an existing security rule to change its action from 'allow' to 'deny'. The script constructs an XML payload and sends it to the firewall. Which API request type and action should be used to modify the existing security rule in the candidate configuration?
An automation team is using the PAN-OS XML API to manage security policies across multiple firewalls. They need to ensure that their API calls are authenticated and authorized. The team has generated an API key for a service account with the necessary permissions. Which HTTP header should be included in the API request to authenticate using the API key?
A DevOps team is automating firewall policy deployment using Panorama. They need to create a new security rule that references an existing address object and a service object. The script uses the pan-os-python library. After running the script, the rule appears in the candidate configuration but references the objects by name. What must the script do to ensure the rule is correctly associated with the objects?
An engineer is automating the creation of a security policy rule on a Palo Alto Networks next-generation firewall using the XML API. The rule must be placed in the 'Shared' policy and applied to all vsys. Which two parameters are required in the API request to ensure the rule is correctly positioned and applied? (Choose two.)
A DevOps engineer is integrating a Palo Alto Networks next-generation firewall with a CI/CD pipeline. The pipeline needs to automatically update a security policy rule's source address group whenever a new application is deployed. The engineer decides to use the PAN-OS XML API. Which API operation should be used to modify the existing address group's members?
An engineer is integrating a PAN-OS firewall with a cloud-based automation platform using the XML API. The platform requires authentication via API keys. Which two actions must the engineer perform to generate and use an API key securely? (Choose two.)
A security engineer is automating the creation of a security policy rule using the PAN-OS XML API. The rule must be placed at a specific position in the rulebase. Which API request parameter is used to specify the insertion point?
A security engineer is automating the deployment of a new security policy rule using the PAN-OS XML API. The rule must be placed in the 'Shared' policy and applied to all firewalls managed by Panorama. Which two API operations must be performed to ensure the policy is active on the managed firewalls? (Choose two.)
A DevOps engineer is using the PAN-OS XML API to automate firewall configuration. The engineer needs to ensure that only the changes made by the automation script are committed, without committing other pending changes in the candidate configuration. Which API request parameter allows the commit to be scoped to only the changes made by the script?
An engineer is building an integration that uses the PAN-OS REST API to retrieve the current running configuration from a firewall. The script authenticates with an API key and calls the endpoint at /restapi/v10.1/Configuration/Devices/Localhost/deviceconfig. The response is a 200 OK but the JSON body contains no device configuration. What is the most likely cause?
An engineer needs to verify that a Python script using the pan-os-python library is connecting to the correct firewall and is authenticated before running a large configuration change. Which method should the script call to confirm connectivity and authentication?
An automation engineer is writing a Python script using the pan-os-python library to update a security policy on a Palo Alto Networks NGFW. The script must ensure that the change is committed to the running configuration and that the script can handle commit failures gracefully. Which two actions should the engineer take to achieve this? (Choose two.)
An automation script uses the PAN-OS Python SDK to modify a security policy on a firewall. The script calls the 'apply()' method on a security rule object. However, the change is not reflected in the running configuration. What is the most likely reason?
An automation engineer is designing a Python script that will use the PAN-OS XML API to retrieve logs from a firewall for security analysis. The script must be able to filter logs based on specific criteria and handle large volumes of data efficiently. Which two parameters are essential to include in the API request to achieve this? (Choose two.)
A DevOps engineer is writing a Python script that uses the pan-os-python library to commit changes to a firewall. The script must ensure that the commit is only performed if there are no validation errors. Which method should be used to perform a validation-only commit?
A DevOps engineer is integrating a Palo Alto Networks firewall with a CI/CD pipeline to automatically update security policies based on application deployments. The pipeline uses the XML API to push policy changes. Which authentication method is recommended for secure, non-interactive automation?
A DevOps engineer is integrating a Palo Alto Networks NGFW with a CI/CD pipeline. The pipeline uses a REST API call to retrieve the current security policy from the firewall for validation. The API request is GET https://firewall/api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security&key=APIKEY. The response is a 403 Forbidden error. The API key is valid and has superuser role. What is the most likely reason for the 403 error?
A network engineer needs to automate the retrieval of the current commit history from a Palo Alto Networks firewall using the XML API. The engineer wants to include the last 10 commit jobs and their statuses in a report. Which API request should be used?
An administrator is using the PAN-OS XML API to automate the creation of a security policy rule. The rule must include a source zone, destination zone, and application. Which THREE elements are required in the API request payload to successfully create the rule? (Choose three.)
A security engineer is writing a Python script using the 'pan-os-python' library to automate the creation of a security policy rule. The script creates a Rule object, sets its properties, and then calls 'rule.create()'. However, the rule does not appear on the firewall. What is the most likely reason?
A security administrator wants to automate the retrieval of the current running configuration from a Palo Alto Networks NGFW using the XML API. The administrator needs to save the configuration to a file for backup purposes. Which API request should be used?
A security engineer is integrating a Palo Alto Networks NGFW with a custom threat intelligence platform. The platform provides a list of malicious IP addresses that must be dynamically blocked. The engineer wants to use the XML API to register the platform as an external dynamic list (EDL) source. Which API call correctly configures an EDL named 'MaliciousIPs' with a URL of 'https://threat.example.com/ips'?
An administrator is using the pan-os-python library to automate firewall configuration. The script creates a new address object and adds it to a security policy rule. After running the script, the address object exists in the candidate configuration, but the security policy rule does not reference it. The script uses the following code: address_object.create(), then security_rule.add(address_object), then security_rule.update(). What is the most likely reason the rule does not reference the address object?
An engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the Palo Alto Networks PAN-OS Python library (pan-os-python). The script needs to create an address object and then immediately use it in a security policy rule. Which sequence of method calls should the engineer use to ensure the address object is available for reference in the policy rule?
A security engineer is integrating a Palo Alto Networks NGFW with a third-party SIEM using the Log Forwarding profile. The SIEM expects logs in a specific format and requires that only threat logs be forwarded. The engineer configures a Log Forwarding profile with a match list for threat logs and assigns it to a security policy rule. However, the SIEM is receiving all traffic logs as well. What is the most likely misconfiguration?
A DevOps engineer is using the PAN-OS Python library (pan-os-python) to automate firewall policy updates in a CI/CD pipeline. The pipeline runs on a Linux server and must authenticate to the firewall using an API key. The engineer wants to avoid hardcoding credentials in the script. Which method should the engineer use to securely provide the API key to the script?
A security engineer is using the PAN-OS XML API to retrieve the current running configuration. The API call returns a large XML document. Which XPath should be used to extract only the security rules from the configuration?
A security team is integrating their Palo Alto Networks NGFW with a third-party SIEM using the PAN-OS XML API. They need to ensure that the API is enabled and accessible. Which two configurations are required on the NGFW to allow API access from the SIEM? (Choose two.)
An automation engineer is using the PAN-OS XML API to retrieve the list of all security rules in the running configuration. The engineer wants to minimize the amount of data returned and only get the rule names. Which API call should be used?
A security automation team is using the PAN-OS XML API to create a new address object and then reference it in a security policy rule. The script successfully creates the address object but fails when committing the configuration. The commit fails with an error indicating that the address object is not found. What is the most likely cause?
You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?
You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?
An administrator wants to trigger a script automatically when a security policy is matched. Which feature can be used to send a notification to an external web server?
In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?
In an AWS Lambda function automating firewall changes, why should you use the 'pan-os-python' library with 'xapi' directly rather than the higher-level classes?
When managing multiple firewalls through Panorama, what is the best way to ensure an automation script performs the same action on all devices in a device group?
An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?
You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?
An administrator wants to use a script to back up firewall configurations daily. Which management interface service must be enabled to allow the script to download the config file?
A security engineer is writing a Python script to automate the creation of a security rule on a Palo Alto Networks NGFW using the PAN-OS XML API. The script must ensure that the rule is placed in the correct position in the rulebase and that the configuration is committed. Which sequence of API calls should the script perform?
An engineer is writing a Python script using the pan-os-python library to update an address group on a PA-VM firewall. The script must ensure that the change is only staged and not committed until a separate approval process completes. Which method should be used to push the modified configuration to the firewall's candidate configuration?
A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. The engineer wants to ensure the response is in a structured format that can be easily parsed by a Python script. Which API request type should be used?
A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)
A security team wants Panorama to automatically push a new security policy rule to all managed firewalls as soon as a change is saved in a specific device group. Which Panorama feature should they configure to accomplish this?
A security engineer is using the PAN-OS XML API to update the description of an existing address object named 'WebServer' in the 'Shared' location. The API request is sent with the correct API key and the following XPath: /config/shared/address/entry[@name='WebServer']. The server responds with a '403 Forbidden' error. What is the most likely cause?
A security automation team is integrating a Palo Alto Networks NGFW with a third-party orchestration platform. The platform requires the firewall to send logs to an external syslog server for correlation. The team must configure the firewall to forward traffic logs to the syslog server. Which two configuration elements are required on the firewall to forward traffic logs to an external syslog server? (Choose two.)
An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?
An engineer is integrating a Palo Alto Networks NGFW with a CI/CD pipeline to automate policy updates. The pipeline uses the XML API and must ensure that changes are validated before committing. Which two actions are required to achieve this? (Choose two.)
A security engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the PAN-OS XML API. The script must authenticate using an API key. Which HTTP header should be used to pass the API key in the request?
A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. Which API request type should be used?
A company uses a SOAR platform to enrich and block indicators of compromise. The SOAR playbook must add malicious IP addresses to an External Dynamic List (EDL) hosted on an internal web server that the firewall already consumes. Which action should the playbook take?
A security automation script uses the XML API to retrieve logs from a Palo Alto Networks firewall. The script needs to filter logs for a specific source IP and time range. Which API request correctly retrieves the filtered logs?
A security engineer needs to programmatically create a new address object in a Palo Alto Networks NGFW using the XML API. The engineer authenticates with an API key and sends a POST request to /api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/address&element=<entry name='WebServer'><ip-netmask>10.1.1.5/32</ip-netmask></entry>. The API returns a success response. However, the address object does not appear in the candidate configuration when checked via the web interface. What is the most likely cause?
An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?
A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)
A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?
An engineer is automating a Next-Generation Firewall to dynamically register IP addresses from a custom cloud inventory system. The solution must update a Dynamic Address Group (DAG) using the XML API. After authenticating, the engineer sends a request to the /api/?type=user-id&action=set endpoint with an XML payload containing <entry ip="10.1.1.5" persistent="0"/> inside a <register> tag. The API responds with success, but the address does not appear in the DAG. What is the most likely cause?
A security team is integrating a Next-Generation Firewall with an orchestration platform using the XML API. The platform needs to retrieve the current running configuration of a specific security policy rule named 'Allow-Web'. Which API request should the engineer use?
An automation engineer is deploying a new firewall using a bootstrapping process. The engineer needs to ensure that the firewall automatically registers with Panorama and receives its license and configuration after the initial boot. Which component must be included in the bootstrap package to enable automatic registration with Panorama?
A security automation team uses the PAN-OS XML API to programmatically create a new security policy rule. The script authenticates with an API key and sends a POST request to the firewall. The API returns a success status, but the rule does not appear in the web interface. What is the most likely reason?
An automation engineer is using the PAN-OS XML API to modify an existing security policy rule. The script retrieves the current rule configuration, changes the action from 'allow' to 'deny', and sends the updated XML back to the firewall. However, the API returns an error indicating that the rule already exists. What is the most likely cause?
An administrator needs to automate the process of updating a dynamic address group based on external threat intelligence. Which PAN-OS feature allows the firewall to automatically update the group members from an external HTTP source?