NGFW-Engineer Integration And Automation Practice Test 2 — 15 Questions

Question 1

When automating firewall operations, which TWO CLI commands are essential for troubleshooting the management plane?

Accepted Answer

debug management-server. 'debug management-server' and 'show system resources' are vital for monitoring health.

Answer

show logdb-quota

Answer

show interface counters

Answer

test security-policy-match

Question 2

You are integrating an NGFW with Panorama for centralized management. You need to ensure that local firewall configurations are not overwritten when the device is imported into Panorama. Which setting in the Panorama > Setup > Operations tab or import process prevents this?

Accepted Answer

Select 'Merge' during the device configuration import process.. When importing a device into Panorama, the 'Import device configuration' process allows you to choose to merge or overwrite. To preserve local policy elements, one should use the 'Import into Template Stack' and 'Import into Device Group' workflows with careful selection of the 'Merge' option.

Answer

Set the device to 'Read-Only' mode in the Panorama Web UI.

Answer

Configure the local firewall as a 'Shared' device in Panorama.

Answer

Enable 'Force Template Values' on the device group.

Question 3

You are troubleshooting an issue where a third-party SIEM is not receiving logs from your NGFW. You have verified that the syslog server is reachable via ping. What is the next logical step to confirm the firewall is actually sending the packets?

Accepted Answer

Run 'test logging-server' from the CLI.. Using the CLI command 'show logging-status' or running a packet capture (tcpdump) filtered by the syslog server IP and port (typically 514) on the management interface is the definitive way to see if packets are egressing.

Answer

Restart the logd process.

Answer

Change the log format to 'BSD' in the server profile.

Answer

Increase the log buffer size in the Device > Setup menu.

Question 4

You are deploying a dynamic address group (DAG) that is populated by an external cloud platform. Which feature must be enabled on the NGFW to allow the firewall to receive these updates automatically?

Accepted Answer

VM Information Source. VM Monitoring or the use of the XML API to push IP-to-Tag mappings is required. For dynamic cloud environments, the 'VM Information Source' feature or 'User-ID agent' integration with cloud tags is typically used.

Answer

Service Route Configuration

Answer

Log Forwarding Profile

Answer

Auto-Tagging

Question 5

When integrating an NGFW with an external SIEM for log ingestion, which TWO of the following methods are natively supported for log forwarding?

Accepted Answer

SNMP Traps. SNMP Traps (A) are natively supported by NGFWs for log forwarding because the firewall can be configured to send SNMP trap notifications to an external SNMP manager or SIEM, which is a standard method for event and alert delivery. Syslog (D) is also natively supported, as NGFWs commonly provide built-in syslog forwarding profiles that send logs to external SIEM collectors over UDP/TCP port 514 or TCP/TLS port 6514. REST API push (B) is not a native log-forwarding method on most NGFWs; while REST APIs exist for management and configuration, they are not typically used to push logs to a SIEM. FTP file push (C) is not a native log-forwarding mechanism, as FTP is a file-transfer protocol and NGFWs do not natively push logs via FTP to SIEMs. Direct SQL query (E) is not natively supported for log forwarding because SIEMs do not query the firewall's database directly; logs must be sent to the SIEM through supported transport methods.

Answer

REST API push

Answer

FTP file push

Answer

Direct SQL query

Question 6

Which TWO actions are required to successfully integrate a new User-ID agent with an NGFW?

Accepted Answer

Configure the User-ID agent IP address in the firewall profile.. You must define the agent in the Device > User Identification > User-ID Agent menu and ensure connectivity is permitted via the management interface.

Answer

Set the agent mode to 'Syslog listener'.

Answer

Configure an IPsec tunnel to the agent.

Answer

Enable the 'User-ID' service on the external interface.

Question 7

When troubleshooting an automation script that uses the Palo Alto Networks XML API, which THREE of the following are valid methods to identify the cause of the failure?

Accepted Answer

Review the 'api.log' file on the firewall via CLI.. To debug API issues, you should check the API logs, use a tool like Postman to isolate the request, and inspect the XML response structure returned by the firewall.

Answer

Reboot the dataplane.

Answer

Increase the policy evaluation threshold.

Question 8

An engineer is integrating a Palo Alto Networks NGFW with a cloud-based orchestration platform using the PAN-OS XML API. The platform requires that every API call be authenticated and authorized. The engineer wants to avoid embedding admin credentials in scripts. Which method should be used to authenticate API requests?

Accepted Answer

Generate an API key using the 'api' command in the PAN-OS CLI with admin credentials, then include the key in subsequent API requests.. The PAN-OS XML API uses API keys for authentication. An API key is generated via the CLI using the 'api' command with valid admin credentials. The key is then passed as a parameter in subsequent API requests. This approach avoids embedding credentials in scripts and is the recommended method for automation.

Answer

Use OAuth 2.0 with a client ID and secret obtained from the Panorama OAuth server.

Answer

Embed the admin username and password directly in each API request using HTTP Basic Authentication.

Answer

Configure a certificate-based authentication profile and use mutual TLS for each API call.

Question 9

An automation engineer is writing a Python script that uses the Palo Alto Networks XML API to create a new address object and then reference it in a security policy rule. The script must make the change effective immediately without a separate commit by the administrator. Which API call should the script include after creating the address object and the security rule?

Accepted Answer

Send a request to the /api/?type=commit&cmd= endpoint with the current candidate configuration.. After making configuration changes via the XML API, a commit is necessary to apply those changes to the running configuration and make them active. The commit operation is available through the API and should be invoked programmatically to achieve immediate effect. Other operations like save or load do not perform a full commit and thus do not meet the requirement.

Answer

Use the /api/?type=config&action=set endpoint with the xpath to directly modify the running configuration.

Answer

Invoke the /api/?type=op&cmd= operation to persist the candidate configuration to the running configuration.

Answer

Call the /api/?type=op&cmd= operation to load the candidate configuration into the running configuration.

Question 10

An automation engineer is writing a Python script using the pan-os-python library to create a new address object on a firewall. The script authenticates with an API key and calls the create() method on an Address object. After running the script, the engineer notices that the address object does not appear in the candidate configuration. Which method must be called on the firewall object to make the change visible in the candidate configuration?

Accepted Answer

apply(). In pan-os-python, creating an object locally does not automatically send it to the firewall. After constructing an Address object and adding it to the Firewall object, the apply() method must be invoked to push the change into the candidate configuration. Only then does the object become part of the candidate config, where it can be committed. Without apply(), the change remains only in the script's memory.

Answer

refresh()

Answer

sync()

Answer

commit()

Question 11

A security engineer is automating the deployment of a VM-Series firewall in AWS using Terraform. The bootstrap process requires the firewall to retrieve its license and configuration from a cloud storage bucket. Which bootstrap method should be used to ensure the firewall can automatically retrieve the init-cfg.txt and license files without manual intervention?

Accepted Answer

Configure the firewall to use the AWS S3 bucket for bootstrap by specifying the S3 bucket name, region, and access keys in the init-cfg.txt, and ensure the IAM role attached to the instance has read access to the bucket.. For automated bootstrap in AWS, the VM-Series firewall retrieves its configuration from an S3 bucket specified in the init-cfg.txt. The file must include the S3 bucket name, region, and authentication details, such as access keys or an IAM role. The IAM role attached to the instance must have read permissions to the bucket.

Answer

Use the VM-Series bootstrap package from the AWS Marketplace and provide the S3 bucket name and folder in the init-cfg.txt.

Answer

Use the AWS Systems Manager Parameter Store to store the bootstrap configuration and have the firewall query it via the AWS CLI during first boot.

Answer

Use the AWS S3 bucket as the bootstrap source and configure the instance user data to include the S3 bucket path.

Question 12

A security engineer is using the PAN-OS XML API to retrieve the current running configuration for a specific virtual system. The engineer wants to ensure that the output is in a structured format that can be easily parsed by a Python script. Which API parameter should be used to specify the output format?

Accepted Answer

Include the 'output-format' parameter with a value of 'json'.. To retrieve configuration in a structured format suitable for parsing, the XML API provides the 'output-format' parameter, which can be set to 'json'. This returns the data in JSON, which is easily consumed by Python scripts. Other parameters like 'type' and 'action' define the operation but do not control the response format.

Answer

Set the 'type' parameter to 'config' and include the 'action' parameter as 'get'.

Answer

Append '&output=text' to the API request to receive plain text output.

Answer

Use the 'key' parameter to authenticate and the 'format' parameter set to 'xml'.

Question 13

An engineer is using the Palo Alto Networks XML API to add a new address object to a device group on Panorama. The API request is sent to /config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG1']/address. The response is an error indicating that the device group does not exist. After verifying that the device group name is correct, what is the most likely cause?

Accepted Answer

The API request is being sent to a firewall instead of Panorama, so the device group path is not recognized.. The error indicates the device group path is not found. Device groups are a Panorama-specific construct; firewalls do not have them. Therefore, the API request must be sent to the Panorama management interface, not to a firewall. Ensuring the correct target and XPath resolves the issue.

Answer

The address object already exists in the device group, causing a conflict error.

Answer

The XPath in the API request is targeting the wrong location; it should include the vsys or device group hierarchy correctly.

Answer

The API request must include the X-PAN-Key header containing a valid API key.

Question 14

An administrator is using the PAN-OS XML API to retrieve the current running configuration from a firewall. The API response is in XML format. Which API action should be used to get the entire running configuration?

Accepted Answer

type=op&cmd=. To retrieve the entire running configuration via the XML API, use an operational command of type 'op' with the command 'show config running'. This returns the full running configuration in XML format. The config type with 'get' action retrieves the candidate configuration, not the running one.

Answer

type=config&action=show&xpath=/config/running

Answer

type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/deviceconfig

Answer

type=config&action=get&xpath=/config

Question 15

An engineer is building a Python script that must create address objects and a security policy rule on a Palo Alto Networks next-generation firewall using the XML API. The script must authenticate without embedding credentials directly in the source code and must be safe to run from a CI/CD pipeline. (Choose two.)

Accepted Answer

Use the keygen endpoint to obtain a key, then restrict the API key's privileges by assigning the administrator account a role with only the permissions the automation requires.. The XML API authenticates requests with an API key obtained from the keygen endpoint using valid administrator credentials. For CI/CD use, the key should be stored in a secret manager rather than embedded, and the associated administrator account should be scoped to only the permissions the automation needs. Combining key-based authentication with least privilege satisfies both the no-hard-coded-credentials requirement and safe pipeline execution.

Answer

Configure a RADIUS server and use the RADIUS shared secret as the API key in the key parameter for all XML API requests.

Answer

Call the /api/?type=op&cmd=

operation to retrieve an existing key for the administrator.

Answer

Embed the administrator password in the script and pass it as the password parameter on every API call to avoid managing a separate key.