NGFW-Engineer Integration And Automation Practice Test 3 — 15 Questions

Question 1

You are troubleshooting a REST API integration issue where the firewall returns '400 Bad Request'. What should you check first?

Accepted Answer

The request payload syntax.. A 400 error indicates that the request sent by the client is malformed or invalid according to the API schema.

Answer

The server's internal firewall status.

Answer

The network latency between client and firewall.

Answer

The API Key expiry date.

Question 2

Which tool in the Palo Alto Networks ecosystem is designed specifically for automated orchestration of security workflows?

Accepted Answer

Cortex XSOAR. Cortex XSOAR is the industry-leading SOAR platform designed for security orchestration and automation.

Answer

Panorama

Answer

AutoFocus

Answer

Expedition

Question 3

When using the Panorama API to push a configuration, what is the 'xpath' parameter used for?

Accepted Answer

To define the XML path of the object to modify.. The 'xpath' specifies the exact location in the configuration hierarchy where the change is being applied.

Answer

To set the commit message.

Answer

To authenticate the API session.

Answer

To specify the target firewall IP.

Question 4

Which file type is required for an External Dynamic List (EDL) to function correctly?

Accepted Answer

Plain text (.txt). EDLs expect raw text files formatted appropriately for the list type, accessible via HTTP/HTTPS.

Answer

Binary (.bin)

Answer

Executable (.exe)

Answer

Encrypted (.zip)

Question 5

What is the purpose of the 'Pan-OS-Python' library's 'refresh_from_candidate' method?

Accepted Answer

To sync the Python object with the firewall's config.. This method updates the local Python object state to match the firewall's current candidate configuration.

Answer

To delete the configuration object.

Answer

To save the running config.

Answer

To commit the changes to the device.

Question 6

In an AWS Lambda function automating firewall changes, why should you use the 'pan-os-python' library with 'xapi' directly rather than the higher-level classes?

Accepted Answer

To reduce latency and overhead in serverless environments.. In serverless environments like Lambda, managing long-lived sessions or complex object hierarchies is often less efficient than raw XML requests via XAPI.

Answer

To avoid installing dependencies.

Answer

Because higher-level classes are not compatible with Python.

Answer

To bypass authentication requirements.

Question 7

When managing multiple firewalls through Panorama, what is the best way to ensure an automation script performs the same action on all devices in a device group?

Accepted Answer

Targeting the device group via the API.. The API allows targeting the device group directly, which Panorama then propagates to the individual firewalls.

Answer

Looping through each firewall IP.

Answer

Manually logging into each firewall.

Answer

Using a broadcast address.

Question 8

What is the default port for the Panorama XML API?

Accepted Answer

443. The XML API operates over the standard HTTPS port, 443.

Answer

80

Answer

22

Answer

8080

Question 9

An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?

Accepted Answer

The 'commit()' method was not called.. The script modifies the candidate configuration; a 'commit' must be performed to push those changes to the running configuration.

Answer

The object is hidden in the GUI.

Answer

The API key has insufficient scope.

Answer

The object was not defined as a constant.

Question 10

An administrator needs to quickly identify if an API call was successful from the firewall side. Which log should be reviewed?

Accepted Answer

System logs. The 'System' logs contain entries for web interface and API interactions.

Answer

Traffic logs

Answer

Threat logs

Answer

URL logs

Question 11

Which TWO actions are required to successfully integrate a new External Dynamic List (EDL)?

Accepted Answer

Configure the refresh interval.. You must define the source URL and set the update frequency in the EDL object.

Answer

Install an SSL certificate for the list source.

Answer

Enable threat prevention logs.

Answer

Restart the firewall.

Question 12

In a complex automation environment, how can you ensure the integrity of the firewall configuration across multiple automated runs?

Accepted Answer

Performing periodic 'get' requests to verify current state against the desired state.. Regularly fetching and verifying the 'running-config' against a known-good baseline or source-of-truth is critical for integrity.

Answer

Using only the CLI.

Answer

Disabling the API after every run.

Answer

Using only static IP addresses.

Question 13

Which THREE configuration items are required in the 'init-cfg.txt' file for a VM-Series firewall to join a Panorama server?

Accepted Answer

panorama-server. The Panorama IP, the serial number (or auth code), and the device group are standard parameters.

Answer

proxy-server

Answer

dhcp-client

Question 14

Which TWO types of files can be included in a bootstrap package?

Accepted Answer

init-cfg.txt. Init-cfg.txt and software images are common components of bootstrap packages.

Answer

Hardware drivers.

Answer

SSL Certificate private key.

Answer

Binary user database.

Question 15

Which TWO methods can be used to update the security policy on a Palo Alto Networks NGFW programmatically?

Accepted Answer

REST API.. The XML API and the REST API (on newer versions) are the primary programmatic methods.

Answer

FTP configuration upload.

Answer

SNMP SET commands.

Answer

Serial console access.