NGFW-Engineer Integration And Automation Practice Test 3 — 15 Questions

Question 1

An engineer needs to configure a PAN-OS firewall to send logs to an external SIEM using a custom log format. The SIEM expects logs in JSON format. Which action should the engineer take?

Accepted Answer

Create a syslog server profile with the JSON format and attach it to a log forwarding profile.. To send logs in JSON format, the engineer must configure a syslog server profile with the desired format and then apply it through a log forwarding profile. This ensures that logs are forwarded with the correct structure to the SIEM. Other options either do not exist or misapply configuration settings.

Answer

Enable the 'JSON Logging' option in the management interface settings.

Answer

Configure a custom log format using regular expressions in the log forwarding profile.

Answer

Use the 'set log-format json' command in the CLI to globally change log output.

Question 2

An administrator is integrating a Next-Generation Firewall with a cloud-based SIEM using the PAN-OS XML API. The SIEM will periodically query the firewall for threat logs. Which two API request parameters are required to retrieve threat logs via the XML API? (Choose two.)

Accepted Answer

type=log. To retrieve threat logs via the PAN-OS XML API, the request must include 'type=log' to indicate a log query and 'log-type=threat' to specify the threat log type. These two parameters are necessary. Other parameters like API key are for authentication, and query parameters are optional for filtering. The API will return threat logs in XML format, which the SIEM can then parse.

Answer

query=(subtype eq threat)

Answer

key=<API_KEY>

Answer

action=get

Question 3

An administrator is integrating a Palo Alto Networks NGFW with Ansible to enforce security policies. The playbook must retrieve the current running configuration in a structured, machine-readable format for auditing. Which Ansible module or approach should be used to accomplish this?

Accepted Answer

Use the panos_export module to export the running configuration as a XML file, then parse it.. The panos_export module is designed to export the running configuration from a Palo Alto Networks firewall in XML format. This output is structured and machine-readable, making it suitable for auditing and integration with other systems. Other modules either do not provide the full configuration or require additional parsing, making them less efficient for this scenario.

Answer

Use the panos_op module to execute 'show config running' and parse the XML output.

Answer

Use the panos_config module with the 'get' operation to fetch the running configuration.

Answer

Use the panos_facts module to gather system facts, which includes the running configuration.

Question 4

An administrator is automating firewall policy updates using the PAN-OS XML API. The script must modify an existing security rule to change its action from 'allow' to 'deny'. The script constructs an XML payload and sends it to the firewall. Which API request type and action should be used to modify the existing security rule in the candidate configuration?

Accepted Answer

type=config&action=set. To modify an existing security rule in the candidate configuration, the XML API request type=config&action=set should be used. This action updates the specified configuration element with the provided values. Other actions like delete would remove the rule, while type=op is for operational commands. The set action is the standard way to create or modify configuration objects via the API.

Answer

type=config&action=delete

Answer

type=config&action=edit

Answer

type=op&cmd=deny

Question 5

An automation team is using the PAN-OS XML API to manage security policies across multiple firewalls. They need to ensure that their API calls are authenticated and authorized. The team has generated an API key for a service account with the necessary permissions. Which HTTP header should be included in the API request to authenticate using the API key?

Accepted Answer

Include the API key as a query parameter named 'key' in the URL.. The PAN-OS XML API authenticates requests by requiring the API key to be included as a query parameter named 'key'. This is the documented and supported method. Other methods like Authorization headers or cookies are not used by the API. Therefore, the correct approach is to append the API key to the URL.

Answer

Set the 'apikey' cookie in the HTTP request headers.

Answer

Authorization: Bearer <api_key>

Answer

X-PAN-KEY: <api_key>

Question 6

A DevOps team is automating firewall policy deployment using Panorama. They need to create a new security rule that references an existing address object and a service object. The script uses the pan-os-python library. After running the script, the rule appears in the candidate configuration but references the objects by name. What must the script do to ensure the rule is correctly associated with the objects?

Accepted Answer

Assign the actual address and service object instances to the rule's source and service attributes.. To create proper references in pan-os-python, you must assign the actual object instances to the security rule's attributes. Assigning names as strings results in literal values, not references. The library then generates the correct XML member elements, ensuring the rule is correctly associated with the address and service objects.

Answer

Use the firewall.op() method to commit the rule.

Answer

Ensure the rule's source and destination fields are set to the address object's name, and the service field to the service object's name.

Answer

Use the rule.add() method to automatically link the objects.

Question 7

An engineer is automating the creation of a security policy rule on a Palo Alto Networks next-generation firewall using the XML API. The rule must be placed in the 'Shared' policy and applied to all vsys. Which two parameters are required in the API request to ensure the rule is correctly positioned and applied? (Choose two.)

Accepted Answer

Ensure the XPath includes '/config/shared/rulebase/security/rules' to target the shared rulebase.. To place a security rule in the shared policy, the API request must use the correct XPath targeting the shared rulebase and specify the location as shared. The location parameter ensures the change is applied to the shared context, and the XPath points to the correct rulebase. Other parameters like vsys or type are not used for this purpose.

Answer

Include the 'vsys' parameter set to 'shared' in the API request.

Answer

Use the 'target' parameter to specify the device group or vsys for the rule.

Answer

Set the 'type' parameter to 'security' to indicate the rule type.

Question 8

A DevOps engineer is integrating a Palo Alto Networks next-generation firewall with a CI/CD pipeline. The pipeline needs to automatically update a security policy rule's source address group whenever a new application is deployed. The engineer decides to use the PAN-OS XML API. Which API operation should be used to modify the existing address group's members?

Accepted Answer

Use the 'edit' action with the xpath to the address group's member list and include the new member in the <member> element.. To add a member to an existing address group without removing others, the 'edit' action should be used with an xpath that targets the member list. This operation appends or modifies the specified member while leaving other members intact. Using 'set' on the group level would replace the entire group, which is not desired.

Answer

Use the 'get' action to retrieve the address group, modify it locally, and then use 'set' to replace the entire group.

Answer

Use the 'delete' action to remove the address group and then recreate it with the new member.

Answer

Use the 'set' action with the xpath to the address group and include the new member in the <member> element.

Question 9

An engineer is integrating a PAN-OS firewall with a cloud-based automation platform using the XML API. The platform requires authentication via API keys. Which two actions must the engineer perform to generate and use an API key securely? (Choose two.)

Accepted Answer

Include the API key in the HTTP header as 'X-PAN-KEY' for each API request.. To securely use the XML API, an engineer must generate an API key using valid admin credentials and then include it in the 'X-PAN-KEY' header for authentication. Other options are either incorrect commands, insecure practices, or unnecessary configurations.

Answer

Generate an API key using the 'request password-hash' command in the CLI.

Answer

Store the API key in plain text in the automation script for simplicity.

Answer

Configure the API key to never expire for continuous automation.

Question 10

A security engineer is automating the creation of a security policy rule using the PAN-OS XML API. The rule must be placed at a specific position in the rulebase. Which API request parameter is used to specify the insertion point?

Accepted Answer

Use the 'insert' attribute with values 'before' or 'after' and specify the reference rule name.. The PAN-OS XML API allows specifying the insertion point for a new security rule by including an 'insert' element with 'before' or 'after' attributes and the name of an existing rule. This ensures the rule is placed exactly where needed in the rulebase, which is critical for correct policy evaluation order. Other methods either do not exist or require additional steps.

Answer

Use the 'position' parameter with an integer index representing the rule's order.

Answer

Use the 'where' parameter with values 'before' or 'after' and the rule name.

Answer

Use the 'move' operation after creation to reorder the rule to the desired location.

Question 11

A security engineer is automating the deployment of a new security policy rule using the PAN-OS XML API. The rule must be placed in the 'Shared' policy and applied to all firewalls managed by Panorama. Which two API operations must be performed to ensure the policy is active on the managed firewalls? (Choose two.)

Accepted Answer

Use the 'set' action to create the security rule in the candidate configuration.. To deploy a security rule via the XML API, you must first add it to the candidate configuration using a 'set' action. Then, you must commit the candidate configuration to apply the changes. On Panorama, a commit also pushes the policy to managed firewalls. Both steps are required to make the rule active.

Answer

Use the 'push' action to send the configuration directly to managed firewalls without committing on Panorama.

Answer

Use the 'edit' action to directly modify the running configuration.

Answer

Use the 'validate' action to check the rule for syntax errors before committing.

Question 12

A DevOps engineer is using the PAN-OS XML API to automate firewall configuration. The engineer needs to ensure that only the changes made by the automation script are committed, without committing other pending changes in the candidate configuration. Which API request parameter allows the commit to be scoped to only the changes made by the script?

Accepted Answer

partial with admin parameter set to the script's admin account. To commit only the changes made by the automation script, the script should use the 'partial' parameter in the commit request along with the 'admin' parameter set to the script's admin account. This limits the commit to changes made by that admin. Other parameters like 'force' commit all changes, and 'admin' alone is not valid. The 'partial' parameter without the correct admin would not target the script's changes.

Answer

admin

Answer

partial

Answer

force

Question 13

An engineer is building an integration that uses the PAN-OS REST API to retrieve the current running configuration from a firewall. The script authenticates with an API key and calls the endpoint at /restapi/v10.1/Configuration/Devices/Localhost/deviceconfig. The response is a 200 OK but the JSON body contains no device configuration. What is the most likely cause?

Accepted Answer

The request must use the 'get' action with a 'type=config' query parameter to retrieve the running configuration.. The PAN-OS REST API requires explicit action parameters to retrieve configuration data. A simple GET to the base deviceconfig endpoint returns an empty structure because it lacks the 'action=get' and 'type=config' query parameters. Supplying these parameters instructs the API to return the running configuration, resolving the empty response while preserving the 200 OK status.

Answer

The API key was generated for an admin role that lacks permission to read the configuration.

Answer

The REST API requires an additional HTTP header, such as 'X-PAN-KEY', to be sent with the request for configuration data.

Answer

The REST API endpoint for retrieving configuration requires a 'location' query parameter specifying the vsys.

Question 14

An engineer needs to verify that a Python script using the pan-os-python library is connecting to the correct firewall and is authenticated before running a large configuration change. Which method should the script call to confirm connectivity and authentication?

Accepted Answer

firewall.op('show system info'). The op() method sends an operational command to the firewall and returns its output, making it ideal for a read-only pre-flight check. Running 'show system info' confirms authentication and connectivity, and the hostname and serial number in the response verify the script is targeting the intended device. This avoids committing or modifying configuration before the engineer is sure the connection is correct.

Answer

firewall.refresh_system_info()

Answer

firewall.add('address', 'test')

Answer

firewall.commit()

Question 15

An automation engineer is writing a Python script using the pan-os-python library to update a security policy on a Palo Alto Networks NGFW. The script must ensure that the change is committed to the running configuration and that the script can handle commit failures gracefully. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Use the sync=True parameter when calling commit() to block until the commit job completes and returns the final result.. To programmatically commit and handle failures, the script should call commit() and then check the returned job status, or use sync=True to wait for completion and catch exceptions. Both approaches allow the script to detect and respond to commit errors. The other options either use invalid parameters or do not provide a reliable way to determine commit success.

Answer

Invoke the commit() method without any parameters and then immediately call refresh() to update the local object state.

Answer

Set the commit_all=True parameter to commit changes across all vsys and device groups simultaneously.

Answer

Enable the debug=True flag on the Firewall object to log commit failures to a local file for later analysis.