NGFW-Engineer Integration And Automation Practice Test 4 — 15 Questions

Question 1

An automation script uses the PAN-OS Python SDK to modify a security policy on a firewall. The script calls the 'apply()' method on a security rule object. However, the change is not reflected in the running configuration. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'apply()' method only stages the change in the candidate configuration; a commit is required to activate it.. The PAN-OS Python SDK's 'apply()' method stages changes to the candidate configuration but does not commit them. To make changes active, a commit must be performed. The script must call a commit method after applying changes. This two-step process is standard for PAN-OS configuration management.

Answer

The 'apply()' method requires the API key to be passed as an argument.

Answer

The security rule object must be added to a rulebase before calling 'apply()'.

Answer

The 'apply()' method only works on Panorama, not on individual firewalls.

Question 2

An automation engineer is designing a Python script that will use the PAN-OS XML API to retrieve logs from a firewall for security analysis. The script must be able to filter logs based on specific criteria and handle large volumes of data efficiently. Which two parameters are essential to include in the API request to achieve this? (Choose two.)

Accepted Answer

The 'nlogs' parameter to limit the number of log entries returned.. To retrieve logs with filtering and efficient handling of large volumes, the 'query' parameter specifies the filter criteria, and the 'nlogs' parameter limits the number of entries returned per request. These two parameters directly address the requirements. Authentication and basic type are necessary but not specific to the filtering and volume handling goals.

Answer

The 'dir' parameter to specify the direction of log retrieval (forward or backward).

Answer

The 'type' parameter set to 'log'.

Answer

The 'key' parameter to authenticate the API request.

Question 3

A DevOps engineer is writing a Python script that uses the pan-os-python library to commit changes to a firewall. The script must ensure that the commit is only performed if there are no validation errors. Which method should be used to perform a validation-only commit?

Accepted Answer

Use the 'validate' method on the firewall object.. The pan-os-python library includes a 'validate' method specifically for validating the candidate configuration without committing. This method returns any validation errors, allowing the script to decide whether to proceed with a commit. Other methods either do not exist or do not provide validation-only functionality, making 'validate' the correct choice.

Answer

Use the 'commit' method with the 'validate_only' parameter set to True.

Answer

Use the 'check_commit' method to validate the configuration.

Answer

Use the 'commit' method with the 'force' parameter set to False.

Question 4

An administrator needs to retrieve a list of all security rules in the 'Shared' policy using the PAN-OS XML API. Which API call should be used?

Accepted Answer

type=config&action=get&xpath=/config/shared/rule. To retrieve configuration data such as security rules, the XML API uses the 'get' action with an XPath that specifies the location of the rules. The 'type=config' parameter indicates a configuration API call. This returns the rules in XML format, which can be parsed by automation scripts.

Answer

type=keygen&user=admin&password=admin

Answer

type=op&cmd=

Answer

type=config&action=set&xpath=/config/shared/rule

Question 5

A DevOps engineer is integrating a Palo Alto Networks firewall with a CI/CD pipeline to automatically update security policies based on application deployments. The pipeline uses the XML API to push policy changes. Which authentication method is recommended for secure, non-interactive automation?

Accepted Answer

Generate an API key using the admin credentials and use it in subsequent API requests.. For secure, non-interactive automation with the PAN-OS XML API, generating an API key from admin credentials and using that key in requests is the recommended approach. It avoids storing passwords in scripts and allows granular revocation. Other methods like basic auth or certificate-based auth are either insecure or not applicable.

Answer

Use OAuth 2.0 tokens obtained from an external identity provider.

Answer

Use the admin username and password in each API request.

Answer

Configure certificate-based authentication for the API and use client certificates.

Question 6

A DevOps engineer is integrating a Palo Alto Networks NGFW with a CI/CD pipeline. The pipeline uses a REST API call to retrieve the current security policy from the firewall for validation. The API request is GET https://firewall/api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security&key=APIKEY. The response is a 403 Forbidden error. The API key is valid and has superuser role. What is the most likely reason for the 403 error?

Accepted Answer

The firewall's management interface does not allow API access from the source IP address of the CI/CD pipeline.. A 403 Forbidden error with a valid API key and superuser role typically points to an access restriction at the management interface level. The firewall can be configured to allow API access only from specific IP addresses. If the CI/CD pipeline's source IP is not in the allowed list, the request is denied. Checking the management interface settings and adding the pipeline's IP address resolves the issue.

Answer

The API key must be passed in the HTTP header as X-PAN-KEY instead of as a query parameter.

Answer

The API key has expired and must be regenerated using the CLI command request api-key generate.

Answer

The xpath expression is invalid because it uses single quotes around 'vsys1', which must be double quotes.

Question 7

A network engineer needs to automate the retrieval of the current commit history from a Palo Alto Networks firewall using the XML API. The engineer wants to include the last 10 commit jobs and their statuses in a report. Which API request should be used?

Accepted Answer

Send a GET request to /api/?type=op&cmd=. To retrieve commit history via the XML API, you must use an operational command with 'type=op' and a 'cmd' parameter containing the CLI command 'show jobs all'. This returns all jobs, including commits, with details such as status, user, and completion time. The other options use incorrect API parameters or target configuration data instead of operational state.

Answer

Send a POST request to /api/?type=config&action=get&xpath=/config/devices/entry/jobs

Answer

Send a GET request to /api/?type=report&reporttype=commitlog

Answer

Send a GET request to /api/?type=commit&action=history

Question 8

An administrator is using the PAN-OS XML API to automate the creation of a security policy rule. The rule must include a source zone, destination zone, and application. Which THREE elements are required in the API request payload to successfully create the rule? (Choose three.)

Accepted Answer

untrust. To create a security rule via the PAN-OS XML API, the request payload must include the source zone (), destination zone (), and application () elements. These define the traffic match criteria and are mandatory for the rule to be valid. While other elements like source IP and action are also important, the question specifically asks for the three elements related to zone and application, making those the correct selections.

Answer

<action>allow</action>

Answer

Question 9

A security engineer is writing a Python script using the 'pan-os-python' library to automate the creation of a security policy rule. The script creates a Rule object, sets its properties, and then calls 'rule.create()'. However, the rule does not appear on the firewall. What is the most likely reason?

Accepted Answer

The script must commit the change using 'fw.commit()' after creating the rule.. In 'pan-os-python', configuration changes are staged in the candidate configuration. Calling 'create()' on a Rule object adds it to the candidate but does not apply it. A commit operation is necessary to activate the change. The script must call 'commit()' on the firewall or Panorama instance to make the rule active.

Answer

The script must use the 'xapi' module directly because 'pan-os-python' does not support rule creation.

Answer

The Rule object must be added to a Rulebase object before calling 'create()'.

Answer

The script must call 'rule.apply()' instead of 'rule.create()'.

Question 10

A security administrator wants to automate the retrieval of the current running configuration from a Palo Alto Networks NGFW using the XML API. The administrator needs to save the configuration to a file for backup purposes. Which API request should be used?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config&key=APIKEY. The XML API's config type with action=get and xpath=/config returns the entire running configuration in XML. This is the correct way to programmatically retrieve the configuration for backup. Other actions or types either do not return the full configuration or are used for different purposes, such as operational commands or file exports.

Answer

GET /api/?type=config&action=show&key=APIKEY

Answer

GET /api/?type=op&cmd=&key=APIKEY

Answer

GET /api/?type=export&category=configuration&key=APIKEY

Question 11

A security engineer is integrating a Palo Alto Networks NGFW with a custom threat intelligence platform. The platform provides a list of malicious IP addresses that must be dynamically blocked. The engineer wants to use the XML API to register the platform as an external dynamic list (EDL) source. Which API call correctly configures an EDL named 'MaliciousIPs' with a URL of 'https://threat.example.com/ips'?

Accepted Answer

type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/external-list/entry[@name='MaliciousIPs']&element=https://threat.example.com/ips. To configure an EDL via the XML API, use the 'set' action with an XPath that targets the external-list entry within the appropriate vsys. The element must specify the type (IP) and the URL. This stages the configuration, which then requires a commit. The vsys-specific XPath ensures the EDL is applied correctly.

Answer

type=op&cmd=

https://threat.example.com/ips

Answer

type=config&action=set&xpath=/config/shared/external-list/entry[@name='MaliciousIPs']&element=https://threat.example.com/ips

Answer

type=config&action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/external-list&element=https://threat.example.com/ips

Question 12

An administrator is using the pan-os-python library to automate firewall configuration. The script creates a new address object and adds it to a security policy rule. After running the script, the address object exists in the candidate configuration, but the security policy rule does not reference it. The script uses the following code: address_object.create(), then security_rule.add(address_object), then security_rule.update(). What is the most likely reason the rule does not reference the address object?

Accepted Answer

The security_rule.add() method must be called after the rule has been created on the firewall and fetched into the script.. The pan-os-python library requires that when modifying an existing security rule, the rule object must be fetched from the firewall to ensure it corresponds to the actual configuration. If the script creates a new rule object without fetching the existing rule, the add() and update() methods will not modify the intended rule. Thus, the address object is not referenced in the actual rule.

Answer

The address object must be committed before it can be referenced in a security rule.

Answer

The security_rule.add() method requires the address object to be a member of a static group, not a standalone object.

Answer

The security_rule.update() method does not automatically persist changes; a separate call to apply() or a commit is needed to save the rule.

Question 13

An engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the Palo Alto Networks PAN-OS Python library (pan-os-python). The script needs to create an address object and then immediately use it in a security policy rule. Which sequence of method calls should the engineer use to ensure the address object is available for reference in the policy rule?

Accepted Answer

Create the address object, call 'create()' on it, then commit the candidate configuration, then create the security rule and commit again.. The most reliable sequence is to create the address object, commit it to the running configuration, then create the security rule and commit again. This ensures the address object is fully available and avoids any dependency or ordering issues. While creating both in the candidate configuration and committing once can work, committing the object first provides a clear separation and guarantees availability, which is important in automated environments where other processes might depend on the object.

Answer

Create the address object, call 'create()' on it, then create the security rule and call 'create()' on it, then call 'commit()' on the firewall object.

Answer

Create the address object, call 'apply()' on it, then create the security rule and call 'apply()' on it.

Answer

Create the address object, call 'create()' on it, then create the security rule and call 'create()' on it.

Question 14

A security engineer is integrating a Palo Alto Networks NGFW with a third-party SIEM using the Log Forwarding profile. The SIEM expects logs in a specific format and requires that only threat logs be forwarded. The engineer configures a Log Forwarding profile with a match list for threat logs and assigns it to a security policy rule. However, the SIEM is receiving all traffic logs as well. What is the most likely misconfiguration?

Accepted Answer

The Log Forwarding profile's match list includes a rule that forwards traffic logs in addition to threat logs.. The Log Forwarding profile contains a match list that determines which log types are forwarded. To forward only threat logs, the match list must contain only a threat log entry. If it also contains a traffic log entry, traffic logs will be forwarded. The engineer should edit the profile to remove any traffic log match entries, ensuring only threat logs are sent to the SIEM.

Answer

The Log Forwarding profile was assigned to the wrong security policy rule.

Answer

The SIEM is configured to receive logs from all sources, and the firewall is sending them by default.

Answer

The security policy rule has both a Log Forwarding profile and a Log Setting that forwards all logs.

Question 15

A DevOps engineer is using the PAN-OS Python library (pan-os-python) to automate firewall policy updates in a CI/CD pipeline. The pipeline runs on a Linux server and must authenticate to the firewall using an API key. The engineer wants to avoid hardcoding credentials in the script. Which method should the engineer use to securely provide the API key to the script?

Accepted Answer

Store the API key in an environment variable and read it in the script using os.environ.. Environment variables are the most secure and practical way to provide API keys to automation scripts. They keep secrets out of source code and can be managed by the CI/CD system's secret store. The script can read the key and pass it to the pan-os-python Firewall object. This method aligns with security best practices and is easy to implement without additional dependencies.

Answer

Store the API key in a text file on the server and read it in the script using file I/O.

Answer

Embed the API key in the script but encrypt it with a symmetric cipher and decrypt at runtime.

Answer

Use the firewall's username and password in the script and generate an API key at runtime.