NGFW-Engineer Integration And Automation Practice Test 5 — 15 Questions

Question 1

A security engineer is using the PAN-OS XML API to retrieve the current running configuration. The API call returns a large XML document. Which XPath should be used to extract only the security rules from the configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/config/devices/entry/vsys/entry/rulebase/security/rules. The correct XPath to retrieve only security rules is '/config/devices/entry/vsys/entry/rulebase/security/rules'. This path precisely targets the security rules container, avoiding unrelated configuration data. Other paths either include too much or are not specific enough.

Answer

/config/devices/entry/vsys/entry/rulebase

Answer

/config/devices/entry/vsys/entry/rulebase/security

Answer

/config/devices/entry/vsys/entry/rulebase/security/rules/entry

Question 2

A security team is integrating their Palo Alto Networks NGFW with a third-party SIEM using the PAN-OS XML API. They need to ensure that the API is enabled and accessible. Which two configurations are required on the NGFW to allow API access from the SIEM? (Choose two.)

Accepted Answer

Configure a management interface profile that allows HTTPS access from the SIEM's IP address.. To allow XML API access from a SIEM, you need a properly permissioned admin account and management interface access. The admin role must include XML API permissions, and the management interface profile must allow HTTPS from the SIEM's IP. The XML API is enabled by default, so no separate enablement is needed. Certificates and REST API settings are not prerequisites for basic XML API access.

Answer

Enable the REST API in Device > Setup > Management.

Answer

Generate a self-signed certificate for API authentication.

Answer

Enable the XML API interface on the management plane.

Question 3

An automation engineer is using the PAN-OS XML API to retrieve the list of all security rules in the running configuration. The engineer wants to minimize the amount of data returned and only get the rule names. Which API call should be used?

Accepted Answer

/config/devices/entry/vsys/entry/rulebase/security/rules/entry/@name. The XML API's xpath parameter enables targeted retrieval of specific configuration elements. By specifying an XPath that selects only the name attributes of security rule entries, the response contains only the desired data, minimizing payload size. Other methods return the entire policy or use incorrect paths, leading to larger responses or errors. This approach is efficient for automation tasks that require only specific information.

Answer

Answer

Answer

Question 4

A security automation team is using the PAN-OS XML API to create a new address object and then reference it in a security policy rule. The script successfully creates the address object but fails when committing the configuration. The commit fails with an error indicating that the address object is not found. What is the most likely cause?

Accepted Answer

The address object was created in a different virtual system (vsys) than the security policy rule.. The most likely cause is that the address object and the security rule are in different vsys. PAN-OS requires that referenced objects exist in the same vsys as the rule that references them. If the script creates the object in one vsys and the rule in another, the commit will fail because the rule cannot resolve the object. Ensuring the correct vsys context in API calls resolves this issue.

Answer

The address object was created in the candidate configuration but not committed before referencing it in the security policy.

Answer

The API key used by the script does not have permission to commit configuration changes.

Answer

The address object name contains uppercase letters, which are not allowed in PAN-OS object names.

Question 5

You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?

Accepted Answer

init-cfg.txt. The 'init-cfg.txt' file is required for bootstrapping and contains the Panorama IP and authorization key to register the VM.

Answer

license.txt

Answer

bootstrap.xml

Answer

config.cfg

Question 6

An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?

Accepted Answer

panos_security_rule. The 'panos_security_rule' resource is the standard Terraform resource for managing security policies on Palo Alto Networks devices.

Answer

panos_firewall_rule

Answer

panos_policy_rule

Answer

panos_security_policy

Question 7

You are troubleshooting a REST API integration where Python scripts are failing to retrieve device information. The API returns a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account lacks permissions for the requested object.. A 403 error indicates that the API key provided has insufficient permissions or the admin account associated with the key lacks the necessary role to access the resource.

Answer

The API Key is expired.

Answer

The JSON body is malformed.

Answer

The API endpoint URL is incorrect.

Question 8

Which feature allows an NGFW to dynamically update security objects based on an external feed such as an IP list or URL list?

Accepted Answer

External Dynamic Lists. External Dynamic Lists (EDL) allow the firewall to consume lists from external web servers and use them in policies automatically.

Answer

User-ID Mapping

Answer

Log Forwarding Profiles

Answer

Dynamic Address Objects

Question 9

An administrator wants to trigger a script automatically when a security policy is matched. Which feature can be used to send a notification to an external web server?

Accepted Answer

Log Forwarding Profile (HTTP destination). Log Forwarding Profiles allow for HTTP/S integration to send notifications to webhooks or external servers when a log is generated.

Answer

SNMP Trap Profile

Answer

Service Route Configuration

Answer

Syslog Server Profile

Question 10

In a cloud-init deployment, which directory must the bootstrap package be placed for the VM-Series firewall to automatically detect and process it during the first boot?

Accepted Answer

/config/bootstrap/. The VM-Series looks for a specific directory structure on the attached storage device, starting with '/config/bootstrap/'.

Answer

/var/bootstrap/

Answer

/etc/bootstrap/

Answer

/opt/paloalto/

Question 11

If a Python script interacting with the XML API experiences '503 Service Unavailable', what is the most likely reason?

Accepted Answer

The Management Plane is overloaded.. A 503 error often indicates that the management plane is overloaded, or the XML API service is busy processing a previous command.

Answer

The endpoint is incorrect.

Answer

The API Key is invalid.

Answer

SSL handshake failed.

Question 12

When using the Panorama XML API for a batch operation, what is the purpose of the 'type=config' parameter?

Accepted Answer

To perform configuration changes.. 'type=config' is used to perform create, read, update, or delete operations on the device configuration.

Answer

To commit changes.

Answer

To export configuration.

Answer

To fetch operational data.

Question 13

You need to automate the retrieval of URL filtering logs from the firewall. Which API endpoint type is used to execute a 'show' command?

Accepted Answer

type=op. The 'op' type is used to execute operational commands, including 'show' commands to retrieve logs or status.

Answer

type=show

Answer

type=log

Answer

type=config

Question 14

What is the primary benefit of using Panorama templates for automation?

Accepted Answer

They provide a single point to manage shared network configuration.. Templates allow for centralized network configuration management, ensuring consistency across firewalls.

Answer

They replace the need for API access.

Answer

They automatically update firewall firmware.

Answer

They automate the hardware installation process.

Question 15

When automating log forwarding to an external SIEM, what is the best practice regarding the management plane load?

Accepted Answer

Use Log Collectors to offload log processing.. Offloading log management to dedicated log collectors or using efficient forwarding profiles prevents management plane degradation.

Answer

Enable debug logging on all policies.

Answer

Increase the log rate limit on the firewall.

Answer

Send logs via serial console.