NGFW-Engineer Integration And Automation Practice Test 6 — 15 Questions

Question 1

Which CLI command displays the API key if already generated for an admin?

Accepted Answer

The API key cannot be retrieved via CLI.. Actually, the API key is never displayed via CLI once created. The admin must regenerate it if forgotten.

Answer

show admin api-key

Answer

show config running

Answer

debug management-plane show-keys

Question 2

You are configuring an External Dynamic List (EDL) on the firewall. What is the required format for the list file?

Accepted Answer

Plain text. EDLs must be text files containing entries separated by newlines, with specific formatting depending on the type (IP, Domain, or URL).

Answer

JSON

Answer

XML

Answer

CSV

Question 3

You are troubleshooting a REST API integration issue where the firewall returns '400 Bad Request'. What should you check first?

Accepted Answer

The request payload syntax.. A 400 error indicates that the request sent by the client is malformed or invalid according to the API schema.

Answer

The server's internal firewall status.

Answer

The network latency between client and firewall.

Answer

The API Key expiry date.

Question 4

Which tool in the Palo Alto Networks ecosystem is designed specifically for automated orchestration of security workflows?

Accepted Answer

Cortex XSOAR. Cortex XSOAR is the industry-leading SOAR platform designed for security orchestration and automation.

Answer

Panorama

Answer

AutoFocus

Answer

Expedition

Question 5

When using the Panorama API to push a configuration, what is the 'xpath' parameter used for?

Accepted Answer

To define the XML path of the object to modify.. The 'xpath' specifies the exact location in the configuration hierarchy where the change is being applied.

Answer

To set the commit message.

Answer

To authenticate the API session.

Answer

To specify the target firewall IP.

Question 6

Which file type is required for an External Dynamic List (EDL) to function correctly?

Accepted Answer

Plain text (.txt). EDLs expect raw text files formatted appropriately for the list type, accessible via HTTP/HTTPS.

Answer

Binary (.bin)

Answer

Executable (.exe)

Answer

Encrypted (.zip)

Question 7

What is the purpose of the 'Pan-OS-Python' library's 'refresh_from_candidate' method?

Accepted Answer

To sync the Python object with the firewall's config.. This method updates the local Python object state to match the firewall's current candidate configuration.

Answer

To delete the configuration object.

Answer

To save the running config.

Answer

To commit the changes to the device.

Question 8

In an AWS Lambda function automating firewall changes, why should you use the 'pan-os-python' library with 'xapi' directly rather than the higher-level classes?

Accepted Answer

To reduce latency and overhead in serverless environments.. In serverless environments like Lambda, managing long-lived sessions or complex object hierarchies is often less efficient than raw XML requests via XAPI.

Answer

To avoid installing dependencies.

Answer

Because higher-level classes are not compatible with Python.

Answer

To bypass authentication requirements.

Question 9

When managing multiple firewalls through Panorama, what is the best way to ensure an automation script performs the same action on all devices in a device group?

Accepted Answer

Targeting the device group via the API.. The API allows targeting the device group directly, which Panorama then propagates to the individual firewalls.

Answer

Looping through each firewall IP.

Answer

Manually logging into each firewall.

Answer

Using a broadcast address.

Question 10

What is the default port for the Panorama XML API?

Accepted Answer

443. The XML API operates over the standard HTTPS port, 443.

Answer

80

Answer

22

Answer

8080

Question 11

An administrator is using the 'pan-os-python' library to automate address object creation. The script succeeds, but objects do not appear in the GUI. What is missing?

Accepted Answer

The 'commit()' method was not called.. The script modifies the candidate configuration; a 'commit' must be performed to push those changes to the running configuration.

Answer

The object is hidden in the GUI.

Answer

The API key has insufficient scope.

Answer

The object was not defined as a constant.

Question 12

An administrator needs to quickly identify if an API call was successful from the firewall side. Which log should be reviewed?

Accepted Answer

System logs. The 'System' logs contain entries for web interface and API interactions.

Answer

Traffic logs

Answer

Threat logs

Answer

URL logs

Question 13

Which TWO actions are required to successfully integrate a new External Dynamic List (EDL)?

Accepted Answer

Configure the refresh interval.. You must define the source URL and set the update frequency in the EDL object.

Answer

Install an SSL certificate for the list source.

Answer

Enable threat prevention logs.

Answer

Restart the firewall.

Question 14

In a complex automation environment, how can you ensure the integrity of the firewall configuration across multiple automated runs?

Accepted Answer

Performing periodic 'get' requests to verify current state against the desired state.. Regularly fetching and verifying the 'running-config' against a known-good baseline or source-of-truth is critical for integrity.

Answer

Using only the CLI.

Answer

Disabling the API after every run.

Answer

Using only static IP addresses.

Question 15

Which THREE configuration items are required in the 'init-cfg.txt' file for a VM-Series firewall to join a Panorama server?

Accepted Answer

panorama-server. The Panorama IP, the serial number (or auth code), and the device group are standard parameters.

Answer

proxy-server

Answer

dhcp-client