NGFW-Engineer Integration And Automation Practice Test 7 — 15 Questions

Question 1

Which TWO types of files can be included in a bootstrap package?

Accepted Answer

init-cfg.txt. Init-cfg.txt and software images are common components of bootstrap packages.

Answer

Hardware drivers.

Answer

SSL Certificate private key.

Answer

Binary user database.

Question 2

Which TWO methods can be used to update the security policy on a Palo Alto Networks NGFW programmatically?

Accepted Answer

REST API.. The XML API and the REST API (on newer versions) are the primary programmatic methods.

Answer

FTP configuration upload.

Answer

SNMP SET commands.

Answer

Serial console access.

Question 3

Which THREE data sources can an NGFW use to dynamically populate address objects?

Accepted Answer

External Dynamic Lists.. EDLs, User-ID mapping, and API-based injection are primary methods.

Answer

Static IP addresses only.

Answer

Manual packet captures.

Question 4

Which THREE actions should be performed during a standard automation failure troubleshooting process?

Accepted Answer

Validate API key permissions for the target object.. Check logs, verify credentials, and test connectivity to the management interface.

Answer

Update the hardware firmware.

Answer

Perform a factory reset of the firewall.

Question 5

Which TWO protocols are commonly used for log forwarding to SIEMs?

Accepted Answer

HTTPS. Syslog (E) is correct because it is the de facto standard protocol for forwarding log and event messages from network devices, servers, and appliances to a central SIEM collector, typically over UDP/TCP port 514 or TLS port 6514. HTTPS (B) is correct because many SIEM and log-ingestion APIs accept log data over HTTPS (TCP 443), providing encryption and authentication for agent- or API-based forwarding. DNS (A) is a name-resolution protocol, not a log transport, so it does not belong. ICMP (C) is used for diagnostics and error messaging (e.g., ping), not log delivery. Telnet (D) is a cleartext remote-terminal protocol and is not used for forwarding logs to SIEMs.

Answer

DNS

Answer

ICMP

Answer

Telnet

Question 6

You are automating firewall policy updates using the XML API. You have successfully authenticated and retrieved an API key. When attempting to perform an 'edit' operation on a security policy, the API returns an 'Invalid Object' error, even though the object exists in the GUI. What is the most likely cause?

Accepted Answer

The XPath in the API call does not correctly specify the Device Group or Vsys context.. The XML API requires precise XPath syntax. If the object exists in the GUI but the API fails, it is often due to the object being nested within a specific Device Group or Vsys that was not properly specified in the XPath.

Answer

The API key does not have the 'Superuser' role.

Answer

The XML document must be wrapped in a <request> tag.

Answer

The API service is disabled on the management interface.

Question 7

When utilizing the Panorama plugin for AWS, what is the primary benefit of the 'S3 bucket' integration for log ingestion?

Accepted Answer

It provides a scalable destination for log archival and external analysis.. The S3 integration allows the firewall to offload logs to cloud storage, providing long-term retention and cost-effective storage for compliance without requiring local disk expansion.

Answer

It enables real-time packet inspection of S3 traffic.

Answer

It automatically updates the device's software version.

Answer

It acts as a primary firewall policy source.

Question 8

An administrator wants to use a script to back up firewall configurations daily. Which management interface service must be enabled to allow the script to download the config file?

Accepted Answer

XML API. The XML API is the standard method for scripts to programmatically export configurations (running-config).

Answer

SNMP

Answer

Telnet

Answer

SSH

Question 9

Which Palo Alto Networks tool provides a programmatic interface to automate firewall configuration and operational tasks via Python?

Accepted Answer

Pan-python. Pan-python is the standard library provided by Palo Alto Networks for interacting with the XML API using Python.

Answer

GlobalProtect API

Answer

ACC (Application Command Center)

Answer

Panorama XML CLI

Question 10

A security engineer is writing a Python script to automate the creation of a security rule on a Palo Alto Networks NGFW using the PAN-OS XML API. The script must ensure that the rule is placed in the correct position in the rulebase and that the configuration is committed. Which sequence of API calls should the script perform?

Accepted Answer

Use 'set' to create the rule, then 'move' to position it, then 'commit' to apply the changes.. To create and position a security rule via the XML API, the script must first use 'set' to add the rule to the candidate configuration. Then, it must use 'move' with appropriate parameters to specify the rule's position relative to other rules. Finally, 'commit' applies the candidate configuration to the running configuration.

Answer

Use 'edit' to create the rule, then 'commit' to apply the changes.

Answer

Use 'set' to create the rule, then 'commit' with a 'partial' parameter to apply only the rule change.

Answer

Use 'set' to create the rule with a specific 'loc' attribute, then 'commit' to apply the changes.

Question 11

An engineer is writing a Python script using the pan-os-python library to update an address group on a PA-VM firewall. The script must ensure that the change is only staged and not committed until a separate approval process completes. Which method should be used to push the modified configuration to the firewall's candidate configuration?

Accepted Answer

firewall.apply(). The requirement is to stage a configuration change without committing it. The apply() method in pan-os-python synchronizes the local object's state to the firewall's candidate configuration, leaving the commit for a later step. commit() would immediately apply the change, add() only creates new objects, and op() is for operational commands.

Answer

firewall.commit(sync=True)

Answer

firewall.add(address_group)

Answer

firewall.op('edit')

Question 12

A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. The engineer wants to ensure the response is in a structured format that can be easily parsed by a Python script. Which API request type should be used?

Accepted Answer

type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']. To retrieve configuration data in a structured XML format suitable for parsing, the type=config API with action=get and an XPath is the correct approach. Operational commands return text blobs, keygen is for authentication, and export is for file downloads.

Answer

type=op&cmd=

Answer

type=export&category=configuration

Answer

type=keygen&user=admin&password=admin

Question 13

A security engineer is automating the deployment of security policies using Panorama and the PAN-OS XML API. The engineer must ensure that the API calls are properly authenticated and that the changes are committed to the managed firewalls. Which TWO steps are required to successfully push the configuration to the managed devices? (Choose two.)

Accepted Answer

Generate an API key on Panorama using an admin account with sufficient privileges.. To automate policy deployment with Panorama, first generate an API key for authentication. Then, after modifying the candidate configuration on Panorama, use the 'commit-all' action to push the changes to the managed firewalls. This ensures the policies are applied to the devices.

Answer

Use the 'set' action to modify the device group configuration directly on each managed firewall.

Answer

Use the 'validate' action to ensure the configuration is valid before committing.

Answer

Use the 'commit' action with the 'partial' parameter to commit only the policy changes to the managed devices.

Question 14

A security team wants Panorama to automatically push a new security policy rule to all managed firewalls as soon as a change is saved in a specific device group. Which Panorama feature should they configure to accomplish this?

Accepted Answer

A commit trigger that fires when the device group configuration changes.. Commit triggers in Panorama are designed for automated, event-driven configuration pushes. When a change is committed in a device group or template, the trigger can immediately commit that configuration to the managed firewalls, ensuring the new rule takes effect without waiting for a scheduled interval. This is the standard mechanism for near-real-time policy distribution from Panorama.

Answer

A dynamic address group that includes the newly created rule's source addresses.

Answer

A log forwarding profile applied to the device group.

Answer

A scheduled commit that runs every five minutes on all managed devices.

Question 15

A security engineer is using the PAN-OS XML API to update the description of an existing address object named 'WebServer' in the 'Shared' location. The API request is sent with the correct API key and the following XPath: /config/shared/address/entry[@name='WebServer']. The server responds with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The admin account used to generate the API key lacks write permission for the 'Shared' location.. The 403 Forbidden response indicates an authorization failure. Even with a valid API key, the admin account's role must have write permission for the target location. In this case, the 'Shared' location requires sufficient privileges to modify address objects. Checking the admin role's permissions and ensuring it includes write access to the relevant configuration area resolves the issue.

Answer

The API request is missing the required 'type=config' parameter.

Answer

The XPath is malformed and does not match any existing object.

Answer

The API key is invalid or expired.