NGFW-Engineer Integration And Automation Practice Test 8 — 15 Questions

Question 1

A security automation team is integrating a Palo Alto Networks NGFW with a third-party orchestration platform. The platform requires the firewall to send logs to an external syslog server for correlation. The team must configure the firewall to forward traffic logs to the syslog server. Which two configuration elements are required on the firewall to forward traffic logs to an external syslog server? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A syslog server profile defining the server IP address and port. To forward traffic logs to an external syslog server, the firewall requires a syslog server profile that defines the server's address and port, and a log forwarding profile that matches traffic logs and references that syslog profile. The log forwarding profile is then attached to security policies. Enabling logging on a rule generates logs but does not forward them externally. Certificates and decryption policies are not required for basic syslog forwarding.

Answer

An SSL/TLS certificate for syslog communication

Answer

A decryption policy to inspect syslog traffic

Answer

A security policy rule with logging enabled at session end

Question 2

An automation script uses the PAN-OS XML API to modify a security rule. After a successful edit request, the script immediately calls the commit endpoint, but the firewall commits an older version of the rule than the script intended. The script does not use a candidate configuration lock. What is the most likely cause?

Accepted Answer

Another administrator or automation process changed the candidate configuration between the script's edit and its commit, and the commit included that other change.. The candidate configuration is shared among management sessions, and the commit operation commits whatever is in the candidate at the moment it runs. Without acquiring a config lock, a script's edit can be interleaved with changes from another session, and the subsequent commit will include those other changes. Locking the candidate before editing and releasing it after committing prevents this race condition.

Answer

The firewall rejected the edit because the rule name already existed and the API returned a success code while ignoring the change.

Answer

The edit request was applied to the running configuration instead of the candidate configuration.

Answer

The commit endpoint requires an API key with superuser role, and the script's key lacks the necessary permission, so the commit silently reverted the change.

Question 3

An engineer is integrating a Palo Alto Networks NGFW with a CI/CD pipeline to automate policy updates. The pipeline uses the XML API and must ensure that changes are validated before committing. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Use type=op&cmd= to validate the candidate configuration.. To validate before committing, the pipeline must first stage changes in the candidate configuration using type=config&action=set, and then run validation using the operational command . These two steps ensure that changes are checked for errors before being committed.

Answer

Use type=commit&action=commit to validate the candidate configuration.

Answer

Use type=commit&action=partial to commit only validated changes.

Answer

Use type=config&action=delete to remove invalid objects before committing.

Question 4

A security engineer is writing a Python script to automate the creation of address objects on a Next-Generation Firewall using the PAN-OS XML API. The script must authenticate using an API key. Which HTTP header should be used to pass the API key in the request?

Accepted Answer

key=<API_KEY> as a query parameter. The PAN-OS XML API authenticates requests using an API key passed as a query parameter named 'key'. This is the documented and supported method. Other headers like Authorization or X-API-Key are not used. The API key must be included in every request, and it is recommended to use HTTPS to protect the key during transmission.

Answer

Authorization: Bearer <API_KEY>

Answer

X-API-Key: <API_KEY>

Answer

X-PAN-KEY

Question 5

A security engineer needs to retrieve the current running configuration from a Palo Alto Networks firewall using the XML API. Which API request type should be used?

Accepted Answer

type=export&category=configuration. To retrieve the full running configuration via the XML API, the export type with category=configuration is used. This returns the entire configuration in XML. Other methods like config get or op commands are for specific elements or operational tasks, not for exporting the complete running config.

Answer

type=op&cmd=

Answer

type=config&action=show

Answer

type=config&action=get

Question 6

A company uses a SOAR platform to enrich and block indicators of compromise. The SOAR playbook must add malicious IP addresses to an External Dynamic List (EDL) hosted on an internal web server that the firewall already consumes. Which action should the playbook take?

Accepted Answer

Update the file on the internal web server that the firewall retrieves as the EDL source.. External Dynamic Lists are designed for exactly this use case: a firewall retrieves a list from an HTTP or HTTPS URL on a refresh interval, and any change to the source file is picked up automatically without a commit. A SOAR playbook can simply append or rewrite the file on the internal web server, and the firewall will enforce the new indicators after its next refresh. This keeps policy static and indicator management dynamic.

Answer

Use the SOAR platform to push a new security policy rule directly to the firewall for each malicious IP.

Answer

Configure the SOAR platform as a syslog target and send the IPs as log entries for the firewall to parse.

Answer

Call the firewall XML API to create a new address object for each IP and add it to a security policy rule.

Question 7

A security automation script uses the XML API to retrieve logs from a Palo Alto Networks firewall. The script needs to filter logs for a specific source IP and time range. Which API request correctly retrieves the filtered logs?

Accepted Answer

type=log&log-type=traffic&query=(addr.src in 10.1.1.1) and (receive_time geq '2023/01/01 00:00:00'). The correct API for retrieving filtered logs is type=log with log-type and a query parameter. The query uses the firewall's log filter syntax to specify source IP and time range. Operational commands have a different structure, and config or export APIs are not for log retrieval.

Answer

type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/log-settings

Answer

type=export&category=traffic&filter=src-10.1.1.1

Answer

type=op&cmd=(addr.src in 10.1.1.1)

Question 8

A security engineer needs to programmatically create a new address object in a Palo Alto Networks NGFW using the XML API. The engineer authenticates with an API key and sends a POST request to /api/?type=config&action=set&xpath=/config/devices/entry/vsys/entry[@name='vsys1']/address&element=

10.1.1.5/32

. The API returns a success response. However, the address object does not appear in the candidate configuration when checked via the web interface. What is the most likely cause?

Accepted Answer

The xpath specified is incorrect for the target vsys, so the object was created in a different location or not at all.. The XML API's set action writes directly to the candidate configuration. A success response indicates the request was syntactically valid and processed, but it does not confirm the object is in the expected vsys. The xpath must accurately reflect the target vsys and hierarchy. A mismatch can cause the object to be created elsewhere or the request to succeed without the desired effect. Verifying the xpath and checking the candidate config in the correct vsys resolves the issue.

Answer

The API key used lacks the necessary permissions to modify the candidate configuration, so the change was silently discarded.

Answer

The API request must include the parameter &commit=true to apply the change to the candidate configuration.

Answer

The XML API requires a two-step process: first create the object with action=set, then activate it with action=enable.

Question 9

An administrator is using the PAN-OS REST API to retrieve the list of all security rules in the 'Shared' policy. Which HTTP method and endpoint should be used?

Accepted Answer

GET /restapi/v10.0/Policies/SecurityRules?location=shared. The PAN-OS REST API uses the 'location' query parameter to specify the scope for policy retrieval. For shared policies, the value is 'shared'. The correct HTTP method is GET, as it is used to retrieve data without modifying it. Other methods or parameters would not correctly return the desired list of security rules.

Answer

GET /restapi/v10.0/Policies/SecurityRules?type=shared

Answer

POST /restapi/v10.0/Policies/SecurityRules with a JSON body specifying 'location': 'shared'

Answer

GET /restapi/v10.0/Policies/SecurityRules/Shared

Question 10

A security automation team is using the PAN-OS XML API to programmatically create and commit a new security policy rule. The script authenticates with an API key and sends an XML document to the /api/ endpoint. The rule is created but does not appear in the running configuration. Which TWO actions must the script perform to make the rule active? (Choose two.)

Accepted Answer

Include the config and set elements in the API request.. To activate a new security rule created via the XML API, the script must first ensure the rule is added to the candidate configuration by including 'type=config' and 'action=set' in the request. Then, a separate commit request with 'action=commit' is required to push the candidate configuration to the running configuration. Without both steps, the rule will not take effect.

Answer

Use the <key> element to provide the API key for authentication.

Answer

Use the <location> element to define whether the rule is for a shared or device-specific policy.

Answer

Include the <vsys> element to specify the virtual system for the rule.

Question 11

A cloud automation team is deploying VM-Series firewalls in AWS using Terraform. They need to bootstrap the firewalls with a Panorama server configuration. The team wants to ensure the firewalls automatically connect to Panorama upon deployment. Which file must be included in the bootstrap package to specify the Panorama server IP address and auth key?

Accepted Answer

init-cfg.txt. For VM-Series firewalls, the init-cfg.txt file is the correct bootstrap configuration file. It includes parameters like panorama-server and auth-key that enable automatic registration with Panorama. Other filenames are not recognized by the bootstrap process, so they would not achieve the desired automatic connection.

Answer

bootstrap.xml

Answer

auth-key.txt

Answer

panorama-config.txt

Question 12

An engineer is automating a Next-Generation Firewall to dynamically register IP addresses from a custom cloud inventory system. The solution must update a Dynamic Address Group (DAG) using the XML API. After authenticating, the engineer sends a request to the /api/?type=user-id&action=set endpoint with an XML payload containing inside a tag. The API responds with success, but the address does not appear in the DAG. What is the most likely cause?

Accepted Answer

The XML payload must include a element specifying the DAG's tag name.. Dynamic Address Groups rely on tags to map registered IP addresses to the correct group. The User-ID API's register action adds an IP to the User-ID table, but the DAG only includes addresses that carry the tag specified in the group's match criteria. The payload must include a element with the appropriate tag name. Without it, the address is registered but not associated with any DAG.

Answer

The API key used for authentication does not have permissions to modify User-ID entries.

Answer

The persistent attribute must be set to 1 for the address to appear in the DAG.

Answer

The API call must use the /api/?type=config&action=set endpoint to modify DAG membership.

Question 13

A security team is integrating a Next-Generation Firewall with an orchestration platform using the XML API. The platform needs to retrieve the current running configuration of a specific security policy rule named 'Allow-Web'. Which API request should the engineer use?

Accepted Answer

GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Allow-Web']. The XML API's config type with the get action allows retrieval of specific configuration objects using an XPath expression. The XPath must accurately reflect the configuration hierarchy, including the device entry, vsys, and the path to the security rule. This method returns the exact rule configuration without requiring a full configuration dump. It is the most efficient and precise way to fetch a single policy rule's settings.

Answer

GET /api/?type=op&cmd=

Allow-Web

Answer

GET /api/?type=op&cmd=

Answer

GET /api/?type=config&action=show&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Allow-Web']

Question 14

An automation engineer is deploying a new firewall using a bootstrapping process. The engineer needs to ensure that the firewall automatically registers with Panorama and receives its license and configuration after the initial boot. Which component must be included in the bootstrap package to enable automatic registration with Panorama?

Accepted Answer

An init-cfg.txt file with Panorama IP addresses and a registration PIN. Bootstrap packages streamline initial firewall deployment. The init-cfg.txt file contains essential parameters for zero-touch provisioning, including Panorama server IP addresses and a registration PIN. When the firewall boots, it reads this file and automatically registers with Panorama, allowing centralized management and policy push. Other files like auth keys or license keys serve different purposes and do not enable Panorama registration.

Answer

A license key file obtained from the Palo Alto Networks support portal

Answer

A VM-Series auth key file

Answer

A Panorama registration PIN file

Question 15

A security automation team uses the PAN-OS XML API to programmatically create a new security policy rule. The script authenticates with an API key and sends a POST request to the firewall. The API returns a success status, but the rule does not appear in the web interface. What is the most likely reason?

Accepted Answer

The rule was added to the candidate configuration but not committed.. The PAN-OS XML API writes to the candidate configuration. A successful API response only confirms that the configuration was staged. To make the rule active and visible in the running configuration, a commit operation must be performed. The web interface shows the running configuration by default, so without a commit, the new rule will not appear. This is a frequent pitfall in automation workflows.

Answer

The API key has expired and needs to be regenerated.

Answer

The rule was created in the wrong virtual system (vsys).

Answer

The firewall requires a reboot to apply new security rules.