NGFW-Engineer Integration And Automation — Timed 10 Questions

Question 1

When using the Panorama XML API, which parameter must be included in the header to authenticate the request?

Accepted Answer

X-PAN-KEY. The 'X-PAN-KEY' header is required to pass the API key generated for the administrator account.

Answer

Authorization: Basic

Answer

X-PAN-API-KEY

Answer

X-API-TOKEN

Question 2

To ensure high availability for an automated script, which Panorama component should the script target?

Accepted Answer

Panorama Management Server. Targeting the Panorama M-series or virtual appliance ensures the script manages the entire policy set for all managed firewalls.

Answer

Log Collector

Answer

Active/Passive Peer

Answer

Individual Firewall Management Plane

Question 3

You are integrating an NGFW with an external SIEM using Syslog. When troubleshooting missing logs, which firewall tool is best to verify that the log forwarding profile is generating packets?

Accepted Answer

Test Log Forwarding Profile. The 'test forwarding-plane-debug' command allows you to verify that log packets are being generated and sent to the configured destination.

Answer

Debug Data Plane Packet Capture

Answer

Monitor > Logs > System

Answer

Debug Management Plane Syslog

Question 4

An administrator needs to automate the deployment of security policy updates using Panorama. Which XML API method should be invoked to commit changes to the candidate configuration?

Accepted Answer

/api/?type=commit. The commit operation is performed via the 'commit' tag in the XML API request to the Panorama management server.

Answer

/api/?type=config&action=save

Answer

/api/?type=export

Answer

/api/?type=op&cmd=<commit/>

Question 5

Which CLI command is used to display the current status of the XML API service?

Accepted Answer

debug management-server show-api-status. 'debug management-server show-api-status' is the command to verify if the API service is active.

Answer

show management-plane-services

Answer

show api status

Answer

show system status

Question 6

Which GUI location is used to generate an API Key for an administrator?

Accepted Answer

Device > Setup > Management. API keys are generated under Device > Setup > Management in the GUI, not under Device > Administrators. In PAN-OS, navigate to Device > Setup > Management and use the API Key section under Authentication Settings.

Answer

Panorama > Setup

Answer

Objects > Security Profiles

Answer

Device > Administrators

Question 7

When using the 'pan-os-python' library, which class is primarily used to interact with firewall configuration objects?

Accepted Answer

panos.objects.AddressObject. The 'panos.firewall.Firewall' or 'panos.panorama.Panorama' classes are used to connect, but configuration objects are handled by classes within the 'panos.objects' namespace.

Answer

panos.xapi.Xapi

Answer

panos.network.Interface

Answer

panos.base.PanObject

Question 8

Which XML API command is used to check the progress of a configuration commit?

Accepted Answer

type=op&cmd=

. The 'type=op' with the command '

' is used to monitor progress.

Answer

type=config&action=get-status

Answer

type=commit&action=check

Answer

type=op&cmd=<check-commit/>

Question 9

Which protocol is typically used for integrating Palo Alto Networks firewalls with authentication servers like LDAP or RADIUS?

Accepted Answer

LDAP. LDAP and RADIUS are standard protocols for user authentication and group mapping in NGFW deployments.

Answer

FTP

Answer

SMTP

Answer

HTTPS

Question 10

Which feature allows the firewall to send logs to a SIEM in a specific format (e.g., CEF, LEEF)?

Accepted Answer

Log Forwarding Profile. Log Forwarding Profiles allow customization of the log format to match SIEM requirements.

Answer

Reporting Profile

Answer

Syslog Server Profile

Answer

Security Profile