NGFW-Engineer Integration And Automation — Timed 15 Questions

Question 1

When using the Panorama XML API, which parameter must be included in the header to authenticate the request?

Accepted Answer

X-PAN-KEY. The 'X-PAN-KEY' header is required to pass the API key generated for the administrator account.

Answer

Authorization: Basic

Answer

X-PAN-API-KEY

Answer

X-API-TOKEN

Question 2

You are integrating an NGFW with an external SIEM using Syslog. When troubleshooting missing logs, which firewall tool is best to verify that the log forwarding profile is generating packets?

Accepted Answer

Test Log Forwarding Profile. The 'test forwarding-plane-debug' command allows you to verify that log packets are being generated and sent to the configured destination.

Answer

Debug Data Plane Packet Capture

Answer

Monitor > Logs > System

Answer

Debug Management Plane Syslog

Question 3

Which CLI command is used to display the current status of the XML API service?

Accepted Answer

debug management-server show-api-status. 'debug management-server show-api-status' is the command to verify if the API service is active.

Answer

show management-plane-services

Answer

show api status

Answer

show system status

Question 4

Which GUI location is used to generate an API Key for an administrator?

Accepted Answer

Device > Administrators. API Keys are managed under 'Device > Administrators' in the GUI.

Answer

Panorama > Setup

Answer

Device > Setup > Management

Answer

Objects > Security Profiles

Question 5

Which XML API command is used to check the progress of a configuration commit?

Accepted Answer

type=op&cmd=

. The 'type=op' with the command '

' is used to monitor progress.

Answer

type=config&action=get-status

Answer

type=commit&action=check

Answer

type=op&cmd=<check-commit/>

Question 6

Which feature allows the firewall to send logs to a SIEM in a specific format (e.g., CEF, LEEF)?

Accepted Answer

Log Forwarding Profile. Log Forwarding Profiles allow customization of the log format to match SIEM requirements.

Answer

Reporting Profile

Answer

Syslog Server Profile

Answer

Security Profile

Question 7

Which THREE steps are necessary to ensure an automated script can successfully modify a security policy via the XML API?

Accepted Answer

Enable the XML API feature on the management interface.. You need the correct API key, the proper permissions for the admin account, and a successful commit.

Answer

Disable all security profiles on the policy.

Answer

Enable dynamic routing protocols.

Question 8

When troubleshooting automation scripts, which TWO logs provide the most visibility into API-related issues?

Accepted Answer

System logs.. System logs and Web server logs provide context on API failures and connection attempts.

Answer

Traffic logs.

Answer

URL filtering logs.

Answer

Threat logs.

Question 9

When designing an automated solution using Panorama, which THREE components should be considered for high availability?

Accepted Answer

Redundant management interfaces for API access.. Redundant management paths, API load balancing, and synchronization across HA pairs are key.

Answer

Using a single static IP for all firewalls.

Answer

Disabling log forwarding to increase performance.

Question 10

When automating firewall operations, which TWO CLI commands are essential for troubleshooting the management plane?

Accepted Answer

debug management-server. 'debug management-server' and 'show system resources' are vital for monitoring health.

Answer

show logdb-quota

Answer

show interface counters

Answer

test security-policy-match

Question 11

You are troubleshooting an issue where a third-party SIEM is not receiving logs from your NGFW. You have verified that the syslog server is reachable via ping. What is the next logical step to confirm the firewall is actually sending the packets?

Accepted Answer

Run 'test logging-server' from the CLI.. Using the CLI command 'show logging-status' or running a packet capture (tcpdump) filtered by the syslog server IP and port (typically 514) on the management interface is the definitive way to see if packets are egressing.

Answer

Restart the logd process.

Answer

Change the log format to 'BSD' in the server profile.

Answer

Increase the log buffer size in the Device > Setup menu.

Question 12

Which TWO actions are required to successfully integrate a new User-ID agent with an NGFW?

Accepted Answer

Configure the User-ID agent IP address in the firewall profile.. You must define the agent in the Device > User Identification > User-ID Agent menu and ensure connectivity is permitted via the management interface.

Answer

Set the agent mode to 'Syslog listener'.

Answer

Configure an IPsec tunnel to the agent.

Answer

Enable the 'User-ID' service on the external interface.

Question 13

When troubleshooting an automation script that uses the Palo Alto Networks XML API, which THREE of the following are valid methods to identify the cause of the failure?

Accepted Answer

Review the 'api.log' file on the firewall via CLI.. To debug API issues, you should check the API logs, use a tool like Postman to isolate the request, and inspect the XML response structure returned by the firewall.

Answer

Reboot the dataplane.

Answer

Increase the policy evaluation threshold.

Question 14

You are configuring an Auto-Scaling Group in AWS with the VM-Series. During the bootstrap process, which file is mandatory to ensure the firewall registers with Panorama successfully?

Accepted Answer

init-cfg.txt. The 'init-cfg.txt' file is required for bootstrapping and contains the Panorama IP and authorization key to register the VM.

Answer

license.txt

Answer

bootstrap.xml

Answer

config.cfg

Question 15

An administrator is using Terraform to manage Palo Alto Networks security policies. Which provider resource is used to create a security rule?

Accepted Answer

panos_security_rule. The 'panos_security_rule' resource is the standard Terraform resource for managing security policies on Palo Alto Networks devices.

Answer

panos_firewall_rule

Answer

panos_policy_rule

Answer

panos_security_policy