NGFW Engineer · Domain 3 of 3

NGFW Engineer Domain 3: Integration and Automation

The smallest domain at 20% of the score. It covers installing each NGFW form factor, automating with APIs and tools such as Terraform and Ansible, managing firewalls centrally with Panorama, and building ACC dashboards and custom reports.

Exam weight
20%
Official objectives
5
Estimated questions estimate
~12
Suggested study time estimate
12–16 hrs

About 12 min read Reviewed October 2026

Overview

Domain 3 moves from one firewall to many. It has five official objectives. The first covers installing the selected deployment option: PA-Series hardware, VM-Series virtual firewalls, CN-Series container firewalls, Cloud NGFW managed services and AI Runtime Security. The second covers PAN-OS APIs for automated deployment. The third covers third-party services used to deploy firewalls, such as Kubernetes, hypervisors, cloud providers, Terraform and Ansible. The fourth covers Panorama with templates, device groups and pre- and post-rulesets. The fifth covers Application Command Center dashboards and custom reports.

At 20%, this domain is half the weight of each of the others, but it rewards clear mental models. Most questions ask where a setting is defined in Panorama, which form factor fits a platform, or which automation interface suits a task, rather than syntax.

How it's tested

This domain tests architecture choices and centralised management logic. Questions describe an environment, such as a Kubernetes cluster, an AWS account or forty branch firewalls, and ask which form factor, automation tool or Panorama construct fits. Know what lives in a template versus a device group without hesitation.

  • Match the form factor

    An environment such as Kubernetes, a hypervisor or a public cloud is described, and you choose PA-Series, VM-Series, CN-Series or Cloud NGFW.

  • Place the Panorama object

    A setting must reach many firewalls, and you decide whether it belongs in a template, template stack, device group, pre-rule or post-rule.

  • Choose the automation path

    A repeatable deployment or change task is described, and you pick bootstrapping, the XML or REST API, Terraform or Ansible.

Reasoning it through

Branch firewalls must share a corporate rule blocking high-risk applications that local administrators cannot override, while each branch keeps its own local rules. Templates hold network and device settings, so they are wrong for Security rules. A device group pre-rule is evaluated before any local rule and cannot be edited locally, so a pre-rule in the branch device group meets the requirement.

Objectives 5

Official objectives from the Palo Alto Networks outline, in outline order.

3.1 Install the selected deployment optionPA-Series, VM-Series, CN-Series, Cloud NGFW and AI Runtime Security.
What it means
Sub-objectives list PA-Series (3.1.1), VM-Series (3.1.2), CN-Series (3.1.3), Cloud NGFW (3.1.4) and AI Runtime Security (3.1.5). Each form factor has its own install path, licensing model and management options.
What to understand
PA-Series hardware starts with the MGT port at 192.168.1.1, registration, licence activation and dynamic updates. VM-Series runs on hypervisors and public clouds, can bootstrap from a package containing init-cfg.txt, bootstrap.xml, licences and content, and draws on software NGFW credits. CN-Series protects Kubernetes with management and data-plane pods, managed by Panorama with the Kubernetes plugin. Cloud NGFW is a managed service in AWS and Azure using rulestacks. AI Runtime Security, now within Prisma AIRS, discovers AI applications and inspects AI traffic for threats such as prompt injection.
How it shows up
Expect environment-matching questions and bootstrap or licensing prerequisites for virtual firewalls.
Common confusion
Choosing VM-Series for container-to-container traffic inside Kubernetes; CN-Series is built for that.
3.2 Use APIs to automate deploymentXML API and REST API for configuration and operations.
What it means
This objective covers driving the firewall and Panorama programmatically. The XML API exposes configuration, operational commands, commits, logs and reports. The REST API offers object and policy endpoints with JSON payloads.
What to understand
Generate an API key with the keygen request using an account whose admin role allows API access. XML API request types include config, op, commit, log, report and user-id, which can push IP-to-user mappings. Configuration changes through the API are staged in the candidate configuration and need a commit. Use a dedicated service account with least privilege for automation rather than a shared superuser.
How it shows up
Questions ask how to authenticate API calls, how to apply changes, or which API type suits a task.
Common confusion
Expecting an API configuration change to take effect without a commit.
3.3 Manage third-party services to deploy NGFWs (e.g., Kubernetes, hypervisors, CSPs, Terraform, Ansible)Kubernetes, hypervisors, cloud providers and infrastructure-as-code tools.
What it means
This objective covers the platforms and tools around the firewall. Kubernetes hosts CN-Series, hypervisors and cloud providers host VM-Series, and Terraform and Ansible automate deployment and configuration with Palo Alto Networks providers and collections.
What to understand
Terraform is declarative and tracks state, suited to building infrastructure and firewall configuration together. Ansible uses playbooks with the paloaltonetworks.panos collection, suited to procedural configuration and operational tasks. Cloud deployments use marketplace images and services such as load balancers for scaling. Kubernetes deployments use Helm charts or YAML manifests. Hypervisor deployments rely on supported images and resource sizing for the chosen VM-Series model.
How it shows up
Scenarios ask which tool fits a declarative or procedural need, or what a cloud or Kubernetes deployment requires.
Common confusion
Treating Terraform and Ansible as interchangeable; Terraform keeps state, Ansible runs ordered tasks.
3.4 Use on-premises centralized managementPanorama, templates and device groups, pre- and post-rulesets.
What it means
Sub-objectives cover Panorama (3.4.1), templates and device groups (3.4.2) and pre- and post-ruleset (3.4.3). Panorama manages many firewalls, pushing network and device settings through templates and policies and objects through device groups.
What to understand
Templates hold Network and Device tab settings; template stacks combine templates, with higher entries winning, and variables handle per-firewall values. Device groups hold policies and objects in a hierarchy below Shared. Pre-rules evaluate before local firewall rules and post-rules after them, and local administrators cannot edit either. Changes are committed to Panorama, then pushed to devices. Panorama can run in Panorama, Management Only or Log Collector mode.
How it shows up
Expect object-placement questions, rule evaluation order, and template stack precedence.
Common confusion
Putting Security rules in templates or interfaces in device groups.
3.5 Build Application Command Center (ACC) dashboards and custom reportsACC widgets, filters and tabs, plus custom and scheduled reports.
What it means
This objective covers turning logs into visibility. The ACC shows interactive widgets on network, threat, blocked and tunnel activity with global filters and time ranges. Custom reports query summary databases or detailed logs and can be scheduled and grouped.
What to understand
Custom ACC tabs let you combine chosen widgets for a team. Clicking a value in a widget can add it as a global filter for drill-down. Custom reports pick a database, columns, sort and group options and a time frame, and summary databases run faster than detailed logs. Reports can be scheduled, combined into report groups and emailed through an email scheduler. On Panorama, the ACC and reports draw on logs from managed firewalls and collectors.
How it shows up
Questions ask how to give a team a tailored view or deliver a recurring report.
Common confusion
Expecting the ACC to email scheduled output; scheduled delivery uses reports and the email scheduler.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Bootstrapping

    Automatic first-boot configuration for VM-Series from a package.

    Remember
    Folders: config, license, content, software, plugins.
    Tested as
    Automated deployment questions.
    Trap
    Forgetting the license or auth code location.

  • CN-Series

    Containerised firewall for Kubernetes workloads.

    Remember
    Managed by Panorama with the Kubernetes plugin.
    Tested as
    Container security scenarios.
    Trap
    Choosing VM-Series inside the cluster.

  • Cloud NGFW

    Managed firewall service in AWS and Azure.

    Remember
    Policies are held in rulestacks.
    Tested as
    Managed cloud service scenarios.
    Trap
    Expecting to patch PAN-OS yourself.

  • AI Runtime Security

    Protection for AI applications and models at runtime, now in Prisma AIRS.

    Remember
    Targets threats such as prompt injection and data leakage.
    Tested as
    Newest blueprint item.
    Trap
    Treating it as a hardware model.

  • API key

    Token generated with keygen to authenticate API calls.

    Remember
    Inherits the admin role's permissions.
    Tested as
    API authentication questions.
    Trap
    Using a superuser account for automation.

  • Commit after API change

    API configuration edits are staged until committed.

    Remember
    Panorama also needs a push to devices.
    Tested as
    Automation workflow questions.
    Trap
    Assuming the change is live immediately.

  • Terraform vs Ansible

    Declarative with state versus ordered procedural tasks.

    Remember
    Both have Palo Alto Networks integrations.
    Tested as
    Tool choice questions.
    Trap
    Treating them as the same model.

  • Template stack

    Ordered set of templates applied to firewalls.

    Remember
    Higher template in the stack wins conflicts.
    Tested as
    Configuration precedence.
    Trap
    Assuming the last template wins.

  • Device group hierarchy

    Shared at the top, then nested device groups.

    Remember
    Policies and objects inherit downward.
    Tested as
    Policy placement questions.
    Trap
    Expecting templates to hold policy.

  • Pre- and post-rules

    Panorama rules evaluated before and after local rules.

    Remember
    Locally uneditable on the firewall.
    Tested as
    Rule order questions.
    Trap
    Placing an enforced block rule in post-rules.

  • Commit and push

    Commit saves to Panorama; push sends to firewalls.

    Remember
    Both steps are needed.
    Tested as
    Change deployment questions.
    Trap
    Stopping after the Panorama commit.

  • ACC global filter

    Filter applied across all widgets in a tab.

    Remember
    Built by clicking values for drill-down.
    Tested as
    Investigation workflow questions.
    Trap
    Filtering one widget at a time.

  • Scheduled custom report

    Saved query run on a schedule and emailed.

    Remember
    Summary databases are faster.
    Tested as
    Recurring reporting needs.
    Trap
    Using the ACC for scheduled delivery.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

NGFW form factors

ConceptMeaningKey differenceCommon trap
PA-Series Physical appliance On-premises hardware throughput Choosing it for cloud-native workloads
VM-Series Virtual firewall image Runs on hypervisors and public clouds Using it for in-cluster pod traffic
CN-Series Containerised firewall Protects Kubernetes workloads Expecting standalone management
Cloud NGFW Managed cloud service Provider-run infrastructure with rulestacks Expecting PAN-OS upgrades by the customer

Panorama constructs

ConceptMeaningKey differenceCommon trap
Template Network and device settings No policies or objects Placing Security rules here
Template stack Ordered template combination Top entry takes precedence Assuming bottom-up order
Device group Policies and objects Hierarchical inheritance Placing interfaces here
Pre-rule and post-rule Panorama rules around local rules Evaluated before or after local rules Swapping their order

Automation options

ConceptMeaningKey differenceCommon trap
XML API Full config, op, commit, log and report access Broadest coverage Forgetting the commit
REST API JSON endpoints for objects and policies Simpler resource model Expecting every operation to be available
Terraform Declarative infrastructure-as-code Tracks state Using it for ad hoc operational commands
Ansible Procedural playbooks Ordered tasks without state file Expecting drift detection like Terraform

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Policy in a template

    What candidates pick
    Adding a Security rule to a Panorama template.
    Why it looks right
    Templates feel like the general configuration container.
    Why it's wrong
    Templates cover network and device settings only; policies and objects belong to device groups.

    Clue to watch for The requirement is a rule shared by many firewalls.

  2. Post-rule for enforcement

    What candidates pick
    Placing a mandatory block rule in post-rules.
    Why it looks right
    Post-rules are still managed centrally.
    Why it's wrong
    Post-rules evaluate after local rules, so a local allow rule could match first; enforced rules go in pre-rules.

    Clue to watch for Local administrators must not be able to override the rule.

  3. Commit only

    What candidates pick
    Committing on Panorama and expecting firewalls to change.
    Why it looks right
    Commit applies changes on a standalone firewall.
    Why it's wrong
    Panorama requires a separate push to devices after commit.

    Clue to watch for Firewalls still show the old configuration.

  4. VM-Series in Kubernetes

    What candidates pick
    Deploying VM-Series to inspect pod-to-pod traffic.
    Why it looks right
    VM-Series is the familiar virtual option.
    Why it's wrong
    CN-Series is designed for Kubernetes and integrates with the cluster through the CNI and Panorama plugin.

    Clue to watch for The scenario describes pods, namespaces or containers.

  5. ACC sends reports

    What candidates pick
    Using the ACC to email a weekly summary.
    Why it looks right
    ACC is the main visibility tool.
    Why it's wrong
    Scheduled delivery comes from custom reports or report groups with an email scheduler.

    Clue to watch for A recurring report must arrive by email.

Answer framework

For integration and automation questions, identify scale and platform first, then pick the construct.

  1. Identify the platform being protected first: on-premises hardware, a hypervisor, a public cloud, Kubernetes, a managed cloud service or AI applications.
  2. Match it to PA-Series, VM-Series, CN-Series, Cloud NGFW or AI Runtime Security, and note bootstrap or licensing prerequisites.
  3. For many firewalls, decide whether the setting is network or device, which means templates, or policy and objects, which means device groups.
  4. For rule order, use pre-rules for enforced controls, post-rules for catch-all controls, and remember the push after commit.
  5. For automation and visibility, choose XML or REST API, Terraform or Ansible by task style, and ACC or scheduled reports by audience.

Practice question

A company manages 50 branch firewalls with Panorama. Each branch needs the same DNS and NTP servers, but a different management IP address and hostname. What is the most efficient way to configure these settings?

Want more like this? The NGFW Engineer practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with Panorama because it carries the most testable logic in this domain. If you have a lab Panorama, add two managed firewalls, build a template stack with a variable and a device group hierarchy, and push pre-rules and post-rules. If not, use the Panorama administrator guide and draw the template and device group model on one page until you can place any setting quickly.

Then cover form factors with a comparison table: environment, management method, licensing and install steps for PA-Series, VM-Series, CN-Series, Cloud NGFW and AI Runtime Security. Read the VM-Series bootstrap documentation and the CN-Series deployment overview, and skim the Cloud NGFW and Prisma AIRS overviews for purpose rather than every setting.

For automation, generate an API key on a lab firewall, run a show system info operational command through the XML API, and make a configuration change followed by a commit. Read a short Terraform example using the panos provider and an Ansible playbook using the panos collection to see the difference in style.

Finish with the ACC: create a custom tab, add global filters, and schedule a custom report to understand the two visibility paths.

FAQ

How much of the NGFW Engineer exam is Integration and Automation?

Integration and Automation is 20% of the score, the smallest of the three domains, with five official objectives in the November 2025 datasheet.

Do I need to write Terraform or Ansible code?

No coding is required, but you should recognise what each tool does, how Terraform tracks state, and when Ansible playbooks fit better.

What is AI Runtime Security?

A Palo Alto Networks offering, now part of Prisma AIRS, that discovers AI applications and inspects their traffic for threats such as prompt injection and sensitive data leakage.

What goes in a Panorama template versus a device group?

Templates hold network and device settings such as interfaces, zones, DNS and logging. Device groups hold Security, NAT and other policies plus objects.

How are pre-rules and post-rules evaluated?

Pre-rules are evaluated first, then local firewall rules, then post-rules, then the default rules. Local administrators cannot change Panorama rules.

Is Strata Cloud Manager tested in this domain?

The objective names on-premises centralised management with Panorama. Strata Cloud Manager appears only indirectly through cloud services such as AI Runtime Security.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have reviewed form factors, APIs, automation tools, Panorama and ACC reporting. Practise placing settings and choosing tools under exam timing.

Take the NGFW Engineer practice test Check your NGFW Engineer readiness

Keep going