Which statement correctly describes behavior when using Ansible to automate configuration changes on a PAN-OS...

Ansible interacts with PAN-OS through its API.

Why C is correct: Ansible uses the PAN-OS XML API to manage configurations. This allows for programmatic interaction and automation.  

Why A, B, and D are incorrect:

A. Ansible can only be used to automate configuration changes on physical firewalls but not virtual firewalls: Ansible can manage both physical (PA-Series) and virtual (VM-Series, CN-Series) firewalls.

B. Ansible requires direct access to the firewall’s CLI to make changes: Ansible does not require direct CLI access. It uses the API, which is more structured and secure.

D. Ansible requires the use of Python to create playbooks: While Ansible playbooks are written in YAML, you don't need to write Python code directly. Ansible modules handle the underlying API interactions. The pan-os-python SDK is a separate tool that can be used for more complex automation tasks, but it's not required for basic Ansible playbooks.

Palo Alto Networks References:

Ansible Collections for Palo Alto Networks: These collections, available on Ansible Galaxy, provide modules for interacting with PAN-OS via the API.  

Palo Alto Networks Documentation on API Integration: The API documentation describes how to use the XML API for configuration management.

Palo Alto Networks GitHub Repositories: Palo Alto Networks provides examples and resources on using Ansible with PAN-OS.