Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?
Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.
Cortex XDR isolation blocks all network traffic except the management server by default; IP-based exceptions in the isolation profile permit the designated forensic server's IP to reach the endpoint. This satisfies the stem's need to allow one specific management server while preserving isolation.
Delete the endpoint from the Cortex XDR asset list and re-add it.
Modify the endpoint routing table locally via a startup script.
Temporarily disable the Host Firewall module on the endpoint via the CLI.
An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?
Disable the self-defense mechanism during MSI deployment.
Configure the proxy bypass list for local loopback communication.
Set the heartbeat interval to 60 seconds.
Ensure the operation mode parameter is set to prevent rather than detect or disable.
Setting the operation mode to prevent enforces blocking behaviour rather than passive detection, satisfying the requirement for full prevention without user intervention. Detect mode only logs alerts, while disable stops enforcement entirely, so prevention must be explicitly selected in the installation profile for the Cortex XDR agent.
A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?
Behavioral Threat Protection
Behavioural Threat Protection monitors process behaviour, including remote thread creation and memory writes into other processes, which are the hallmarks of process injection. It blocks these sequences at runtime regardless of the malware's changing file signature.
URL Filtering profile
Data Loss Prevention (DLP) engine
DNS Security subscription
A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?
In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.
Creating a hash-based exception in the Cortex XDR behavioural threat protection profile allows that exact script to run while all other behavioural rules stay enforced. The file hash pins the exception to one immutable artefact, satisfying the requirement to permit this specific script without disabling behavioural monitoring endpoint-wide.
Change the Agent settings to bypass all SSL decryption rules.
Disable the Local Analysis module entirely for the target endpoint group.
Modify the Windows Firewall inbound rules on the local endpoint.
An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?
Ensure the endpoint operating system is running the latest patch level.
Confirm that the kernel module version matches the BIOS version.
Check that the connection status shows Connected with a recent heartbeat timestamp.
A recent heartbeat timestamp confirms the agent is actively communicating with the Cortex XDR cloud tenant, satisfying the stem's requirement for verified ongoing connectivity. The Connected status alone indicates registration, but the heartbeat proves live check-ins, which is precisely the evidence the administrator needs.
Verify that the local disk usage is below 10 percent.
An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?
In the DNS Security query logs.
In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.
Quarantine actions are recorded in the Cortex XDR management console, where the Action Center lists remediation actions taken by the agent and Endpoint Management shows quarantined files per endpoint. This satisfies the requirement to review details of the specific quarantine action.
In the WildFire analysis report repository exclusively.
In the global firewall traffic log.
Want more Endpoint Security practice?
Practice this domainAn administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?
Administration > Access Control > Trusted IP
Prisma Cloud's Trusted IP settings live under Administration > Access Control > Trusted IP, where administrators define allowed corporate CIDR ranges that gate console login. Configuring this restricts administrative console access to the specified corporate IP ranges, exactly as the stem requires.
Cloud Accounts > Add Account > Network Security
Inventory > Asset Explorer > Filters
Compute > Defend > Access Rules
A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?
Deploy VM-Series firewalls in every VPC to inspect CloudTrail API payloads locally
Rely entirely on Prisma Cloud Compute Defenders installed on AWS EC2 instances
Establish a master CloudTrail setup in the management account paired with cross-account IAM roles for Prisma Cloud access
A master CloudTrail in the management account aggregates organisation-wide events into one trail, satisfying the centralised ingestion constraint. Cross-account IAM roles then let Prisma Cloud read that consolidated log stream without deploying separate trails per member account, giving unified posture visibility.
Configure independent CloudTrail logging directly inside each individual member account without cross-account roles
An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?
Prisma Access Remote Network connector
Prisma Cloud Auto-Remediation via Cloud Functions / Webhooks
Prisma Cloud's auto-remediation triggers a Cloud Function or webhook the moment a policy violation is detected, removing public access from the S3 bucket without human intervention. This satisfies the auditor's requirement for automatic remediation upon discovery, rather than merely alerting on misconfiguration.
VM-Series firewall active-passive high availability failover
WildFire automated sample submission
A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?
WildFire cloud-based analysis service
Prisma Cloud CSPM Resource Configuration Scan
Prisma Cloud CSPM Resource Configuration Scan continuously evaluates cloud resource configurations against benchmarks such as CIS, directly satisfying the requirement to detect public exposure on the new S3 bucket. It inspects configuration state rather than runtime traffic, so an open bucket policy or ACL is flagged as a misconfiguration.
Prisma Cloud Compute Defender
VM-Series firewall URL filtering profile
An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?
Prisma Cloud Admission Controller Webhook
Prisma Cloud Admission Controller Webhook intercepts Kubernetes API requests before persistence, evaluating privileged pod specifications against deployed runtime security policies. It satisfies the requirement to block non-compliant workloads at admission time, denying the developer's privileged pod before scheduling occurs, rather than detecting it later during runtime monitoring.
Prisma Cloud Defender DaemonSet
Prisma Cloud Console
AWS IAM policy simulator
An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?
Physical security of the underlying data center facilities
Classification and protection of data stored within the cloud storage buckets
Under the shared responsibility model, the cloud provider secures the infrastructure, but classifying data and protecting it within storage buckets remains the customer's duty across IaaS, PaaS and SaaS. This obligation never transfers to AWS or Azure, making it the constant customer responsibility.
Configuration of host-level firewalls in a managed PaaS database
Hypervisor patching and firmware updates in AWS EC2 instances
Want more Cloud Security practice?
Practice this domainA security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?
The maximum segment size (MSS) negotiation has failed during the three-way handshake.
The receiver's buffer is full and it is requesting the sender to pause transmission.
A zero window advertises that the receiver's TCP receive buffer is full, so the sender must stop transmitting until a window update arrives. This is TCP flow control, distinct from congestion control or packet loss.
An asymmetric routing loop has caused sequence numbers to go out of sync.
The firewall has blocked the session due to a security profile match.
An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?
In the Tag field of the Layer 2 interface configuration
For a Layer 2 subinterface, the VLAN association is defined by the Tag value in the interface configuration, which binds that subinterface to the existing VLAN ID. This is the field that carries the 802.1Q tag.
Within the DHCP Server IP pool configuration
In the Virtual Router general settings
Inside the Zone Protection Profile assigned to the interface
An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?
A Security Policy rule with an application of 'ping'
An Interface Management Profile assigned to the interface
An Interface Management Profile defines which management services, including ICMP, the interface answers. Assigning the profile to the Layer 3 interface enables ping replies for diagnostics; the setting is not enabled by default on dataplane interfaces.
A Zone Protection Profile applied to the egress zone
The Device > Setup > Management tab
An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?
Device > Setup > Operations > Routing
Network > Interfaces > Ethernet > Static Route
Network > Virtual Routers > [Virtual Router Name] > Static Routes
Static routes on Palo Alto Networks firewalls live under the virtual router, not the interface or zone. Binding the route to the correct virtual router ensures the next-hop 10.0.0.1 is reachable within that routing instance.
Policies > Routing > Static
An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?
show system resources
show session all
show counter global filter packet-drop yes
The `show counter global filter packet-drop yes` command streams global counters filtered to packet-drop events, revealing real-time discards including those caused by security rule denials. This directly satisfies the requirement to monitor drops live, unlike static log queries or session lookups that show only historical or per-flow state.
show interface all
An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?
An incorrect peer AS number or incorrect peer IP address configuration
BGP peers remain in Idle when the local router cannot establish a TCP session or rejects the neighbour, typically because the configured peer IP address or remote AS number is wrong. Correcting these parameters lets the peer advance through Connect and OpenSent.
An AS-path loop detection trigger
MD5 authentication password mismatch during OPEN message exchange
BGP route reflection timer expiration
Want more Network Fundamentals practice?
Practice this domainAn administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?
Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.
Deploy SSH Proxy decryption rules to intercept TLS handshakes.
Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.
SSL Forward Proxy decryption requires the firewall to present a certificate signed by its Forward Trust CA to clients. Installing that CA as trusted on endpoints prevents browser certificate warnings while allowing the firewall to inspect outbound HTTPS sessions transparently.
Enable SSL Inbound Inspection using the public certificate of the destination web server.
A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?
URL Filtering Profile
Vulnerability Protection Profile
Antivirus Profile
Anti-Spyware Profile with DNS Sinkhole
The DNS Sinkhole action within an Anti-Spyware Profile intercepts DNS queries matching known malicious domains and returns a spoofed address, preventing internal hosts from reaching C2 infrastructure. Attaching it to the Security policy rule satisfies the requirement to block DNS-based threats automatically.
A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?
A Security policy rule with an explicit source user match.
A decryption policy specifying a trusted CA certificate.
A NAT rule translating the public IP to a private IP.
An Authentication Profile linked to the GlobalProtect Portal/Gateway configuration.
An Authentication Profile defines the authentication service, such as LDAP, RADIUS or SAML, that the GlobalProtect Portal and Gateway use to verify user identity before the gateway assigns an IP address pool. It is the component that performs user authentication in this flow.
A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?
On the ingress interface where the bulk file traffic enters the firewall.
As a global setting inside the Device Management configuration tab.
Inside the Zone Protection Profile attached to the internal zone.
On the egress interface pointing toward the WAN connection.
QoS shaping on PAN-OS applies to egress traffic, so the profile must be attached to the outbound interface toward the WAN. This ensures VoIP packets are prioritised before leaving the firewall, satisfying the requirement to shape traffic effectively.
An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?
Rely solely on perimeter firewalls to block external attackers.
Inspect and log all traffic across all zones with least-privilege access control.
Zero Trust requires every packet to be treated as untrusted regardless of zone, so the firewall must decrypt, inspect and log traffic between all zones while enforcing least-privilege rules. This satisfies the stem's demand for a foundational principle applied to all traffic traversing the firewall.
Bypass security inspection for authenticated VPN users.
Implicitly trust traffic originating from internal zones.
An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?
When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.
Forwarding occurs only when the file hash is absent from the global cloud cache and the file matches the configured file type forwarding rules, so known-benign files are skipped. This satisfies the condition governing submission to the WildFire cloud.
Whenever a session exceeds maximum packet length thresholds.
Only when an Antivirus signature explicitly fails to scan the file.
Every time any user downloads a standard PDF document.
Want more Network Security practice?
Practice this domainA SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?
A configured Cortex XSOAR Integration instance polling the Prisma Cloud API.
A Cortex XSOAR integration instance polls the Prisma Cloud API, pulling alerts into the platform where they become incidents that trigger automated playbooks. This is the ingestion mechanism; playbooks, incident types and classifiers act on data only after the integration retrieves it.
A Log Forwarding Profile configured on the Prisma Access cloud service.
A Syslog Collector script running on a Panorama Log Collector.
An External Dynamic List hosted on an internal web server.
A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?
Use Parsing Rules in Cortex XSIAM to map raw log fields to the XDM schema.
Parsing Rules in Cortex XSIAM transform non-standard raw logs by mapping their fields to the XDM schema. This lets the analyst normalise custom application logs that lack RFC structure so they align with the Common Schema.
Create an Incident Response Playbook in XSOAR to regex-parse the raw text file.
Modify the firewall Zone Protection profile to drop unparsed packets.
Configure Data Collection Rules in Expedition to automatically rewrite the syslog header.
During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?
Trigger the 'Isolate Endpoint' action from the Cortex XDR Incident response tools.
Cortex XDR's incident response tools expose the Isolate Endpoint action, which severs the host's network connectivity while preserving the agent channel for investigation. Invoking it directly from the incident satisfies the requirement to isolate the endpoint automatically upon detecting the impossible-travel authentication.
Change the Authentication Profile to drop Kerberos ticket grants.
Enable strict Zone Protection profiles on the local switch interface.
Apply a Global Protect Portal lockout via Panorama Device Groups.
An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?
Change the GlobalProtect Gateway IP pool configuration.
Modify the local hosts file on every endpoint via Cortex XDR Action Center.
Create a Panorama Pre-Rule or Post-Rule blocking the destination IP address and push the policy to managed firewalls.
Panorama Pre-Rules and Post-Rules sit outside the device-group rule hierarchy and are evaluated before or after local rules, so a destination-IP block pushed to managed firewalls immediately halts the workstation's C2 traffic enterprise-wide without editing each firewall's rulebase.
Reboot the Panorama management server to flush active state tables.
An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?
Objects > External Dynamic Lists > Syslog
Device > Server Profiles > Syslog
Syslog server profiles are defined under Device > Server Profiles > Syslog in the firewall GUI. This path creates the profile that log forwarding rules then reference, enabling the external SIEM to receive Syslog messages from the Next-Generation Firewall.
Policies > Forwarding > Syslog
Network > Log Settings > Syslog
A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?
Run a manual threat hunting query in the Action Center to install new agents.
Access the Policy Editor to disable the infected endpoints from the network.
Open the Endpoint Protection profiles to manually delete the malware binaries.
Navigate to Cortex XDR > Incident View to review the automated attack story and affected endpoints.
Cortex XDR's Incident View correlates related endpoint alerts into a single automated attack story, mapping the ransomware's root cause, process chain and every affected host. This directly satisfies the analyst's need to establish scope and causality during initial triage, rather than investigating isolated alerts individually.
Want more Security Operations practice?
Practice this domainDuring an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?
App-ID
App-ID classifies traffic by inspecting application signatures and behaviour, identifying the application even when it is encrypted, obfuscated or running on non-standard ports. This satisfies the requirement to determine the exact application within the HTTPS stream.
Data-ID
Device-ID
User-ID
An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?
WildFire
AutoFocus
GlobalProtect
GlobalProtect is Palo Alto Networks' client VPN, tunnelling remote users' traffic to the next-generation firewall for inspection and policy enforcement. It secures public Wi-Fi connections by encrypting both internet-bound and corporate traffic back to the firewall.
Traps agent
An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?
The Incidents tab in the Cortex XDR management console.
The Incidents tab aggregates correlated alerts into cases, each mapped to MITRE ATT&CK techniques, letting the analyst see active threats and C2 communications. It provides the categorised, framework-mapped view the stem requires, unlike raw endpoint or log views.
The Dashboards tab under System Settings on the firewall.
The User-ID Agent status page.
The ACC (Application Command Center) threat map on Panorama.
A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?
URL Filtering Profile
URL filtering profiles inspect outbound HTTP/HTTPS requests against category and reputation lists, blocking known phishing and malicious domains at the rule level. This directly satisfies the requirement to prevent employees reaching those destinations, unlike TLS inspection or threat-intelligence feeds alone.
Denial of Service (DoS) Protection Profile
File Blocking Profile
WildFire Analysis Profile
A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?
A custom URL Filtering profile blocking the login page URL category.
An Antivirus Profile with signature auto-update enabled every minute.
A DoS Protection Profile configured with random early drop or classified rate limiting.
A DoS Protection Profile with random early drop or classified rate limiting absorbs and throttles volumetric floods from thousands of distributed source IP addresses, which per-IP blocking cannot handle. Attaching it to the security rule mitigates the brute-force traffic before it reaches the administrative portal.
A Data Filtering Profile configured to scan for weak passwords.
Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?
Principle of Least Privilege
Least privilege grants users and applications only the minimum access rights needed for their authorised tasks, reducing the attack surface exposed by excessive permissions. It directly matches the requirement that privileges be restricted to what each identity genuinely requires, limiting damage from compromised accounts or over-privileged processes.
Zero Trust Architecture
Defense-in-Depth
Separation of Duties
Want more Cybersecurity Fundamentals practice?
Practice this domainThe vendor does not publish an exact question count for the Cybersecurity-Apprentice. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Endpoint Security, Cloud Security, Network Fundamentals, Network Security, Security Operations, Cybersecurity Fundamentals. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks Cybersecurity-Apprentice exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.