Cybersecurity-Practitioner Exam Questions and Answers

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

A security administrator is reviewing firewall logs and notices multiple outbound connection attempts from a client workstation to known command and control IP addresses. Which security profile component is primarily responsible for generating a threat log entry for this specific outbound traffic?

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?

An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

An administrator is deploying Cortex XDR Agent to Windows workstations using an Active Directory Group Policy Object (GPO). Which installation parameter must be used to ensure the agent registers correctly with the assigned Cortex XDR tenant using a specific installation token?

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

An administrator is preparing to deploy Cortex XDR agents to 500 remote endpoints using a software deployment tool. Where can the administrator download the latest installation packages and transforms?

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?