Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?
The GlobalProtect client certificate installed in the personal certificate store.
The public vendor certificate of the SaaS application.
The Palo Alto Networks root CA certificate installed in the browser or OS Trusted Root Certification Authorities store.
Decrypting outbound HTTPS for inspection requires the firewall to re-sign traffic with its own certificate. Installing the Palo Alto Networks root CA into the endpoint trust store lets clients validate that certificate silently, preventing browser warnings while enabling inspection.
A self-signed untrusted certificate generated automatically by the firewall.
An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?
The User-ID agent or GlobalProtect portal has not been configured to register the user's IP address with the specific tag name used in the DAG filter.
DAG membership is populated by tag-to-IP mappings registered through User-ID. If neither the agent nor the GlobalProtect portal pushes the authenticated user's IP under the exact tag name the DAG filter references, the group stays empty and rules never match.
Security policy rules cannot reference DAGs unless a Decryption profile is explicitly attached.
The XML API key lacks administrative privileges to register IP-to-tag mappings on the management plane.
The address object must be converted to a static IP subnet because DAGs do not support User-ID tags.
An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?
WildFire Analysis Profile set to block all files
File Blocking Profile applied to the Security rule
A File Blocking Profile attached to the Security rule inspects the application layer, letting the administrator permit document viewing while denying upload actions within the same application family, achieving granular control that a blanket application block cannot.
URL Filtering Profile with custom file blocking categories
Data Filtering Profile
An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?
External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.
The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.
An IP-type EDL parses entries strictly as IPv4 addresses, so domain names in the file trigger parsing errors and no entries load, leaving rules with nothing to match. The firewall downloaded the file successfully, ruling out connectivity.
The firewall management plane does not have an outbound route to the internet to download the file.
The EDL update schedule is set to 'daily' instead of 'real-time'.
An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?
WildFire Analysis Profile
Vulnerability Protection Profile
The Vulnerability Protection Profile inspects traffic for exploits such as SQL injection and buffer overflows, blocking them at the Security policy rule. It satisfies the stem's requirement to shield critical database servers from those specific attack signatures.
URL Filtering Profile
Antivirus Profile
An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?
The firewall detected TCP traffic that does not match any known application signature database entry.
unknown-tcp indicates TCP sessions whose payload matches no App-ID signature, so the firewall cannot identify the application. It is not a threat verdict; it simply reflects signature-database gaps, commonly seen with custom or encrypted applications, and typically triggers policy based on service or port.
The traffic has been blocked by a Security policy rule.
The session is an encrypted SSL handshake that failed decryption.
The application is a predefined system service running on the management plane.
Want more Network Security practice?
Practice this domainA network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?
URL Filtering profile with custom block lists
Data Filtering profile with pre-defined patterns
Vulnerability Protection profile with severity filters
Anti-Spyware profile with DNS Signature enforcement
The Anti-Spyware profile with DNS signature enforcement inspects DNS queries against known malicious domain signatures, blocking resolution of malware-delivery domains. Attached to the security rule, it satisfies the requirement that internal hosts cannot resolve those domains.
An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?
The decryption policy must exempt WildFire inspection traffic to prevent performance degradation on the data plane
A custom URL Filtering profile must be applied to decrypt traffic matching the unknown-file category
The Security rule must utilize an application override to bypass App-ID processing for encrypted file transfers
SSL Decryption must be active, and the security rule must have a WildFire Analysis profile set to forward the specific file type to the WildFire cloud
WildFire only receives files when SSL decryption exposes the HTTPS payload and the security rule attaches a WildFire Analysis profile forwarding that file type. Both conditions satisfy the stem's requirement for cloud analysis of the malware binary.
A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?
AutoFocus threat intelligence service
AutoFocus aggregates threat intelligence and correlates indicators with actor TTPs, letting the analyst research threats targeting their sector. It provides the contextual hunting data required, unlike raw firewall logs or vulnerability scans, satisfying the exposure-assessment and TTP-research constraint.
Panorama Log Collector forwarding engine
Application Command Center (ACC) dashboard
GlobalProtect Host Information Profile (HIP) engine
During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?
WildFire cloud-based analysis and automated signature generation
WildFire submits the unknown sample to cloud sandbox analysis, derives a signature from the observed malicious behaviour, and pushes it to all subscribed Next-Generation Firewalls automatically, satisfying the minutes-scale global blocking requirement without manual signature updates.
Palo Alto Networks MineMeld open-source threat intelligence
Traps Advanced Endpoint Protection cloud service
AutoFocus Context-Aware Threat Intelligence service
An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?
GlobalProtect with Clientless VPN
App-ID cloud-based application signatures
User-ID agent or Panorama User-ID mapping
User-ID maps IP addresses to authenticated user identities, letting policy match on user rather than IP alone. Integrating the User-ID agent or Panorama mapping with the firewall supplies that identity data, which is precisely what Least Privilege Access under Zero Trust demands.
WildFire threat intelligence cloud
A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?
NAT policy source translation mapping
Static routing table optimization
App-ID based security policies
App-ID classifies traffic by application regardless of port or protocol, letting internal segmentation firewalls enforce granular allow/deny rules between tiers sharing a zone. This satisfies the requirement for precise intra-zone access control that port-based policies cannot achieve.
Zone Protection profiles against SYN floods
Want more Cybersecurity Fundamentals practice?
Practice this domainWhen configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?
Inside the Prisma Access Cloud Security Processing Node (SPN) cloud infrastructure.
Branch-to-branch traffic is routed into Prisma Access, where the Cloud Security Processing Node applies security policy and inspection within the cloud infrastructure. This satisfies the requirement that inter-branch flows are inspected without backhauling through a physical data centre.
Inside the customer-managed AWS Transit Gateway associated with the remote network.
On the Panorama management server located in the customer's primary datacenter.
On the local physical firewall at the originating branch office before it leaves the LAN.
An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?
Configure an explicit SAML authentication proxy on the Panorama management plane.
Configure an explicit proxy PAC file pointing all browser traffic to the Prisma Access Remote Networks gateway IP.
Install a dedicated VM-Series User-ID Agent on an EC2 instance in every public cloud VPC.
Deploy the Cloud Identity Engine (CIE) agent and configure directory synchronization with Microsoft Entra ID.
The Cloud Identity Engine agent synchronises user and group objects from Microsoft Entra ID into Prisma Access, letting it map identities to traffic logs. This satisfies the no-captive-portal constraint by supplying identity data without inline user authentication.
An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?
Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.
CSPM > Alerts surfaces the failed IAM policy check as a misconfiguration finding, where RQL filters by AWS IAM service and built-in auto-remediation applies the fix directly, satisfying the requirement to view and remediate this specific S3 permission issue.
Navigate to Panorama > Cloud Services > Native Security to update IAM roles.
Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.
Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.
An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?
Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.
Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.
Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.
Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.
Configuring the Prisma Cloud GitHub Action scans Terraform and CloudFormation templates at the pull request stage, satisfying the requirement to detect misconfigurations before deployment. Unlike runtime or registry scanning, this shifts detection left into CI, blocking flawed IaC from merging and reaching AWS.
An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?
Mount an Amazon EFS volume containing the Prisma Cloud scanner binary to the Lambda execution environment.
Configure AWS Inspector to forward Lambda scan results directly to the Prisma Cloud Console via an SNS topic.
Deploy a Prisma Cloud Compute Defender container inside the same VPC subnet as the Lambda functions.
Attach the Prisma Cloud Compute Lambda layer and configure the runtime wrapper to automatically scan the function upon invocation.
Prisma Cloud Compute instruments serverless functions by attaching its Lambda layer, which injects the runtime wrapper. That wrapper triggers vulnerability and compliance scanning automatically at invocation, giving continuous assessment without modifying function code or managing separate scanning infrastructure.
An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?
Configure Azure ExpressRoute Global Reach to bypass the Azure Load Balancer entirely.
Deploy an Azure Bastion host to proxy all inbound administrative and application sessions.
Configure an Azure Application Gateway in front of the Standard Load Balancer to perform Layer 7 proxying.
Enable Source NAT (SNAT) on the VM-Series firewall untrust/trust interface policies so return traffic flows back through the active firewall IP.
Azure Standard Load Balancer uses flow symmetry, so return traffic from backend VMs bypasses the firewall unless source NAT rewrites the source IP. Enabling SNAT on VM-Series policies forces return traffic back through the active firewall, resolving the asymmetry constraint.
Want more Cloud Security practice?
Practice this domainAn endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?
Disable the firewall profile associated with the endpoint group in Policy Management.
Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.
Removing isolation from the Endpoint Management action menu lifts the network block Cortex XDR imposed during the ransomware response. Since the threat is remediated and the endpoint verified clean, this restores connectivity without disabling protection.
Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.
Reboot the endpoint twice using the remote action menu to clear the isolation driver state.
An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?
Host Insights Response Actions
Agent Profile Distribution task
BIOC automated remediation playbooks
Cortex XDR Remote Response tool
Remote Response provides live terminal access, script execution and file retrieval on the endpoint itself, satisfying the requirement for real-time artefact collection rather than post-incident log review. It operates through the Cortex XDR agent, so no reimaging or offline imaging is needed.
A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?
Add the file path as an exclusion in the OS-level Windows Defender settings.
Disable the local analysis module entirely for the affected endpoint group.
Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.
A Malware Profile exception scoped to the executable's SHA-256 hash allows only that exact binary, unlike folder or wildcard exclusions that could be abused by substituted files. This preserves maximum security while unblocking the development tool.
Change the agent profile operating mode from Prevention to Audit mode globally.
An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?
Add the browser executable path to the OS exclusions list in Cortex XDR.
Change the exploit protection behavior for the specific technique to 'Report' instead of 'Terminate'.
Setting the specific technique to 'Report' logs the exploit attempt without terminating the process, so the crashing plugin keeps running while telemetry reveals whether that rule caused the crash. Other techniques stay enforced, satisfying the requirement to troubleshoot without disabling exploit protection entirely.
Disable memory protection features globally in the agent settings profile.
Enable Agent Self-Protection to prevent local interference.
An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?
Lower the threat severity threshold for Behavioral Threat Protection in the agent profile.
Set the Cortex XDR Agent to troubleshooting mode for the affected subnet.
Add the application directory to the system-wide exclusion list in the Malware Profile.
Create a Behavioral Threat Protection exception specifying the application hash and the triggered rule ID.
A BTP exception scoped to both the application hash and the triggered rule ID suppresses only that precise detection, leaving BTP active for every other process and rule. The hash constrains the exception to this line-of-business binary, while the rule ID prevents blanket suppression of the injection technique across the estate.
An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?
Configured via the Windows Registry under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\Proxy.
Configured through the local Windows Internet Options control panel.
Managed automatically via DNS SRV records without console configuration.
Configured directly in the Agent Settings profile within the Cortex XDR console.
Proxy settings for Cortex XDR agents are defined in the Agent Settings profile in the Cortex XDR console, which the agent retrieves and applies. This centrally satisfies the stem's requirement that agents verify their connection through the corporate HTTP proxy.
Want more Endpoint Security practice?
Practice this domainA security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?
Defense Evasion
Collection
Discovery
Credential Access
LSASS memory dumping maps to OS Credential Dumping (T1003) under the Credential Access tactic, which covers techniques for stealing credentials such as account names and passwords. The stem specifies harvesting credentials, directly satisfying that tactic's definition rather than Execution, Collection or Privilege Escalation.
A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?
Rapid, automated encryption of all endpoints for immediate financial ransom
Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits
Immediate self-replication across all reachable network segments without persistence goals
Persistent, targeted, and methodical human-driven objective execution with customized tooling
Human operators pursuing a defined objective, adapting custom tooling and pacing exfiltration slowly, is the axis separating APTs from commodity campaigns, which rely on reusable, indiscriminate payloads. This satisfies the stem's custom C2, low-and-slow exfiltration and living-off-the-land indicators.
An enterprise is integrating Microsoft Entra ID (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?
Locally on the GlobalProtect gateway via local user database groups
Within the Panorama Log Forwarding profile settings
On the identity provider (IdP) during the authentication and token issuance phase
Microsoft Entra ID evaluates conditional access during authentication, before issuing the SAML token. Device compliance signals flow into that evaluation, so unmanaged devices are blocked at token issuance and never reach GlobalProtect's gateway, satisfying the requirement to block sensitive segment access.
Inside the firewall security policy rule base post-authentication
An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?
Assign the built-in superuser administrator role to the user account.
Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.
An Admin Role Profile defines granular permissions per functional area, so configuring it as read-only for configuration and logs grants visibility without write capability. Assigning that profile to the junior analyst's account enforces least privilege, satisfying the requirement to view firewall configurations and logs while preventing any changes.
Grant dynamic device group ownership without specifying an admin role profile.
Configure password complexity requirements without modifying access profiles.
An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?
Perimeter-based defense centralization
Never trust, always verify through continuous context
Continuous context verification enforces identity, device health and application checks on every request, so access to the financial databases no longer depends on network location. This directly satisfies the stem's requirement for explicit verification rather than implicit trust.
Implicit trust verification via subnet placement
Static role-based implicit authorization
An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?
The Palo Alto Networks Next-Generation Firewall data plane
The Cortex XSOAR incident playbook engine
The external MFA server or Identity Provider integrated via RADIUS or SAML
The external MFA server or Identity Provider holds the second-factor secret and validates the push token, returning the authentication result to Prisma Access. Prisma Access itself acts as the service provider or gateway, not the token validator, so the integrated RADIUS or SAML component satisfies the stem.
The local administrator database on Panorama
Want more SOC Operations practice?
Practice this domainThe vendor does not publish an exact question count for the Cybersecurity-Practitioner. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Network Security, Cybersecurity Fundamentals, Cloud Security, Endpoint Security, SOC Operations. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks Cybersecurity-Practitioner exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.