Cybersecurity-Practitioner Flashcards — Free Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) Study Cards

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?

An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?

An administrator configures a decryption policy to 'No Decrypt' for financial institution websites to comply with privacy regulations. However, the firewall is still decrypting traffic to certain banking sites. Upon investigation, the administrator discovers that the firewall is matching a pre-defined PAN-OS SSL Decryption Exclusion list. How can the administrator override or modify this behavior?

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?