Cybersecurity-Practitioner Practice Test — Free Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) Questions with Explanations

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

A security team wants to prevent a specific known-malicious executable from running on all Windows endpoints managed by Cortex XDR. The file's SHA-256 hash is known, but the filename may vary. They must ensure the block is enforced even if the file is renamed. Which Cortex XDR capability should they use?

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?

An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

A Cortex XDR administrator wants to reduce alert noise from a custom internal application that legitimately writes to the Windows registry Run key during installation. The administrator needs to suppress future alerts for this specific behavior on a defined group of developer endpoints without disabling the Behavioral Threat module globally. Which Cortex XDR capability should the administrator use?

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

What is the primary function of the Prisma Cloud Data Security module?

A security operations team is using Prisma Cloud to monitor their AWS environment. They receive an alert about an S3 bucket that is publicly accessible. The team wants to quickly identify which users or roles have permissions to modify the bucket policy. Which Prisma Cloud feature should they use?

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?