Cybersecurity-Practitioner Practice Test 1 — 10 Questions

Question 1

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Proxy server address and port.. To enable communication through a forward proxy, the agent configuration must include the proxy server address and port, as well as authentication credentials if the proxy requires them. These settings allow the agent to establish a connection and authenticate with the proxy, ensuring that telemetry and management traffic reach the Cortex XDR management server.

Answer

DNS server addresses for the proxy.

Answer

Broker VM address and port.

Answer

SSL/TLS certificate for the proxy.

Question 2

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

Accepted Answer

Causality View. Causality View is designed specifically for visualizing process ancestry and the details of each process, including command-line arguments. In a scenario where a suspicious process is spawned by an Office application, this view enables the analyst to quickly see whether the PowerShell command is obfuscated or contains malicious parameters, thereby accelerating triage.

Answer

Incident Timeline

Answer

Threat Intelligence

Answer

Alert Details

Question 3

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

Accepted Answer

Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.. The Prisma Cloud GitHub Action is the purpose-built CI/CD integration that scans Infrastructure as Code (Terraform, CloudFormation, ARM, Kubernetes manifests) directly within the GitHub pull request workflow, catching misconfigurations before they are merged or deployed. It authenticates to the Prisma Cloud CSPM API, runs IaC policy checks against the templates, and reports findings as PR comments or status checks. This shifts security left, which is the core goal of scanning IaC in a repository.

Answer

Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.

Answer

Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.

Answer

Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.

Question 4

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

Accepted Answer

Modify the User-ID idle timeout and mapping aging timers in Device > User-ID > Edit settings.. User-ID mappings age out based on the idle timeout and mapping aging timers configured under Device > User-ID > Edit settings. Reducing these timers shortens how long the firewall retains a stale user-to-IP mapping after logoff, which directly addresses the 45-minute attribution problem.

Answer

Change the Security policy session timeout value to 5 minutes.

Answer

Enable Captive Portal as a primary authentication fallback mechanism.

Answer

Increase the GlobalProtect portal idle disconnect timer.

Question 5

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

Accepted Answer

The host is infected with malware that uses DGA to locate its command-and-control (C2) server.. The random-looking subdomains and regular intervals are classic signs of a domain generation algorithm (DGA) used by malware to find its command-and-control server. The host is likely infected and attempting to resolve domains until it reaches the attacker's active C2. This behavior is distinct from DNS amplification, domain fronting, or DNS tunneling, which have different traffic patterns.

Answer

The host is exfiltrating data via DNS tunneling to the domain.

Answer

The host is performing a DNS amplification attack against the domain.

Answer

The host is using a domain fronting technique to hide its traffic.

Question 6

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

Accepted Answer

Device > Setup > Management > General Settings. The idle timeout for firewall administrators logging into the Web Interface is configured under Device > Setup > Management > General Settings. Within this pane, the 'Idle Timeout' field (default 60 minutes) controls how long an inactive administrative session can remain open before the firewall forces re-authentication. Setting it to 15 minutes satisfies the requirement to auto-logout unattended consoles.

Answer

Policies > NAT

Answer

Network > Interfaces > Loopback

Answer

Objects > Tags

Question 7

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

Accepted Answer

Inline Machine Learning analysis that evaluates web traffic and categorizes Newly Registered Domains (NRDs) in real-time.. Advanced URL Filtering's inline machine learning engine analyzes web traffic in real time and can categorize Newly Registered Domains (NRDs) — domains registered within the last 24 hours (or a few hours) — as malicious even before they appear in any static blocklist. This is the feature that catches short-lived, fast-flux phishing and malware domains that traditional URL databases miss.

Answer

GlobalProtect endpoint registry checks for browser history.

Answer

Client-side proxy PAC file lookups against local browser blocklists.

Answer

Static URL database updates downloaded from Panorama once every 24 hours.

Question 8

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

Accepted Answer

The firewall detected TCP traffic that does not match any known application signature database entry.. When App-ID cannot match a session to any known application signature, the firewall falls back to a generic layer-4 classification such as unknown-tcp, unknown-udp, or unknown-p2p. This indicates the traffic is TCP but does not correspond to any application in the signature database, often because it is custom, encrypted without decryption, or evasive.

Answer

The traffic has been blocked by a Security policy rule.

Answer

The session is an encrypted SSL handshake that failed decryption.

Answer

The application is a predefined system service running on the management plane.

Question 9

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

Accepted Answer

Domain generation algorithm (DGA) activity. Domain generation algorithm (DGA) activity is the most likely explanation because malware uses DGAs to generate many random domain names and attempt to contact a command-and-control server. The pattern of numerous failed resolutions with occasional successes from a single host is a strong indicator of DGA-based malware communication, distinguishing it from other DNS-related attacks.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS tunneling

Question 10

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. A DoS Protection profile with classified and aggregate rate limiting rules is specifically designed to mitigate volumetric and application-layer floods, including HTTP GET floods, by rate-limiting based on source, destination, or application criteria while allowing legitimate traffic. This is the correct platform capability to tune for this attack.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic