Cybersecurity-Practitioner Practice Test 12 — 15 Questions

Question 1

A security administrator is reviewing a Palo Alto Networks firewall configuration and notices that a Security policy rule allowing outbound web traffic has no security profiles attached. The administrator wants to ensure that the rule is protected against known vulnerabilities, malware, and command-and-control traffic. Which security profile group should the administrator attach to the rule to provide this protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Security profile group containing Antivirus, Anti-Spyware, and Vulnerability Protection profiles. A Security profile group that includes Antivirus, Anti-Spyware, and Vulnerability Protection profiles delivers the layered threat inspection needed to detect malware, command-and-control traffic, and exploits. Applying a group is more efficient than attaching individual profiles and ensures consistent protection. The single-profile options each cover only part of the threat landscape and would leave gaps in the required coverage.

Answer

An Antivirus profile only

Answer

A custom URL Filtering profile only

Answer

A Vulnerability Protection profile only

Question 2

A hospital must ensure that electronic protected health information remains available and unaltered even if a ransomware incident encrypts production servers. The security officer is selecting a recovery control that provides a guaranteed, isolated copy of data that cannot be modified by an attacker who has compromised the production domain. Which control best meets this requirement?

Accepted Answer

An immutable, offline or air-gapped backup copy with separate credentials and retention locks. The requirement is for a recovery copy that remains intact even when the production domain is fully compromised. Immutable storage with retention locks prevents alteration or deletion, and keeping the copy offline or air-gapped with separate credentials places it beyond the attacker's reach. Replication and same-array snapshots improve resilience to hardware faults but faithfully reproduce malicious changes, so they cannot guarantee a clean recovery point.

Answer

A replicated database cluster that synchronously mirrors all writes to a second node

Answer

A storage area network snapshot retained for twenty-four hours on the same array

Answer

A nightly backup written to a share on the same domain with domain admin write access

Question 3

A security analyst notices that an internal web server is receiving a high volume of requests containing long strings of special characters in URL parameters, and the application log shows database error messages being returned to clients. The analyst suspects the application is vulnerable to an injection attack. Which practice most directly prevents this class of vulnerability in the application code?

Accepted Answer

Using parameterized queries with strict input validation. Injection vulnerabilities arise when untrusted input is concatenated into interpreter statements, letting data change the structure of a command or query. Parameterized queries, also called prepared statements, keep code and data separate so input cannot alter query logic, and strict validation rejects malformed values early. Network filtering and error handling may reduce exposure or aid detection, but they do not remove the coding flaw that enables the attack.

Answer

Deploying a web application firewall in blocking mode in front of the server

Answer

Enabling verbose error messages so developers can debug failures faster

Answer

Rotating database service account passwords every thirty days

Question 4

A security administrator is configuring a NAT policy on a Palo Alto Networks firewall. Internal users in the 10.1.1.0/24 subnet need to access the internet, but the organization has only a single public IP address, 203.0.113.5, on the untrusted interface. The administrator wants all internal users to share this public IP address when accessing external resources. Which NAT type should the administrator configure?

Accepted Answer

Source NAT with Dynamic IP and Port (DIPP). Source NAT with Dynamic IP and Port allows many internal hosts to share a single public IP address by translating both source IP and source port. This is the standard method for enabling outbound internet access for a subnet when only one public IP is available. Destination NAT, Dynamic IP only, and Static IP do not provide the port multiplexing needed for many-to-one translation.

Answer

Source NAT with Static IP

Answer

Destination NAT

Answer

Source NAT with Dynamic IP only

Question 5

An administrator is configuring Cortex XDR to allow a legitimate application that performs process injection for accessibility purposes. The application is currently being blocked by the agent's protection modules. Which action should the administrator take to allow the application while minimizing the reduction in security?

Accepted Answer

Create a Behavioral Threat exception for the specific process name and the injection behavior.. Behavioral Threat exceptions are designed to permit specific behaviors for specific processes, providing a surgical way to allow legitimate applications that might otherwise be blocked. This approach maintains protection against the same behavior from other processes, unlike disabling modules or creating global exclusions. It is the most precise and secure method.

Answer

Disable the Exploit Prevention module entirely on the endpoint.

Answer

Create a global exclusion for all process injection events on all endpoints.

Answer

Add the application's digital signature to the allow list in the Malware profile.

Question 6

A network security engineer is configuring a Palo Alto Networks firewall to prevent users from accessing known malicious websites. The engineer wants to ensure that the firewall blocks access based on a dynamically updated list of malicious URLs and IP addresses. Which feature should be configured to achieve this?

Accepted Answer

External Dynamic Lists (EDLs) with a malicious URL and IP feed. External Dynamic Lists (EDLs) are the correct feature to dynamically import and use lists of malicious URLs and IP addresses. By configuring EDLs and referencing them in security policies, the firewall can automatically block access to known malicious sites. Other options either require manual updates, are limited to DNS, or focus on file analysis rather than dynamic URL/IP blocking.

Answer

DNS Security profile with sinkhole action

Answer

WildFire analysis profile with inline ML

Answer

URL Filtering profile with a custom URL category

Question 7

A SOC team is using Cortex XDR to investigate a series of alerts indicating suspicious PowerShell execution on multiple endpoints. The analyst wants to create a custom detection rule that triggers when PowerShell is launched with the -EncodedCommand parameter and the parent process is not a known administrative tool. The analyst also wants to exclude a specific service account that legitimately uses encoded commands for automation. Which approach should the analyst take in Cortex XDR to meet these requirements?

Accepted Answer

Create a BIOC (Behavioral Indicator of Compromise) rule using the Cortex XDR rule editor, specifying the PowerShell command line pattern and a process exclusion for the service account.. BIOC rules in Cortex XDR are the correct mechanism for creating custom behavioral detections based on process and command-line attributes, with the ability to exclude specific users or processes. They operate in real time, integrate with the incident response workflow, and provide the granularity needed to detect encoded PowerShell while avoiding false positives from a known service account.

Answer

Configure a correlation rule in the Cortex XDR management console that uses the MITRE ATT&CK technique T1059.001 and applies a global allowlist for the service account.

Answer

Deploy a custom Cortex XDR agent script that monitors PowerShell execution and sends an alert to the management console, excluding the service account via a local configuration file.

Answer

Use the Cortex XDR Query Builder to schedule an XQL query that searches for the PowerShell command line and filters out the service account, then set it to generate an alert.

Question 8

A network administrator is configuring a Palo Alto Networks firewall to prevent TCP SYN flood attacks. The administrator wants to limit the number of half-open connections from a single source IP address to a specific destination. Which feature should the administrator configure?

Accepted Answer

SYN Flood Protection in a Zone Protection profile.. SYN Flood Protection is part of Zone Protection and allows the administrator to set thresholds for half-open connections per source and per destination. It can activate randomly early drop or SYN cookies to mitigate SYN floods. This directly meets the requirement to limit half-open connections from a single source IP to a specific destination.

Answer

ICMP Flood Protection in a Zone Protection profile.

Answer

Reconnaissance Protection in a Zone Protection profile.

Answer

Flood Protection for UDP in a Zone Protection profile.

Question 9

A security analyst is investigating a Windows endpoint where a user downloaded a legitimate-looking PDF invoice. The file executed a macro that spawned a child process, and Cortex XDR generated a 'Local Analysis Malware' alert. The analyst wants to determine whether the file was also submitted to WildFire for cloud-based verdict. Which Cortex XDR feature should the analyst check to confirm whether the file hash was sent for WildFire analysis?

Accepted Answer

The WildFire Submission Log in the Cortex XDR management console. WildFire submissions—whether automatic from the agent or manual from an analyst—are recorded in the WildFire Submission Log within the Cortex XDR console. Checking this log confirms whether the PDF hash was detonated in the cloud, what verdict was returned, and whether the file was already known. This gives the analyst the definitive cloud-analysis context needed to complete the investigation.

Answer

The Cortex XDR agent installation directory on the endpoint

Answer

The Endpoint Management inventory table filtered by agent version

Answer

The Audit Log filtered by the analyst's administrative actions

Question 10

A Cortex XDR administrator is configuring a Behavioral Threat protection policy for a finance department. The policy must prevent credential theft attempts where a non-browser process reads LSASS memory on Windows endpoints. The administrator wants the agent to block the behavior without terminating the parent process. Which Cortex XDR configuration should the administrator apply to meet this requirement?

Accepted Answer

Enable the 'Credential Gathering' behavior in the Behavioral Threat module with action set to Block. The Behavioral Threat module includes a Credential Gathering category specifically designed to detect and block unauthorized reads of LSASS memory. Setting the action to Block stops the credential theft attempt at the memory-access stage while leaving the calling process intact. This aligns with the requirement to prevent the behavior without terminating the parent process, preserving business continuity while stopping the attack.

Answer

Enable the 'Process Execution' behavior with action set to Report for all non-browser processes

Answer

Create a BIOC rule that matches lsass.exe as the target process and set the action to Terminate

Answer

Add lsass.exe to the Exploit Protection exclusions list for the finance department policy

Question 11

A security administrator is configuring a Cortex XDR agent policy for a group of Windows workstations that run a proprietary line-of-business application. The application frequently triggers behavioral threat alerts because it spawns command interpreters and writes to system directories. The administrator wants to suppress these known-good alerts without disabling behavioral threat protection for the rest of the endpoint. What should the administrator configure?

Accepted Answer

Add the application's executable to the allow list in the Behavioral Threat protection module and specify the relevant behavioral indicators.. Behavioral Threat protection in Cortex XDR can be tuned with an allow list that scopes exemptions to specific executables and behavioral indicators. This preserves detection coverage for all other processes while eliminating the noisy known-good alerts generated by the line-of-business application. Group-wide module disabling, BIOC ignores, and malware scanning exclusions do not target the behavioral detection engine correctly.

Answer

Exclude the application's installation directory from Real-Time Scanning in the Malware protection profile and restart the agent.

Answer

Create a BIOC rule that matches the application's process name and set its action to Ignore in the Cortex XDR management console.

Answer

Disable the Behavioral Threat protection module in the agent policy and rely solely on Malware protection for the workstation group.

Question 12

A SOC analyst is investigating a Cortex XDR alert indicating that a process attempted to write to a suspicious registry key on a Windows endpoint. The analyst wants to determine if the process is malicious by examining its behavior. Which Cortex XDR capability provides the most comprehensive view of process activity, including command-line arguments and parent-child relationships?

Accepted Answer

Process Execution History. Process Execution History offers the most comprehensive view by capturing process creation events, command-line arguments, and parent-child relationships. This allows the analyst to trace the origin of the suspicious process and understand its behavior in context, which is crucial for determining malicious intent. Other capabilities provide complementary data but lack the depth needed for behavioral analysis.

Answer

File Inventory

Answer

Network Connection Logs

Answer

Registry Monitoring

Question 13

A security operations analyst wants to verify that Cortex XDR agents on managed endpoints are actively communicating with the Cortex XDR server and receiving policy updates. Which Cortex XDR component is responsible for maintaining this communication channel between the agent and the management server?

Accepted Answer

The Cortex XDR agent's communication service that connects to the Cortex XDR server over the configured port. The Cortex XDR agent includes a dedicated communication service that maintains the channel to the management server, handling registration, heartbeats, and policy synchronization. Checking that this service is running and can reach the server confirms active connectivity. The management console, WildFire, and external dynamic lists serve different roles and do not provide the agent-to-server transport.

Answer

The external dynamic list service that synchronizes indicators from third-party feeds

Answer

The Cortex XDR management console web interface

Answer

The WildFire cloud analysis service that inspects files submitted from endpoints

Question 14

A Cortex XDR administrator needs to prevent users on a specific endpoint group from disabling the Cortex XDR agent through the Windows system tray. The administrator wants the agent to remain running and protected even if a user has local administrator rights. Which Cortex XDR agent setting should the administrator configure to achieve this?

Accepted Answer

Enable agent tamper protection in the endpoint policy. Tamper protection is the Cortex XDR agent capability designed to stop users from disabling, uninstalling, or modifying the agent, even with local administrator rights. Enabling it in the endpoint policy ensures the agent's services and files are protected, so attempts via the system tray or other local tools fail. This directly fulfills the requirement to keep the agent running and protected.

Answer

Apply a Windows Group Policy that removes the user's local administrator rights

Answer

Configure a BIOC rule to alert when the agent service stops

Answer

Set the agent to run in kernel mode instead of user mode

Question 15

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script that downloads a file from a remote server. The analyst wants to determine if the file was executed and, if so, what child processes it spawned. Which Cortex XDR data source should the analyst query?

Accepted Answer

Process execution logs. Process execution logs are the definitive source for determining if a file was executed and what child processes it created. They capture command lines, parent process IDs, and execution timestamps, enabling the analyst to reconstruct the attack chain after the download.

Answer

Registry modification events

Answer

Network connection logs

Answer

File inventory