Cybersecurity-Practitioner Practice Test 13 — 15 Questions

Question 1

An organization is building a Zero Trust Architecture and deploying Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation. Which THREE design elements are essential for a successful Zero Trust segmentation deployment? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Explicit security policy rules enforcing least privilege between internal security zones. Option A is correct because Zero Trust micro-segmentation requires explicit security policy rules that enforce least-privilege access between internal security zones, replacing implicit trust with deny-by-default, zone-to-zone controls. Option B is correct because integrating User-ID lets the firewall map IP addresses to users and groups, so identity-based policy can be enforced consistently regardless of where a user or device connects. Option D is correct because App-ID granular policies identify applications by their actual traffic characteristics and inspect payloads regardless of port or protocol, which is essential for preventing evasion and enforcing application-level least privilege. Option C is not correct because port-based allow rules are exactly the legacy, trust-based approach Zero Trust segmentation is meant to replace, since applications can tunnel over allowed ports. Option E is not correct because default allow policies across internal zones contradict Zero Trust's deny-by-default and least-privilege principles, even if they simplify operations.

Answer

Reliance on port-based port-allow rules for broad internal network blocks

Answer

Default allow policies across all internal zones to maximize operational efficiency

Question 2

A security engineer is deploying Cortex XDR agents to a fleet of Linux servers. The engineer wants to prevent users on those servers from terminating the agent process or unloading its kernel module. Which Cortex XDR feature should the engineer enable to protect the agent from tampering on the Linux endpoints?

Accepted Answer

Enable the agent self-protection setting in the endpoint policy so the agent resists termination and module unloading attempts.. Agent self-protection is the Cortex XDR feature that defends the agent against termination, process killing, and kernel module unloading by local users, including privileged ones. Enabling it in the endpoint policy directly addresses the tampering concern on Linux servers. Host Firewall, Device Control, and Exploit Protection address different security domains and cannot prevent agent tampering.

Answer

Configure a Host Firewall rule that blocks outbound connections from the agent process to the Cortex XDR server.

Answer

Apply a Device Control policy that prevents execution of unsigned binaries on the Linux servers.

Answer

Enable the Exploit Protection module with kernel-level mitigation rules for all processes on the Linux servers.

Question 3

A SOC analyst is reviewing a Cortex XDR incident involving a suspicious executable that was flagged as malware. The analyst wants to determine the initial infection vector and whether the malware has spread to other endpoints. Which Cortex XDR feature should the analyst use to visualize the process execution chain and related network activity?

Accepted Answer

Causality view. The Causality view is the correct tool because it visually maps the sequence of process executions, network connections, and file operations related to an alert. This enables the analyst to trace the attack back to its origin and identify any lateral movement or additional affected endpoints, which are key to understanding the infection vector and spread.

Answer

Threat intelligence platform

Answer

Incident response playbook

Answer

Alerts dashboard

Question 4

A security analyst observes that a Cortex XDR agent on a Windows server is not enforcing exploit protection rules even though the policy is assigned. The agent status shows as connected and other modules are working. Which action should the analyst take first to diagnose the issue?

Accepted Answer

Verify that the exploit protection module is enabled in the assigned policy and that the server's operating system is supported. Verifying that exploit protection is enabled in the assigned policy and that the server OS is supported is the correct first step because non-enforcement often stems from a disabled module setting or an unsupported platform. Reinstalling, disabling other modules, or changing proxy settings do not address these likely causes and may introduce unnecessary disruption.

Answer

Reinstall the Cortex XDR agent on the server

Answer

Disable all other protection modules to isolate exploit protection

Answer

Change the agent's communication proxy settings

Question 5

A Cortex XDR administrator is investigating an alert where a process attempted to inject code into a legitimate system process. The administrator wants to understand the sequence of events that led to the alert. Which Cortex XDR feature provides a visual representation of related events and process lineage to aid in this investigation?

Accepted Answer

Causality Analysis view.. Causality Analysis view is designed to visualize the chain of events and process relationships, making it the correct tool for investigating how an alert occurred. It shows the process tree and associated activities, enabling analysts to trace the sequence of events. The other options are either lists without visual context or unrelated to event investigation.

Answer

Alerts table with filtering by alert name.

Answer

Policy Audit log.

Answer

Endpoint Management inventory.

Question 6

A SOC analyst is triaging a Cortex XDR alert where a process on a Windows endpoint executed 'vssadmin.exe delete shadows /all /quiet'. The parent process is 'cmd.exe', which was spawned by a Microsoft Word macro. Which Cortex XDR artifact should the analyst pivot to first to determine if this is part of a broader ransomware attack?

Accepted Answer

The process execution timeline for the endpoint, filtered by the initiating process hash.. The process execution timeline filtered by the initiating process hash provides a complete view of all processes spawned by the malicious macro, allowing the analyst to quickly identify additional ransomware behaviors such as file encryption, service stopping, or lateral movement tooling. This pivot is critical for determining the full scope of the attack on the endpoint and guiding containment efforts.

Answer

The network connections map for the endpoint, filtered by destination port 445.

Answer

The file quarantine list for the endpoint, sorted by most recent detection.

Answer

The registry modifications log for the endpoint, filtered by the user account that opened the document.

Question 7

A SOC analyst receives a Cortex XDR alert indicating that a process attempted to modify the registry key 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run' on a critical server. The analyst wants to quickly determine which process made the modification and its command line. Which Cortex XDR artifact should the analyst examine first?

Accepted Answer

Registry event details in the Causality View. Causality View is the primary tool in Cortex XDR for visualizing the chain of events leading to an alert, including registry modifications. It shows the process responsible, its parent, and the command line, enabling rapid triage. Other artifacts like network connections or file hashes are supplementary and do not directly answer the question.

Answer

File hash of the process executable

Answer

User account that triggered the alert

Answer

Network connections associated with the alert

Question 8

A SOC analyst is reviewing a Cortex XDR incident involving a compromised endpoint. The analyst observes that the attacker used 'wmic.exe' to create a process on a remote system. Which of the following is the most appropriate immediate containment action?

Accepted Answer

Isolate the compromised endpoint from the network using Cortex XDR isolation.. The correct immediate containment action is to isolate the compromised endpoint. This stops the attacker from using the endpoint for lateral movement or further attacks. Isolation via Cortex XDR is quick and effective, allowing the SOC to investigate without risking additional damage.

Answer

Disable the user account associated with the compromised endpoint.

Answer

Run a full scan on all endpoints in the network to detect additional compromises.

Answer

Block the remote IP address used by wmic.exe at the firewall.

Question 9

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?

Accepted Answer

Defense Evasion. Defense Evasion (TA0005) covers techniques adversaries use to avoid detection, and Base64 encoding of scripts is a classic obfuscation method (T1027, Obfuscated Files or Information) that hides malicious content from signature-based scanners. Encoding does not change the script's function — it only masks its appearance. This maps directly to the Defense Evasion tactic.

Answer

Initial Access

Answer

Exfiltration

Answer

Collection

Question 10

An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?

Accepted Answer

Layer 3 interface assigned to an Untrust security zone. A Layer 3 interface assigned to an Untrust security zone is correct because connecting to an untrusted ISP router requires IP routing and security policy enforcement. The Untrust zone is the standard designation for external, untrusted networks like the internet, and Layer 3 interfaces support IP addressing, routing, and zone-based security rules. This configuration allows the firewall to route traffic between the ISP and internal networks while applying security policies.

Answer

Tap interface assigned to an Internal zone

Answer

Virtual Wire interface assigned to a DMZ zone

Answer

HA1 interface assigned to the Management zone

Question 11

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

Accepted Answer

Execute an automated Cortex XSOAR playbook task invoking the PAN-OS XML API to terminate the active user session. To immediately terminate an active user session across all enforcement points in a Zero Trust architecture, the administrator should execute an automated Cortex XSOAR playbook task that invokes the PAN-OS XML API to terminate the session. This API call instructs the firewall (Prisma Access) to drop the session and invalidate the user's authentication, enforcing the Zero Trust decision in real time. Manual or delayed methods cannot achieve immediate termination.

Answer

Clear the Dynamic Address Group tags manually via a Syslog alert

Answer

Wait for the active DHCP lease to expire on the core switch

Answer

Restart the management server daemon on Panorama

Question 12

An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?

Accepted Answer

URL Filtering Profile attached to the relevant Security policy rule. URL Filtering Profiles in Palo Alto Networks firewalls are attached to Security policy rules and control which URL categories are allowed or blocked. To block gambling and adult categories while allowing all other business sites, the administrator creates a URL Filtering Profile with those categories set to block, then attaches it to the relevant Security rule. This is the standard, granular way to enforce category-based web access control.

Answer

Zone Protection Profile applied to the external zone

Answer

Data Filtering Profile attached to the NAT policy

Answer

Authentication Profile configured under Device > Setup

Question 13

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Accepted Answer

Actions on Objectives (exfiltrating data or lateral movement across internal zones). The three correct phases are those where attacker traffic actually crosses into or out of the enterprise network and can be inspected by a Palo Alto Networks firewall. Delivery (B) is correct because the malicious payload (email attachment, web download, or exploit kit) is transmitted to the internal target, so the firewall's URL filtering, file blocking, and vulnerability protection can detect or block it. Command and Control (C) is correct because compromised hosts initiate outbound sessions to external C2 servers, which the firewall can identify via App-ID, DNS sinkholing, and threat prevention signatures. Actions on Objectives (A) is correct because the attacker's post-exploitation activity, such as lateral movement across internal zones or data exfiltration, generates east-west and outbound traffic that the firewall can detect and disrupt through zone-based policies and data filtering. Reconnaissance (D) is not correct because it typically occurs outside the target's network via public sources, so the firewall has no traffic to inspect. Weaponization (E) is not correct because it happens in the attacker's own offline environment before any interaction with the target enterprise network.

Answer

Reconnaissance (researching target organization via public social media without direct network interaction)

Answer

Weaponization (coupling an exploit with a backdoor in the attacker's offline lab environment)

Question 14

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Accepted Answer

URL Filtering profile configured with Credential Theft Prevention settings. URL Filtering profiles include Credential Theft Prevention features that inspect HTTP submissions against corporate credential settings.

Answer

Data Filtering profile configured for credit card pattern matching

Answer

Vulnerability Protection profile with HTTP header inspection

Answer

Anti-Spyware profile configured with DNS sinkholing

Question 15

An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)

Accepted Answer

A single virtual router can support multiple routing protocols including OSPFv2, OSPFv3, and BGP simultaneously.. Option A is correct because a single Palo Alto Networks virtual router can run multiple dynamic routing protocols at once, including OSPFv2, OSPFv3, and BGP, allowing flexible path selection in complex environments. Option B is correct because static routes support path monitoring via track objects (e.g., tracking a next-hop IP or interface), enabling automatic failover to a backup route when the tracked object goes down. Option E is correct because default routes (0.0.0.0/0) can be redistributed into BGP or OSPF through route redistribution profiles, which is useful for advertising a default path dynamically. Option C is incorrect because virtual routers operate at Layer 3 and forward based on IP routing tables, not Layer 2 VLAN tagging. Option D is incorrect because virtual routers on the same firewall can share or leak routes between them using static or dynamic route redistribution without any physical cable connection.

Answer

Virtual routers operate at Layer 2 and require VLAN tagging to forward packets.

Answer

Virtual routers cannot share routes with other virtual routers on the same firewall without physical cable connections.