Cybersecurity-Practitioner Practice Test 14 — 15 Questions

Question 1

A security analyst is examining an advanced malware sample reported by Cortex XDR. The malware utilizes sophisticated evasion techniques. Which THREE of the following MITRE ATT&CK techniques are commonly associated with the Defense Evasion tactic? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obfuscated Files or Information (e.g., encoded scripts or packed binaries). Option A, Obfuscated Files or Information, is correct because it belongs to the Defense Evasion tactic (T1027) and covers encoding scripts, packing binaries, and encrypting payloads to hide malicious content from static and dynamic analysis. Option B, Indicator Removal on Host, is correct because it is a Defense Evasion technique (T1070) that includes clearing Windows event logs, deleting audit trails, and removing artifacts to hinder forensic investigation. Option C, Masquerading, is correct because it is a Defense Evasion technique (T1036) where adversaries rename or place malicious files to appear as legitimate system executables or trusted utilities, deceiving users and security tools. Option D, Remote System Discovery via network ping sweeps, is not correct because it falls under the Discovery tactic (T1018), used for mapping remote systems rather than evading defenses. Option E, Data Staged for Exfiltration, is not correct because it belongs to the Collection tactic (T1074), involving centralizing data prior to exfiltration, not defense evasion.

Answer

Remote System Discovery via network ping sweeps

Answer

Data Staged for Exfiltration

Question 2

Which TWO metrics or features are provided by Prisma Autonomous DEM (ADEM) to troubleshoot remote user application performance issues? (Choose two)

Accepted Answer

Synthetic test monitoring that periodically simulates user interactions and application access from remote locations.. ADEM provides synthetic testing (scripted user actions) and real-user monitoring (capturing device metrics, Wi-Fi, CPU, and network path latency).

Answer

Automated quarantine of infected container workloads in public cloud Kubernetes clusters.

Answer

Direct decryption and viewing of private banking user passwords traversing HTTPS sessions.

Answer

Automated firmware flashing for branch office switch hardware.

Question 3

An administrator wants to configure authentication for firewall administrators using RADIUS. Where in the Panorama Web Interface should the administrator configure the RADIUS server profile?

Accepted Answer

Device > Server Profiles > RADIUS. In Panorama, server profiles for external authentication services such as RADIUS, LDAP, TACACS+, Kerberos, and SAML are configured under Device > Server Profiles. The RADIUS profile is created there and then referenced in authentication settings for firewall administrators or GlobalProtect.

Answer

Objects > Addresses

Answer

Policies > Security

Answer

Network > GlobalProtect > Portals

Question 4

A security operations team is implementing zero trust network access (ZTNA) principles across the enterprise. According to foundational Zero Trust architecture guidelines, which THREE tenets must be enforced? (Choose three)

Accepted Answer

Verify explicitly by authenticating and authorizing based on all available data points. Option A is correct because the foundational Zero Trust principle of 'verify explicitly' requires every access request to be authenticated and authorized using all available data points, such as user identity, device health, location, and behavioral signals, rather than relying on a single credential check. Option C is correct because 'assume breach' mandates continuous monitoring of all sessions, telemetry, and traffic to detect anomalous behavior and limit lateral movement, treating no session as inherently safe. Option D is correct because Zero Trust requires limiting user access through Just-In-Time and Just-Enough-Access (JIT/JEA) principles, granting only the minimum permissions needed for the minimum time required, often combined with adaptive, risk-based policies. Option B is incorrect because automatically trusting users and devices after a one-time perimeter authentication is the traditional castle-and-moat model that Zero Trust explicitly rejects. Option E is incorrect because granting broad internal network access to partners or contractors violates least-privilege and microsegmentation principles, regardless of operational convenience.

Answer

Trust users and devices automatically once they successfully authenticate at the network perimeter

Answer

Grant broad internal network access to trusted partners and contractors to streamline operations

Question 5

A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?

Accepted Answer

Least-privilege principles. Least-privilege principles dictate that users are granted only the minimum permissions required to perform their job functions. In Cortex XDR, administrative access should be scoped to specific roles and responsibilities, avoiding excessive privileges. This reduces the attack surface and potential for insider threats or credential misuse.

Answer

Role-Based Access Control expansion

Answer

Zero Trust Architecture

Answer

Federated Identity Management

Question 6

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

Accepted Answer

Cortex XDR Remote Response tool. The Cortex XDR Remote Response tool allows administrators to execute scripts and retrieve files directly from endpoints in real time, enabling live forensic artifact collection. This capability is designed for interactive response actions on compromised endpoints.

Answer

Host Insights Response Actions

Answer

Agent Profile Distribution task

Answer

BIOC automated remediation playbooks

Question 7

Which THREE conditions or indicators typically trigger an automated endpoint isolation action in Cortex XDR? (Choose three)

Accepted Answer

Critical Behavioral Indicator of Compromise (BIOC) match indicating active data exfiltration.. Option A is correct because a critical Behavioral Indicator of Compromise (BIOC) match that indicates active data exfiltration represents a high-severity, in-progress threat, which is exactly the kind of condition Cortex XDR uses to automatically isolate an endpoint and stop the data loss. Option B is correct because high-confidence Command and Control (C2) communication detected through behavioral analysis signals an active attacker channel, and automated isolation is a standard response to cut off that C2 traffic. Option D is correct because confirmed ransomware execution encrypting local files is an active, destructive attack requiring immediate containment, so Cortex XDR triggers automated endpoint isolation to halt further encryption. Option C is not correct because a failed Windows Update is a routine software/patch management issue, not a security incident that warrants isolating the endpoint. Option E is not correct because a user visiting an unauthorized social media site is a policy violation at most, not a malicious threat indicator that would trigger automated isolation.

Answer

A standard software update failing to install via Windows Update.

Answer

A user attempting to access an unauthorized social media website during lunch.

Question 8

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

Accepted Answer

ICMP and UDP flood protection setting packet rate thresholds.. Zone Protection Profiles in PAN-OS include Flood Protection, which covers ICMP and UDP flood protection by setting packet rate thresholds (option A), and SYN Flood protection that can use SYN cookies or RED to mitigate TCP SYN floods (option B). They also include Reconnaissance Protection and Spoofed IP address detection, which blocks packets whose source IPs match internal subnets arriving on external interfaces (option D). Options C and E are incorrect because URL filtering categorization and malware sandboxing are handled by URL Filtering profiles and WildFire/sandboxing services, not by Zone Protection Profiles, which focus on layer 2/3/4 flood, reconnaissance, and spoofing defenses.

Answer

Advanced URL filtering categorization of malicious phishing links.

Answer

Automatic kernel-level malware sandboxing of unknown executable attachments.

Question 9

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Accepted Answer

SQL Injection attacks. SQL Injection (D) is a classic application-layer injection attack in which attacker-supplied input is interpreted as SQL code by the backend database, and NGFW security profiles such as vulnerability protection can detect and block the malicious payloads. Cross-Site Scripting (E) is likewise a web application-layer attack where script is injected into pages viewed by other users, and it can be mitigated by NGFW URL filtering, antivirus, and vulnerability/application security profiles inspecting HTTP traffic. The remaining options are not web-based injection or application-layer attacks: a fiber optic cable cut (A) is a physical layer availability incident, a server power supply failure (B) is a hardware fault, and cooling fan speed degradation in the management plane (C) is an environmental/hardware monitoring issue, none of which are mitigated by NGFW security profiles.

Answer

Fiber optic cable fiber cut

Answer

Physical server hardware power supply failure

Answer

Management plane cooling fan speed degradation

Question 10

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

Accepted Answer

Data exfiltration of sensitive source code or credit cards over encrypted HTTPS sessions goes undetected by Data Filtering profiles. When SSL/TLS traffic is not decrypted, the firewall cannot inspect the plaintext payload, so option A is correct: sensitive data such as source code or credit card numbers can be exfiltrated inside HTTPS sessions without Data Filtering profiles detecting it. Option B is correct because command-and-control callbacks tunneled over HTTPS appear as ordinary web traffic, allowing them to evade Anti-Spyware signatures that would otherwise match the malicious payload. Option D is correct because malware and trojans encapsulated in HTTPS streams are never exposed to Antivirus or WildFire analysis, so those threats pass uninspected. Option C is not correct because App-ID can still identify encrypted applications using TLS metadata such as SNI, certificates, and JA3 fingerprints, even without decryption. Option E is not correct because SSL/TLS decryption is unrelated to Layer 3 forwarding; the firewall still routes IP packets across static routes regardless of decryption policy.

Answer

App-ID fails entirely to identify any encrypted applications

Answer

The firewall is unable to forward Layer 3 IP packets across static routes

Question 11

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

Accepted Answer

The User-ID agent or GlobalProtect portal has not been configured to register the user's IP address with the specific tag name used in the DAG filter.. The most likely root cause is that the User-ID agent or GlobalProtect portal has not been configured to register the user's IP address with the specific tag name used in the DAG filter. Dynamic address groups based on tags require that the tags are properly assigned to IP addresses through User-ID or other tag registration methods.

Answer

Security policy rules cannot reference DAGs unless a Decryption profile is explicitly attached.

Answer

The XML API key lacks administrative privileges to register IP-to-tag mappings on the management plane.

Answer

The address object must be converted to a static IP subnet because DAGs do not support User-ID tags.

Question 12

An incident response team is analyzing an Advanced Persistent Threat (APT) group that has successfully infiltrated a corporate network. Which THREE characteristics are typically associated with APT campaigns compared to opportunistic malware? (Choose three)

Accepted Answer

Highly targeted objectives directed at specific intellectual property or geopolitical intelligence. Option A is correct because APT campaigns are defined by highly targeted objectives, focusing on specific intellectual property, strategic data, or geopolitical intelligence rather than broad, opportunistic gain. Option D is correct because APTs prioritize operational stealth and long-term persistence, using techniques like credential theft, scheduled tasks, and covert command-and-control channels to remain undetected for months or years. Option E is correct because APT actors typically deploy custom malware, zero-day exploits, and living-off-the-land binaries (LOLBins) such as PowerShell or WMI to blend into the victim environment and evade signature-based detection. Option B does not belong because indiscriminate mass distribution via automated spam is characteristic of opportunistic malware like ransomware worms, not targeted APTs. Option C does not belong because APTs seek to maintain and expand access, not immediately self-destruct their infrastructure upon payload execution.

Answer

Indiscriminate, mass distribution via automated spam campaigns aiming for immediate widespread ransom

Answer

Immediate self-destruction of the compromised infrastructure upon payload execution

Question 13

An administrator is troubleshooting a BGP routing peer connection between the Palo Alto Networks firewall and an external provider router. The BGP session is stuck in the 'Connect' state. Inspection of system logs indicates TCP port 179 packets sent by the firewall are being transmitted, but no SYN-ACK is received. Which troubleshooting step or feature verification should be performed first?

Accepted Answer

Verify that a Security policy rule with application 'bgp' (or service tcp-179) from the external zone to 'zone: 'to-firewall'' permits control plane traffic, or check Zone Protection / Management Profile settings.. A BGP session stuck in 'Connect' state means the firewall is sending TCP SYN to port 179 but not receiving SYN-ACK, indicating the return path or policy is blocking the handshake. On Palo Alto Networks firewalls, control-plane traffic to the firewall itself is governed by Security policy rules targeting the 'to-firewall' zone (or the management interface's Management Profile), so verifying that a rule permits BGP (application bgp or service tcp-179) from the external zone is the correct first step. Zone Protection profiles can also drop control-plane packets if configured too aggressively.

Answer

Reconfigure the Virtual Wire interface pair to handle BGP encapsulation headers.

Answer

Restart the Management server process using the CLI command 'debug software restart management-server'.

Answer

Convert the BGP peer to OSPFv3 protocol.

Question 14

An administrator configures a Security policy rule with an application dependency on 'ssl', but the target application is 'custom-app'. When committing the configuration, the firewall generates a warning or error regarding application dependencies. What is the correct way to handle application dependencies in Palo Alto Networks firewalls?

Accepted Answer

Explicitly include both the dependent application and all required dependent applications in the Security policy rule.. In Palo Alto Networks firewalls, when a Security policy rule references an application that has dependencies (e.g., 'custom-app' depends on 'ssl'), the rule must explicitly include all dependent applications. This ensures that the firewall can correctly identify and allow the necessary underlying traffic. The correct approach is to include both the dependent application and its dependencies in the rule.

Answer

Place the dependent application above the dependency in the Security policy table.

Answer

Create a custom App-Override policy for the dependent application to bypass Layer 7 inspection.

Answer

Disable application dependency checking globally under Device > Setup > Content.

Question 15

A security administrator is troubleshooting an issue where internal users cannot reach a specific external website, and the traffic is being dropped by the firewall. The administrator suspects a Threat Prevention profile is blocking the response as a command-and-control callback. Where should the administrator look to verify the exact threat signature ID and packet capture that triggered the block?

Accepted Answer

Monitor > Logs > Threat. Threat Prevention blocks are logged in Monitor > Logs > Threat, which records the threat signature ID, severity, action taken, and often a packet capture for the offending session. This is the only log type that contains the specific signature and packet-level detail the administrator needs to confirm which Threat Prevention profile blocked the response. Traffic logs show allow/deny but not the signature ID or packet capture.

Answer

Policies > Security

Answer

Network > Network Profiles > Zones

Answer

Monitor > Logs > Traffic