Cybersecurity-Practitioner Practice Test 15 — 15 Questions

Question 1

An administrator is configuring a Destination NAT rule to forward inbound web traffic from the internet to an internal web server. The administrator notices that when internal users try to access the web server using its public IP address (Hairpinning/NAT Loopback), the connection fails. What additional rule is required to support NAT Loopback?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A separate Source NAT rule that allows traffic from the internal zone to the internal zone, translating the source IP to the internal interface IP.. NAT Loopback (hairpinning) occurs when an internal client accesses an internal server via its public IP. This requires a Source NAT rule that translates internal source IPs to the firewall's internal interface IP so the server replies back to the firewall rather than directly to the client.

Answer

A security policy rule blocking inter-zone traffic from untrust to trust.

Answer

An Application Override rule for HTTP/HTTPS traffic.

Answer

A static ARP entry on the external interface for the public IP address.

Question 2

Which TWO pieces of information are displayed in the Cortex XDR Endpoint Management inventory table for a managed agent? (Choose two)

Accepted Answer

Operating system type and version.. The inventory table provides comprehensive details including IP address, operating system, agent version, and content version.

Answer

Local user printer queue statuses.

Answer

Current BIOS manufacturer serial number and asset tag.

Answer

Wi-Fi router SSID signal strength percentage.

Question 3

Which THREE mechanisms are employed by Cortex XDR to protect endpoints against unknown zero-day file-based malware? (Choose three)

Accepted Answer

Cloud-based WildFire static and dynamic analysis sandbox.. Zero-day file defense utilizes local machine learning analysis, cloud-based WildFire static/dynamic analysis, and behavioral threat protection.

Answer

Traditional static MD5 hash blocklists updated hourly.

Answer

Manual user verification prompts upon every file execution.

Question 4

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

Accepted Answer

The firewall detected TCP traffic that does not match any known application signature database entry.. 'unknown-tcp' indicates that the firewall recognizes the traffic is TCP-based, but has not matched any known application signature yet (often because it's custom, non-standard, or encrypted/obscured).

Answer

The traffic has been blocked by a Security policy rule.

Answer

The session is an encrypted SSL handshake that failed decryption.

Answer

The application is a predefined system service running on the management plane.

Question 5

Which TWO platforms are officially supported for deploying the Cortex XDR Agent? (Choose two)

Accepted Answer

Apple macOS endpoints.. Cortex XDR supports multiple operating systems including Windows and macOS.

Answer

Personal gaming consoles.

Answer

Legacy mainframe operating systems from the 1980s.

Answer

Consumer smart home IoT routers running embedded proprietary firmware.

Question 6

An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?

Accepted Answer

HA Session Synchronization is disabled in the HA configuration settings.. For stateful failover to work seamlessly without dropping sessions, HA Session Synchronization must be enabled under Device > High Availability > General > Election Settings / Session Synchronization.

Answer

The HA1 backup cable is disconnected, preventing configuration sync.

Answer

The interface management IP addresses on both firewalls are identical.

Answer

Preemption is enabled on both peer firewalls with identical priorities.

Question 7

An administrator is troubleshooting a high availability (HA1) heartbeat failure between two firewall peers. Which THREE configuration or physical items should be checked? (Choose three)

Accepted Answer

Verify physical connectivity of the HA1 fiber or Ethernet cables between both firewall peers.. HA1 issues are typically caused by physical cable disconnection, IP address conflicts on the HA1 subnet, or firewall/switch port filtering of HA control traffic (UDP/TCP ports used by HA).

Answer

Verify that the Panorama management server is online and syncing policies.

Answer

Check that GlobalProtect portals are licensed and operational on both peers.

Question 8

Which TWO actions should an administrator take when a legitimate software application is falsely blocked by Cortex XDR Behavioral Threat Protection (BTP)? (Choose two)

Accepted Answer

Create a Behavioral Threat Protection exception rule specifying the relevant criteria and file attributes.. False positives can be resolved by creating a BTP exception rule or submitting the false positive for analysis and whitelist update.

Answer

Disable operating system firewall services globally.

Answer

Completely uninstall the Cortex XDR agent from all corporate endpoints.

Answer

Format the hard drive and reinstall the operating system.

Question 9

An administrator wants to view real-time session information, including source/destination ports, translated IPs, and matched security rules, for active traffic flowing through the firewall. Which CLI command should the administrator execute?

Accepted Answer

show session all. The 'show session all' command displays active session table entries in the firewall CLI.

Answer

show high-availability state

Answer

show interface management

Answer

show system resources

Question 10

An administrator needs to configure Active Directory-based User-ID mapping without installing a dedicated User-ID agent on a Windows Server. Which TWO methods are natively supported by PAN-OS for agentless user mapping? (Choose two)

Accepted Answer

Server Monitoring via Windows Security Event Logs (WMI or WinRM).. PAN-OS supports agentless User-ID mapping via Windows security event log monitoring (WMI or WinRM) and Kerberos decryption/ticket log inspection.

Answer

Automatic SNMP trap polling of user workstations.

Answer

RADIUS Accounting start/stop message parsing without User-ID agents.

Answer

Direct LDAP querying of active user sessions via continuous TCP port scanning.

Question 11

An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?

Accepted Answer

File Blocking Profile applied to the Security rule. File Blocking Profiles allow administrators to inspect traffic by application, file type, and direction (upload/download), blocking specific file transfers while allowing the app to run.

Answer

WildFire Analysis Profile set to block all files

Answer

URL Filtering Profile with custom file blocking categories

Answer

Data Filtering Profile

Question 12

An administrator needs to restrict access to malicious command-and-control (C2) domains. Which security profile should be attached to the outbound Security policy rules to inspect and block this traffic?

Accepted Answer

Anti-Spyware Profile. Anti-Spyware profiles inspect traffic for spyware, command-and-control (C2) traffic, and phone-home activities.

Answer

Quality of Service (QoS) Profile

Answer

File Blocking Profile

Answer

Data Filtering Profile

Question 13

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

Accepted Answer

Modify the User-ID idle timeout and mapping aging timers in Device > User-ID > Edit settings.. User-ID aging timers control how long IP-to-user mappings remain active after receiving a logout event or idle timeout. These are configured under Device > User-ID > User-ID Agent or Server settings / Group Mapping Settings.

Answer

Change the Security policy session timeout value to 5 minutes.

Answer

Enable Captive Portal as a primary authentication fallback mechanism.

Answer

Increase the GlobalProtect portal idle disconnect timer.

Question 14

An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)

Accepted Answer

A single virtual router can support multiple routing protocols including OSPFv2, OSPFv3, and BGP simultaneously.. Virtual routers support static routes, OSPF, BGP, RIP, and route leaking between virtual routers on the same firewall.

Answer

Virtual routers operate at Layer 2 and require VLAN tagging to forward packets.

Answer

Virtual routers cannot share routes with other virtual routers on the same firewall without physical cable connections.

Question 15

An administrator is troubleshooting a BGP routing peer connection between the Palo Alto Networks firewall and an external provider router. The BGP session is stuck in the 'Connect' state. Inspection of system logs indicates TCP port 179 packets sent by the firewall are being transmitted, but no SYN-ACK is received. Which troubleshooting step or feature verification should be performed first?

Accepted Answer

Verify that a Security policy rule with application 'bgp' (or service tcp-179) from the external zone to 'zone: 'to-firewall'' permits control plane traffic, or check Zone Protection / Management Profile settings.. BGP uses TCP port 179. If SYN packets are sent but no SYN-ACK is returned, the issue is either upstream filtering, incorrect peer IP, or Zone Protection / Security policies blocking the control plane traffic destined for the firewall's routing daemon.

Answer

Reconfigure the Virtual Wire interface pair to handle BGP encapsulation headers.

Answer

Restart the Management server process using the CLI command 'debug software restart management-server'.

Answer

Convert the BGP peer to OSPFv3 protocol.