Cybersecurity-Practitioner Practice Test 15 — 15 Questions

Question 1

During an incident investigation in Cortex XDR, an analyst identifies that an attacker utilized Windows Management Instrumentation (WMI) to execute commands remotely across multiple endpoints. According to the MITRE ATT&CK framework, under which tactic should this activity be categorized?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Execution. In MITRE ATT&CK, Execution includes techniques that result in adversary-controlled code running on a local or remote system. WMI remote execution (e.g., via Win32_Process Create) is a classic Execution technique (T1047). The attacker is actively running commands, not just gathering information or maintaining control.

Answer

Discovery

Answer

Command and Control

Answer

Credential Access

Question 2

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

Accepted Answer

Command and Control. Command and Control (TA0011) in MITRE ATT&CK covers techniques adversaries use to communicate with compromised systems, including encrypted tunnels and application-layer protocols used to relay commands. An outbound encrypted tunnel to an unknown external IP is the textbook signature of C2. The other tactics describe earlier or different phases of the attack lifecycle.

Answer

Execution

Answer

Lateral Movement

Answer

Initial Access

Question 3

An incident responder analyzing an APT intrusion discovers that the attacker compressed and encrypted sensitive files locally on a compromised server before staging them for exfiltration. Under the MITRE ATT&CK framework, which Tactic describes this staging behavior?

Accepted Answer

Collection. Under MITRE ATT&CK, Collection (TA0009) is the tactic where adversaries gather data of interest and stage it in a central location before exfiltration. Compressing and encrypting files locally on a compromised host is the classic 'Data Staged' (T1074) technique, which sits inside Collection. The staging step is preparatory — the actual transfer off-network is Exfiltration.

Answer

Exfiltration

Answer

Persistence

Answer

Execution

Question 4

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

Accepted Answer

HA Session Synchronization. HA Session Synchronization ensures that the active firewall continuously replicates session state (including TCP session tables, NAT translations, and application state) to the passive peer, so that when a failover occurs, the passive firewall already has the session information and can forward existing flows without dropping them. Without session synchronization, the newly active firewall has no knowledge of established sessions and will drop them, forcing clients to re-establish TCP connections.

Answer

Route Monitoring

Answer

HEC (High Availability Encryption)

Answer

Preemption

Question 5

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

Accepted Answer

GlobalProtect with Host Information Profile (HIP) checking and SAML authentication. GlobalProtect with HIP checking and SAML authentication provides both user identity (via SAML IdP) and device compliance posture (via HIP profiles) evaluated on every connection, which is the core of Zero Trust Network Access. Security policies can then enforce dynamic, identity- and posture-based rules per session. This combination directly satisfies the requirement for continuous authentication and authorization based on device compliance and user identity.

Answer

Unauthenticated captive portal with static MAC address whitelisting

Answer

Static IP reservation combined with pre-shared key IPsec tunnels

Answer

SNMP trap forwarding combined with local database authentication

Question 6

Which Prisma Cloud feature continuously scans cloud resource configurations to detect compliance violations against frameworks such as CIS Benchmarks, HIPAA, and PCI-DSS?

Accepted Answer

Prisma Cloud CSPM Compliance Dashboard. Prisma Cloud CSPM (Cloud Security Posture Management) includes a Compliance Dashboard that continuously scans cloud resource configurations against built-in and custom benchmarks such as CIS, HIPAA, PCI-DSS, GDPR, and NIST. It surfaces violations with remediation guidance. This is the core CSPM function within Prisma Cloud.

Answer

WildFire Compliance Analyzer

Answer

Prisma Access Panorama Compliance Reporter

Answer

GlobalProtect Compliance Agent

Question 7

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Accepted Answer

Panorama Log Viewer / Firewall Traffic and Threat logs filtered by source IP address. Panorama Log Viewer, combined with firewall Traffic and Threat logs filtered by source IP address, provides the consolidated session explorer view needed to trace all connections from a specific host over time. It aggregates traffic, threat, URL, and data logs across managed firewalls, enabling forensic reconstruction of the host's network activity.

Answer

Dynamic Address Group membership audit report

Answer

AutoFocus Campaign Tracker and malware family indicator list

Answer

GlobalProtect Clientless Portal connection history report

Question 8

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Accepted Answer

GlobalProtect Host Information Profiles (HIP) combined with Security policy zone and posture criteria. GlobalProtect Host Information Profiles (HIP) collect endpoint posture data (OS patch level, antivirus, disk encryption, etc.) from managed and unmanaged devices, and Security policy can then match on HIP profiles alongside zone and user criteria. This lets the firewall deny BYOD devices lacking required posture even after successful authentication, which is exactly the Zero Trust 'never trust, always verify' enforcement the auditor is asking about.

Answer

WildFire automated sandbox analysis combined with Data Filtering profiles

Answer

User-ID agent IP-to-user mapping combined with NAT translation tables

Answer

App-ID application signatures combined with URL Filtering categories

Question 9

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Accepted Answer

Panorama Administrative Roles and external authentication profiles (RADIUS/TACACS+/SAML). Panorama Administrative Roles allow granular role-based access control for administrators, and external authentication profiles (RADIUS, TACACS+, SAML) enable integration with enterprise identity providers. Together, they support individual administrator accounts with specific permissions, addressing the auditor's recommendation.

Answer

WildFire API token generation and management

Answer

User-ID clientless mapping via Windows User-ID Agent

Answer

GlobalProtect Portal client configuration profiles

Question 10

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Accepted Answer

Dynamic behavioral analysis. WildFire executes unknown files in a sandboxed virtual environment and observes runtime behaviors such as registry modification and process injection, which is dynamic behavioral analysis. It does not rely solely on static signatures; it watches what the malware actually does when run. This matches the scenario where the executable exhibited malicious behavior during analysis.

Answer

URL category filtering

Answer

DNS sinkholing

Answer

Static signature matching

Question 11

An organization running Kubernetes clusters across multiple public clouds wants to enforce runtime protection that blocks unauthorized container process execution and file system writes. Which Prisma Cloud component performs this enforcement?

Accepted Answer

Prisma Cloud Compute Defender daemonset installed on each Kubernetes cluster node.. The Prisma Cloud Compute Defender daemonset installed on each Kubernetes cluster node performs runtime protection, including blocking unauthorized container process execution and file system writes. The Defender runs as a daemonset, ensuring it is present on every node to monitor and enforce runtime policies. The other options do not provide runtime enforcement for Kubernetes.

Answer

Panorama Kubernetes Plugin communicating with kubelet via SSH tunnels.

Answer

Prisma Cloud CSPM API scanner querying the Kubernetes control plane API server every 15 minutes.

Answer

Prisma Access cloud security processing node intercepting Kubernetes egress traffic.

Question 12

An administrator is reviewing endpoint security profiles and notices the term 'BIOC'. What does BIOC stand for in the context of Cortex XDR?

Accepted Answer

Behavioral Indicator of Compromise. BIOC stands for Behavioral Indicator of Compromise. In Cortex XDR, BIOCs are behavioral rules that detect malicious activity based on sequences of actions or behaviors rather than static signatures. They are used to identify advanced threats that may not have known file hashes or IOCs.

Answer

Blocked Internal Operating Component

Answer

Basic Intelligent Output Control

Answer

Binary Indicator of Code

Question 13

A security analyst wants to configure a custom alert rule in Cortex XDR that triggers whenever a specific command-line pattern is observed across multiple endpoints. Which feature should the analyst use to create this behavioral alert?

Accepted Answer

Custom BIOC (Behavioral Indicator of Compromise) rules. Custom BIOC (Behavioral Indicator of Compromise) rules in Cortex XDR let analysts define behavioral logic using the Causality Analysis Engine, matching process, command-line, and file events across all endpoints. A BIOC rule can specify a command-line pattern (e.g., regex on process arguments) and trigger alerts whenever that behavior is observed fleet-wide. This is exactly the feature designed for custom behavioral detection.

Answer

WildFire Signature Generator

Answer

Agent Profile Exploit Exception builder

Answer

Host Insights Scheduled Query task

Question 14

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

Accepted Answer

Forward the unknown file to the WildFire cloud for sandboxing analysis. Option B is correct because a WildFire analysis profile's core function is to submit unknown files (those not matched by existing signatures) to the WildFire cloud sandbox, where they are executed and observed for malicious behavior. Option D is correct because the profile can be configured to hold or block the file transfer while inline analysis (including inline machine learning and WildFire verdict lookups) completes, preventing the user from receiving a potentially malicious file before a verdict is reached. Option E is correct because the profile can generate alert logs (and other log types) when an unknown file type or unknown file is detected, giving the administrator visibility into potentially suspicious activity. Option A is not part of a WildFire analysis profile, since downgrading user access privileges is a function of authentication or User-ID/security policy, not file analysis. Option C is not a WildFire profile action; rebooting data plane CPU cores is not a supported or sensible response to file inspection and would disrupt traffic processing.

Answer

Automatically downgrade user access privileges upon file detection

Answer

Reboot the firewall data plane CPU cores to clear memory caches

Question 15

An administrator wants to view real-time session information, including source/destination ports, translated IPs, and matched security rules, for active traffic flowing through the firewall. Which CLI command should the administrator execute?

Accepted Answer

show session all. The PAN-OS CLI command 'show session all' displays the session table, including source and destination IPs and ports, NAT-translated addresses, application, and the matched security rule for each active session. This is the correct command for real-time session visibility. Other commands listed address HA state, interface status, or system resource usage, not session details.

Answer

show high-availability state

Answer

show interface management

Answer

show system resources