Cybersecurity-Practitioner Practice Test 16 — 15 Questions

Question 1

An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HA Session Synchronization is disabled in the HA configuration settings.. In an active/passive HA pair, session synchronization must be enabled so the passive firewall maintains the session table and can take over without dropping existing flows. If HA Session Synchronization is disabled, the passive peer has no state for active sessions, so on failover all TCP sessions are dropped and users must re-establish connections and re-authenticate.

Answer

The HA1 backup cable is disconnected, preventing configuration sync.

Answer

The interface management IP addresses on both firewalls are identical.

Answer

Preemption is enabled on both peer firewalls with identical priorities.

Question 2

An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)

Accepted Answer

Using a single un-audited shared administrator account for multiple SOC team members. Option B is correct because a single un-audited shared administrator account for multiple SOC team members violates least privilege: it prevents individual accountability and non-repudiation, forces all users to inherit the same (typically broad) privileges, and makes it impossible to scope rights to each person's actual duties. Option D is correct because assigning the built-in superuser role to a Tier-1 helpdesk analyst who only needs to view logs grants far more privilege than required—superuser has full read/write access across the entire Palo Alto Networks environment, whereas a read-only role limited to logs would satisfy the task. Option A does not violate least privilege; restricting admin access profiles to specific Device Groups matching an engineer's region is a proper scoping control. Option C is also compliant, since custom Admin Role Profiles limited to specific read-only tabs enforce least privilege. Option E is not a violation either; SAML authentication with dynamic role attribute mapping from an IdP supports least privilege by automatically assigning appropriately scoped roles based on identity attributes.

Answer

Restricting administrator access profiles to specific Device Groups matching the engineer's assigned region

Answer

Creating custom Admin Role Profiles that restrict users to specific read-only tabs

Answer

Enabling SAML authentication with dynamic role attribute mapping from an IdP

Question 3

An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)

Accepted Answer

Advanced URL Filtering. Advanced URL Filtering (A) is correct because it is a native Prisma Access cloud-delivered security service that can be enforced directly in security policy rules to categorize and block malicious or risky web traffic inline. Advanced WildFire (D) is also correct because it is a native cloud-delivered service integrated into Prisma Access that submits files for sandbox analysis and returns verdicts to block zero-day malware. These services are part of Palo Alto Networks' cloud-delivered security subscriptions that Prisma Access can enforce natively in policy. Azure Sentinel Log Forwarder (B), AWS GuardDuty Threat Intelligence Exporter (C), and Google Cloud Chronicle SIEM Connector (E) are not native inline security services in Prisma Access; they are third-party logging, threat-intelligence, or SIEM integration components and do not inspect traffic within Prisma Access security policies.

Answer

Azure Sentinel Log Forwarder

Answer

AWS GuardDuty Threat Intelligence Exporter

Answer

Google Cloud Chronicle SIEM Connector

Question 4

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Accepted Answer

HA Active/Active mode with session synchronization enabled. HA Active/Active mode allows both firewalls in the pair to process traffic simultaneously while synchronizing session tables in real time, providing both load sharing and failover. This matches the requirement that both firewalls actively process traffic with real-time session sync.

Answer

Cluster mode with dynamic routing ECMP multipath load balancing

Answer

Virtual Router redundancy protocol (VRRP) standalone failover groups

Answer

HA Active/Passive mode with preemption enabled

Question 5

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

Accepted Answer

Threat likelihood and impact magnitude. NIST SP 800-30 defines risk as a function of the likelihood of a threat exploiting a vulnerability and the magnitude of the impact if it occurs. Therefore, the team must evaluate threat likelihood and impact magnitude to determine the overall risk level. This combination drives prioritization of mitigation efforts for the critical database vulnerability.

Answer

Network bandwidth consumption and CPU utilization overhead

Answer

Patch availability time and vendor support lifecycle status

Answer

Asset replacement cost and regulatory fine amounts

Question 6

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

Accepted Answer

Attach the Prisma Cloud Compute Lambda layer and configure the runtime wrapper to automatically scan the function upon invocation.. Prisma Cloud Compute protects serverless functions by deploying a dedicated Lambda layer that contains the Defender runtime, which is then bound to the function via a runtime wrapper (handler override). This wrapper intercepts each invocation, performs vulnerability and compliance scanning of the function's code and dependencies, and reports results back to the Prisma Cloud Console. It is the only supported, agentless-to-the-host method for instrumenting Lambda functions in Prisma Cloud Compute.

Answer

Mount an Amazon EFS volume containing the Prisma Cloud scanner binary to the Lambda execution environment.

Answer

Configure AWS Inspector to forward Lambda scan results directly to the Prisma Cloud Console via an SNS topic.

Answer

Deploy a Prisma Cloud Compute Defender container inside the same VPC subnet as the Lambda functions.

Question 7

Which TWO deployment methods are officially supported for provisioning VM-Series firewalls in public cloud environments like AWS and Azure? (Choose two)

Accepted Answer

Using cloud-native orchestration tools (AWS CloudFormation or Azure Resource Manager templates) combined with bootstrap packages.. Option D is correct because Palo Alto officially supports automating VM-Series deployment through cloud-native orchestration such as AWS CloudFormation templates and Azure Resource Manager (ARM) templates, which can inject a bootstrap package (init-cfg.txt and related files via an S3 bucket or Azure storage) to zero-touch provision the firewall with licenses, management settings, and configuration. Option E is correct because the VM-Series is published as a marketplace image in both AWS Marketplace and Azure Marketplace, and customers can deploy it using either BYOL (bringing existing licenses or auth codes) or PAYG (hourly/per-hour consumption billing through the cloud provider). Option A is not a supported method: AWS Snowball is a physical data-transfer appliance, not a mechanism for flashing or running PAN-OS virtual images. Option B is invalid because PAN-OS is not distributed as a Docker container and cannot run its management plane on AWS Lambda serverless functions. Option C is invalid because PAN-OS supervisor cards are physical hardware components for on-premises chassis systems and have no place in AWS EC2 bare-metal instances.

Answer

Flashing the PAN-OS virtual appliance image onto an AWS Snowball physical storage device.

Answer

Using Docker container daemonsets to host the PAN-OS management plane on AWS Lambda.

Answer

Installing physical PAN-OS supervisor cards directly into AWS EC2 bare-metal hypervisor chassis slots.

Question 8

An administrator is configuring a secure IPsec VPN tunnel between an on-premises Palo Alto Networks firewall and a Prisma Access Remote Networks mobile gateway. During negotiation, Phase 2 fails. Where should the administrator check to view detailed IKE and IPsec negotiation error messages?

Accepted Answer

Run the CLI command `tail follow yes mp-log ikemgr.log` or check the System and GlobalProtect logs in Panorama/Firewall.. IPsec VPN troubleshooting on Palo Alto Networks firewalls is performed using the CLI command `tail follow yes mp-log ikemgr.log` or through the System > Logs > System/GlobalProtect or CLI operational commands.

Answer

Review the AWS VPC Flow Logs in the Amazon CloudWatch console.

Answer

Navigate to Prisma Cloud Compute > Monitor > Audit logs.

Answer

Open the WildFire submission report for the crypto module hash.

Question 9

An organization is reviewing its threat intelligence feeds and security posture to prepare for advanced persistent threat (APT) campaigns. Which TWO characteristics are typically associated with advanced persistent threats? (Choose two)

Accepted Answer

Prolonged, stealthy presence within the compromised network over an extended period. Option D is correct because APTs are defined by their ability to maintain a long-term, low-profile foothold inside a victim network, often persisting for months or years while evading detection through techniques like living-off-the-land binaries and slow, periodic beaconing. Option E is correct because APTs are goal-driven campaigns, typically sponsored by nation-states or organized groups, that target specific high-value assets such as intellectual property, trade secrets, or strategic intelligence rather than opportunistic victims. Options A, B, and C are not characteristic of APTs: aggressive scanning and high visibility (A) contradict the stealth requirement, exclusive use of unencrypted HTTP for C2 (B) is atypical since APTs commonly use encrypted channels, domain fronting, or custom protocols to hide traffic, and automated indiscriminate ransomware against consumers (C) describes commodity cybercrime, not a targeted persistent threat.

Answer

High visibility and aggressive network scanning to maximize immediate impact

Answer

Exclusive reliance on unencrypted HTTP protocols for command and control

Answer

Automated, indiscriminate ransomware distribution targeting consumer endpoints

Question 10

Which THREE diagnostic or troubleshooting steps can be performed using the 'cytool' command-line utility on a local endpoint? (Choose three)

Accepted Answer

Generating support logs and diagnostic dumps ('cytool support dump').. Option A is correct because 'cytool support dump' is a documented cytool subcommand that collects support logs and diagnostic dumps from the local endpoint for troubleshooting. Option B is correct because 'cytool protection query' reports the state of the protection modules (such as the various sensor/defense components) on that endpoint, which is a core diagnostic use of the utility. Option D is correct because 'cytool query status' returns the agent's overall status and operational health, letting an administrator verify whether the endpoint agent is functioning normally. Option C does not belong because LDAP domain controller replication schedules are configured in directory services (e.g., AD Sites and Services or repadmin), not by cytool. Option E does not belong because NAT routing tables on a core switch are managed on network infrastructure via switch/router configuration, not by a local endpoint command-line utility.

Answer

Configuring enterprise LDAP domain controller replication schedules.

Answer

Modifying global firewall NAT routing tables on the core switch.

Question 11

An administrator is reviewing Prisma Cloud Data Security reports and identifies several high-risk findings related to AWS S3 buckets. Which THREE conditions or findings would trigger an alert in Prisma Cloud Data Security? (Choose three)

Accepted Answer

An S3 bucket containing personally identifiable information (PII) shared externally with unauthorized third-party AWS accounts.. Prisma Cloud Data Security focuses on discovering and classifying sensitive data in cloud storage and alerting on risky exposure or protection gaps. Option A is correct because an S3 bucket containing PII that is shared externally with unauthorized third-party AWS accounts represents both sensitive data discovery and an improper cross-account exposure, which Prisma Cloud Data Security flags as a high-risk finding. Option C is correct because an S3 bucket holding credit card numbers or Social Security Numbers with public read ACLs combines regulated data classification with public accessibility, a classic data exposure condition that triggers an alert. Option E is correct because unencrypted files classified as confidential financial records violate data-at-rest protection expectations for sensitive data, which Prisma Cloud Data Security detects and reports. Option B does not belong because an invalid TLS certificate on an internal load balancer is a configuration/compliance issue, not a data security finding about sensitive data in storage. Option D does not belong because an EC2 instance with an unpatched Linux kernel is a vulnerability and patch-management concern, not a Prisma Cloud Data Security finding about data classification or exposure.

Answer

An invalid TLS certificate on an internal load balancer.

Answer

An AWS EC2 instance running Linux kernel version 5.4 with missing security patches.

Question 12

Which TWO log types are generated by VM-Series firewalls and can be forwarded to Panorama or external SIEM platforms for cloud security analysis? (Choose two)

Accepted Answer

Traffic logs recording session details, source/destination IPs, applications, and bytes transferred.. Option A is correct because VM-Series firewalls generate Traffic logs that record session details such as source and destination IP addresses, applications, and bytes transferred, and these logs can be forwarded to Panorama or external SIEM platforms via syslog, SNMP, email, or HTTP for cloud security analysis. Option E is correct because VM-Series firewalls also generate Threat logs that record detected vulnerabilities, malware, spyware, and URL filtering events, which are equally forwardable to Panorama or external SIEMs for security monitoring. Option B is incorrect because AWS IAM console login audit trails are produced by AWS CloudTrail, not by VM-Series firewalls. Option C is incorrect because Microsoft Entra ID password reset tokens are identity artifacts generated by Microsoft Entra ID, not firewall log types. Option D is incorrect because Kubernetes pod container image build artifact binary files are container build outputs, not logs generated by VM-Series firewalls.

Answer

AWS IAM console login audit trails.

Answer

Azure Active Directory password reset tokens.

Answer

Kubernetes pod container image build artifact binary files.

Question 13

Which THREE mechanisms are employed by Cortex XDR to protect endpoints against unknown zero-day file-based malware? (Choose three)

Accepted Answer

Cloud-based WildFire static and dynamic analysis sandbox.. Option A is correct because Cortex XDR submits unknown files to the cloud-based WildFire sandbox, which performs static and dynamic analysis to detect never-before-seen zero-day malware without relying on prior signatures. Option C is correct because Behavioral Threat Protection (BTP) monitors execution chains and process behaviors in real time, allowing it to identify malicious activity from unknown files based on behavior rather than known hashes. Option E is correct because Cortex XDR runs local machine learning models directly on the endpoint, enabling it to classify and block unknown file-based malware even when offline or before cloud verdicts return. Option B is not correct because MD5 hash blocklists are signature-based and cannot detect unknown zero-day files that have no known hash. Option D is not correct because prompting users for manual verification on every file execution is not a Cortex XDR malware protection mechanism and would not reliably stop zero-day threats.

Answer

Traditional static MD5 hash blocklists updated hourly.

Answer

Manual user verification prompts upon every file execution.

Question 14

Which TWO actions should an administrator take when a legitimate software application is falsely blocked by Cortex XDR Behavioral Threat Protection (BTP)? (Choose two)

Accepted Answer

Create a Behavioral Threat Protection exception rule specifying the relevant criteria and file attributes.. Option A is correct because Cortex XDR Behavioral Threat Protection supports exception rules that let administrators whitelist a legitimate process by specifying criteria such as the module name, process path, signer, or hash, so the benign application is no longer falsely blocked while BTP remains active. Option C is correct because submitting the false-positive sample to Palo Alto Networks allows the threat research team to analyze the file and adjust the BTP logic or signatures, preventing the same false detection for other endpoints in the future. Option B is wrong because disabling the operating system firewall globally removes a critical security control and has no bearing on a Cortex XDR BTP false positive. Option D is wrong because uninstalling the Cortex XDR agent from all endpoints would eliminate endpoint protection entirely rather than resolve the specific false positive. Option E is wrong because formatting and reinstalling the OS is a destructive, disproportionate action that does not address the BTP detection logic.

Answer

Disable operating system firewall services globally.

Answer

Completely uninstall the Cortex XDR agent from all corporate endpoints.

Answer

Format the hard drive and reinstall the operating system.

Question 15

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

Accepted Answer

Verify that the DNS Proxy object has valid primary and secondary external DNS server IP addresses configured.. Option B is correct because a DNS Proxy object must have reachable primary and secondary external DNS server IP addresses configured; without valid upstream resolvers, the firewall cannot forward client queries for external domain names and resolution fails. Option E is correct because the DNS Proxy feature must be enabled in the Network Profile assigned to the interface that receives the client DNS requests; if the DNS Proxy is not enabled there, the firewall will not intercept and process those queries as a proxy. Option A is incorrect because captive portal redirection on a loopback address is unrelated to DNS proxy resolution and is used for user authentication/redirect scenarios. Option C is incorrect because BGP routing on Layer 2 trust interfaces has no bearing on DNS proxy operation, and Layer 2 interfaces do not run BGP. Option D is incorrect because the GlobalProtect portal certificate in the trusted root store affects VPN portal trust, not DNS proxy name resolution for internal clients.

Answer

Ensure captive portal redirection is enabled on the loopback address.

Answer

Verify that BGP routing is enabled on all Layer 2 trust interfaces.

Answer

Check that the GlobalProtect portal certificate is installed in the trusted root store.