Cybersecurity-Practitioner Practice Test 17 — 15 Questions

Question 1

An enterprise is implementing a Zero Trust Architecture across its cloud and on-premises environments using Palo Alto Networks Prisma Access and Next-Generation Firewalls. Which THREE of the following principles are core tenets of a Zero Trust Architecture? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assume breach and verify explicitly at every access request. Option B is correct because Zero Trust's foundational tenet is 'never trust, always verify' — every access request must be authenticated and authorized explicitly based on identity, device, and context, regardless of network location, which is exactly what Prisma Access enforces via its identity-based policies. Option C is correct because continuous monitoring through telemetry and analytics (e.g., Prisma Access ADEM, Cortex Data Lake, and NGFW logging) is required to validate device posture and user behavior on an ongoing basis rather than at a single point in time. Option E is correct because least privilege with just-in-time and just-enough access is a core Zero Trust principle, implemented in Prisma Access through dynamic, granular security policies and time-bound access rather than standing entitlements. Option A is incorrect because relying on perimeter firewalls for east-west traffic reflects a traditional castle-and-moat model, whereas Zero Trust requires microsegmentation and inspection of lateral traffic regardless of perimeter. Option D is incorrect because implicit trust of internal subnets after perimeter authentication directly contradicts Zero Trust, which mandates explicit verification for every session even from inside the network.

Answer

Rely primarily on perimeter firewalls to secure internal east-west traffic

Answer

Trust internal subnets implicitly once a user authenticates at the corporate perimeter

Question 2

An administrator is designing a high-availability network using Panorama and Palo Alto Networks firewalls. Which TWO tasks can be performed directly by Panorama regarding firewall management and deployment? (Choose two)

Accepted Answer

Pushing device and network templates to managed firewalls. Option A is correct because Panorama uses device and network templates within template stacks to centrally define and push firewall and network configuration (interfaces, zones, virtual routers, etc.) to managed firewalls. Option B is correct because Panorama can manage and distribute PAN-OS software versions, dynamic content updates (Applications and Threats, Antivirus), and WildFire signatures to managed firewalls from its content update schedule. Option C is incorrect because Panorama is a management and logging platform; it does not process data-plane traffic, which is handled by the firewalls themselves. Option D is incorrect because packet captures are executed locally on the firewall (e.g., via the CLI or GUI), not autonomously triggered by Panorama without administrator interaction. Option E is incorrect because Panorama does not eliminate the need for local firewall administrator accounts; local accounts and role-based access remain on each managed firewall.

Answer

Acting as the primary data-plane traffic processor for remote branch offices

Answer

Executing local packet captures on managed firewalls without administrator interaction

Answer

Replacing the need for local firewall administrator accounts entirely

Question 3

An administrator is configuring authentication profiles in PAN-OS to integrate an external identity provider. Which TWO of the following server types can be directly configured as authentication server profiles in a Palo Alto Networks firewall? (Choose two)

Accepted Answer

LDAP. Option A (LDAP) is correct because PAN-OS authentication server profiles natively support LDAP as a server type, allowing the firewall to bind to a directory such as Active Directory or OpenLDAP for user and group lookups used in authentication and User-ID. Option C (RADIUS) is correct because PAN-OS also natively supports RADIUS authentication server profiles, enabling the firewall to send authentication requests to a RADIUS server for user verification and MFA integration. Option B (Syslog Forwarder Service) is incorrect because syslog forwarding is configured under Server Profiles > Syslog for log export, not as an authentication server type. Option D (DHCP Scope Manager) is incorrect because DHCP scopes are managed on a DHCP server, and PAN-OS interfaces can act as DHCP clients or servers but this is not an authentication profile type. Option E (SNMPv3 Trap Receiver) is incorrect because SNMP trap receivers are configured under Server Profiles > SNMP Trap for monitoring, not for authentication.

Answer

Syslog Forwarder Service

Answer

DHCP Scope Manager

Answer

SNMPv3 Trap Receiver

Question 4

An administrator is configuring Zone Protection profiles to mitigate potential network attacks. Which TWO flood protection mechanisms are available within a Zone Protection profile? (Choose two)

Accepted Answer

SYN flood protection. SYN flood protection (C) is correct because a Zone Protection profile includes Flood Protection settings that specifically detect and limit TCP SYN floods by tracking half-open sessions and applying actions such as random early drop or SYN cookies. UDP flood protection (D) is also correct because the same Flood Protection section provides a UDP flood threshold that rate-limits UDP packets destined to a zone, mitigating volumetric UDP-based attacks. The other options do not belong: cross-site scripting (A) and SQL injection (E) are application-layer web attacks handled by URL filtering or custom vulnerability signatures in a Security Profile, not by Zone Protection, and antivirus payload inspection (B) is performed by the Antivirus Security Profile, not by Zone Protection flood mechanisms.

Answer

Cross-site scripting (XSS) protection

Answer

Antivirus payload inspection

Answer

SQL injection protection

Question 5

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

Accepted Answer

Configure permitted IP address lists on the management interface to allow access only from secure jump hosts. Option C is correct because configuring permitted IP address lists (an allowlist/ACL on the management interface) restricts administrative access to known secure jump hosts, blocking unauthorized source addresses from reaching the management plane. Option D is correct because dedicating a separate out-of-band management interface (MGT port) isolates administrative traffic from data-plane traffic, reducing exposure and preventing data-path compromise from reaching management functions. Option E is correct because enforcing multi-factor authentication for all administrative logins adds a strong second factor beyond passwords, mitigating credential theft and brute-force attacks against privileged accounts. Option A is incorrect because disabling password complexity weakens authentication and increases the risk of credential compromise. Option B is incorrect because exposing the management interface with a public IP reachable from the entire internet dramatically expands the attack surface and invites scanning, brute-force, and exploitation attempts.

Answer

Disable administrative password complexity requirements to simplify login

Answer

Configure the management interface with a public IP address accessible from the entire internet

Question 6

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Accepted Answer

Antivirus profile. The Antivirus profile (A) is correct because it scans traffic content for known malware signatures, including viruses, worms, and spyware, and applies actions such as alert, block, or reset for infected files. The Vulnerability Protection profile (D) is correct because it inspects content payloads for software exploit attempts, such as buffer overflows and code-execution attacks, using signatures that detect and block known exploits. Together, these two profile types are the content-inspection profiles specifically designed to detect malware and exploit attempts in allowed traffic. Data Filtering (B) is for controlling sensitive data patterns like credit card numbers, not malware. Zone Protection (C) is a network-layer profile for flood and reconnaissance protection, not payload content inspection. URL Filtering (E) categorizes and controls web destinations but does not inspect payloads for malware or exploits.

Answer

Data Filtering profile

Answer

Zone Protection profile

Answer

URL Filtering profile

Question 7

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

Accepted Answer

Inside the Prisma Access Cloud Security Processing Node (SPN) cloud infrastructure.. Prisma Access performs security inspection of branch-to-branch traffic inside its Cloud Security Processing Node (SPN) infrastructure, because branch traffic is tunneled to the Prisma Access service and then re-inspected before being forwarded to the destination branch. This is the core value proposition of Prisma Access: consistent security policy enforcement in the cloud regardless of whether traffic is user-to-app, branch-to-internet, or branch-to-branch. The SPN is where decryption, threat inspection, and policy evaluation occur.

Answer

Inside the customer-managed AWS Transit Gateway associated with the remote network.

Answer

On the Panorama management server located in the customer's primary datacenter.

Answer

On the local physical firewall at the originating branch office before it leaves the LAN.

Question 8

A SOC analyst is reviewing a Palo Alto Networks firewall traffic log and notices a large number of outbound connections to various IP addresses on port 53. The connections are using UDP and the payload appears to contain encoded data. Which type of malicious activity is most likely occurring?

Accepted Answer

DNS tunneling for command-and-control or data exfiltration.. The correct answer is DNS tunneling, which involves encoding data within DNS queries and responses to bypass security controls. The use of UDP port 53, encoded payload, and multiple destination IPs are classic indicators. This technique is often used by attackers for command-and-control or data exfiltration, making it a critical detection for SOC analysts.

Answer

A denial-of-service attack against external DNS servers.

Answer

A misconfigured application performing DNS lookups.

Answer

Peer-to-peer file sharing using the DNS protocol.

Question 9

A SOC team is using Cortex XDR to investigate a security incident. The analyst notices that a critical alert was automatically resolved without any analyst action. The team wants to ensure that all high-severity alerts are reviewed by a human before closure. Which Cortex XDR configuration should the analyst modify to enforce this requirement?

Accepted Answer

Modify the incident response playbook to require manual approval.. The correct configuration is to modify the incident response playbook to require manual approval for incident closure. Playbooks define the automated response actions, and adding a manual approval step ensures that high-severity alerts are not resolved without human intervention, aligning with the team's requirement.

Answer

Change the alert severity threshold to high.

Answer

Disable automatic updates for the Cortex XDR agent.

Answer

Adjust the alert exclusion rules to prevent auto-closure.

Question 10

A SOC analyst is reviewing a Cortex XDR alert for a Windows endpoint. The alert indicates that a process has created a scheduled task to run a PowerShell script that downloads a file from a remote server. The analyst wants to gather additional evidence to determine the scope of the compromise. Which TWO of the following actions should the analyst take? (Choose two.)

Accepted Answer

Query the Cortex XDR database for all endpoints that have executed the same scheduled task name.. The correct answers are to query the Cortex XDR database for other endpoints with the same scheduled task and to retrieve the PowerShell script content. These actions help determine the scope of the compromise and understand the attacker's methods, enabling effective containment and remediation.

Answer

Disable the scheduled task without further investigation.

Answer

Immediately reboot the endpoint to clear any malicious processes.

Answer

Run a full antivirus scan on the endpoint only.

Question 11

A Cortex XDR administrator is preparing to enable the Device Control module for a group of Windows endpoints. The organization wants to prevent data exfiltration via removable media while still allowing approved USB storage devices used by the IT team. Which TWO actions must the administrator take to achieve this with Device Control? (Choose two.)

Accepted Answer

Create a Device Control policy that blocks removable media by default on the endpoint group.. Effective Device Control for removable media requires a default block policy to stop unauthorized USB storage, plus exceptions that permit specific approved devices used by the IT team. Together these steps enforce the exfiltration prevention requirement while maintaining necessary business operations. Exploit Protection, WildFire, and disabling Real-Time Scanning do not contribute to Device Control enforcement.

Answer

Enable the Exploit Protection module to prevent malware from writing data to USB devices.

Answer

Disable Real-Time Scanning on endpoints so that Device Control can manage USB access without conflicts.

Answer

Configure WildFire to analyze files copied to USB devices before allowing the transfer.

Question 12

A SOC analyst is investigating a Cortex XDR incident involving a Linux server. The analyst observes that a process named 'kworker' is making outbound DNS queries to a domain that is not in the approved list. The process is running from /tmp/kworker, and its parent process is 'bash'. Which of the following is the most likely explanation?

Accepted Answer

The process is a malicious binary masquerading as a kernel worker to evade detection.. The correct answer is that the process is a malicious binary masquerading as a kernel worker. The location in /tmp and parent process bash are inconsistent with legitimate kernel threads. The outbound DNS queries to an unapproved domain further indicate malicious activity, such as command-and-control or exfiltration.

Answer

The process is a legitimate application installed by the administrator in /tmp.

Answer

The process is a legitimate kernel worker thread performing DNS resolution.

Answer

The process is part of a scheduled task that performs DNS updates for dynamic DNS services.

Question 13

A SOC analyst is triaging a Cortex XDR incident where a suspicious process spawned from a Microsoft Word document. The process tree shows WINWORD.EXE launching powershell.exe with an encoded command. The analyst wants to quickly determine the parent-child relationship and command-line arguments across all endpoints in the incident. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality View. Causality View is specifically designed to visualize process execution chains in Cortex XDR, showing how one process spawned another along with full command-line details. This allows the analyst to quickly understand the attack sequence from the initial document to the encoded PowerShell command, which is essential for triage and further investigation.

Answer

Incident Response playbook

Answer

Behavioral Indicators dashboard

Answer

Threat Intelligence module

Question 14

A SOC analyst is investigating a Cortex XDR incident where an attacker used a signed binary to proxy execution of malicious code. The analyst observes that the binary is a legitimate Windows utility often abused for defense evasion. Which MITRE ATT&CK technique is most likely associated with this behavior?

Accepted Answer

T1218: Signed Binary Proxy Execution. The abuse of a legitimate signed binary to execute malicious code is best mapped to T1218: Signed Binary Proxy Execution. This technique is specifically designed to describe such defense evasion tactics, where attackers leverage trusted system binaries to bypass application control and other security mechanisms. It is a precise match for the scenario.

Answer

T1204: User Execution

Answer

T1059: Command and Scripting Interpreter

Answer

T1055: Process Injection

Question 15

A Cortex XDR administrator is reviewing endpoint protection settings for a group of macOS laptops used by the finance department. The organization wants to ensure that only approved applications can execute on these laptops and that any attempt to run unapproved software is blocked and reported. Which Cortex XDR capability should the administrator configure to meet this requirement?

Accepted Answer

Application Control policy using an allow list of approved applications with block and report actions for unapproved executables. Application Control in Cortex XDR enforces execution of only approved applications through allow lists, with block and report actions for anything unapproved. This matches the requirement to permit only approved software on the macOS laptops and to log blocked attempts. WildFire, malware scanning, and Host Firewall address different threats and do not enforce application approval status.

Answer

Malware Protection profile with Real-Time Scanning and quarantine actions for detected threats

Answer

WildFire file analysis with automatic verdict enforcement on all executables

Answer

Host Firewall policy that restricts outbound network connections from the macOS laptops