Cybersecurity-Practitioner Practice Test 18 — 15 Questions

Question 1

A SOC analyst is triaging alerts in Cortex XDR and notices a high volume of false positives from a custom detection rule that triggers on legitimate administrative activity. The analyst wants to reduce noise without disabling the rule entirely. Which action should the analyst take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an exception in the rule to exclude the specific administrative activity.. Creating an exception for the specific administrative activity allows the rule to continue detecting malicious behavior while filtering out known benign actions. This fine-tuning reduces false positives without compromising detection capabilities, aligning with best practices in SOC operations for alert management.

Answer

Disable the rule and rely on other detections.

Answer

Modify the rule's severity to low.

Answer

Add a suppression rule to ignore alerts from the administrative user account.

Question 2

A Cortex XDR administrator needs to prevent users on managed Windows endpoints from launching an unauthorized peer-to-peer file-sharing tool. The administrator wants the Cortex XDR agent to block the executable and record the attempt in the console without relying on file hash values that change with every update. Which Cortex XDR agent capability should the administrator configure?

Accepted Answer

Restrictions Profile with a Block List rule on the executable path or name. Application execution control on Cortex XDR endpoints is delivered through the Restrictions Profile, where Block List rules deny execution of specified executables. Because the rule targets the executable name or path, it remains effective after the vendor ships an updated binary, and every denial is logged as an agent event that appears in the console for auditing.

Answer

Malware Profile with WildFire inline verdicts

Answer

Exploit Protection module with a browser plugin rule

Answer

Device Control module with a USB mass storage rule

Question 3

An organization wants to prevent users on managed Windows endpoints from writing data to unapproved USB mass storage devices while still allowing approved encrypted USB drives to be used. Which Cortex XDR capability should the administrator configure to meet this requirement?

Accepted Answer

Device Control policy in the Cortex XDR management console with rules that allow specific device IDs and block the rest. Cortex XDR Device Control provides policy-based allow-listing and blocking of removable devices by class, vendor, product, and serial number. Configuring rules that permit only approved encrypted USB drives and block all other mass storage devices satisfies the requirement while keeping USB ports available for sanctioned peripherals, and it is applied through the management console to the relevant endpoint groups.

Answer

Host Firewall policy in the Cortex XDR management console with rules blocking outbound SMB traffic

Answer

Disk Encryption policy in the Cortex XDR management console enforced on all removable media

Answer

Exploit Protection policy in the Cortex XDR management console with browser plugin protections enabled

Question 4

A cloud security engineer is configuring Prisma Cloud to monitor AWS accounts for compliance with the CIS AWS Foundations Benchmark. The engineer wants to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should be used to create a policy that triggers an alert for this specific misconfiguration?

Accepted Answer

Config Query. Config Query enables the creation of custom policies using RQL to evaluate cloud resource configurations. By writing a query that identifies S3 buckets with public access, the engineer can set up alerts for this misconfiguration. This is the correct feature for custom posture policies in Prisma Cloud.

Answer

Host Vulnerability Scan

Answer

Data Security Scan

Answer

Network Scan

Question 5

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

Accepted Answer

The Palo Alto Networks root CA certificate installed in the browser or OS Trusted Root Certification Authorities store.. To inspect encrypted HTTPS traffic without causing certificate warnings, the firewall performs SSL forward proxy decryption, which requires the client to trust the firewall's decryption certificate. The Palo Alto Networks root CA certificate must be installed in the browser or OS Trusted Root Certification Authorities store on each client endpoint. The firewall then presents certificates signed by this CA for decrypted sessions, and because the CA is trusted, no warnings appear.

Answer

The GlobalProtect client certificate installed in the personal certificate store.

Answer

The public vendor certificate of the SaaS application.

Answer

A self-signed untrusted certificate generated automatically by the firewall.

Question 6

A security engineer is deploying a VM-Series firewall in AWS to inspect outbound traffic from a VPC. The design requires that the firewall preserve the original source IP of the instances so that security policy can be applied based on actual workload addresses. The engineer configures the firewall's untrust interface with an Elastic IP and sets the trust interface to use a static private address. When testing, the instances' traffic appears to originate from the firewall's trust IP rather than the instances' own IPs. Which configuration change should the engineer make to preserve the original source IP?

Accepted Answer

Disable Source NAT on the trust interface so that the original source IP is retained.. The VM-Series firewall in AWS applies Source NAT on the trust interface by default, which hides the original source IP of instances. To preserve source IPs for policy enforcement, the engineer must disable Source NAT on that interface. This allows outbound traffic to retain the instances' actual addresses, enabling security rules based on workload IPs and improving visibility in logs.

Answer

Enable ECMP on the untrust interface to load-balance traffic and retain source addresses.

Answer

Enable Source NAT on the trust interface to translate the instances' IPs to the firewall's IP.

Answer

Configure a destination NAT rule on the untrust interface to map the firewall IP back to the instances.

Question 7

A Cortex XDR administrator notices that a specific Windows endpoint repeatedly triggers behavioral threat alerts for a legitimate internally developed accounting application. The administrator wants the application to run without generating further behavioral alerts while keeping all other protection modules active. What is the MOST appropriate action?

Accepted Answer

Create a Behavioral Threat exception in the Cortex XDR management console that scopes the exception to the application's path or signature. Behavioral Threat exceptions let administrators scope suppression to a specific application using path, signer, or hash while keeping the Behavioral Threat module active for all other processes. This achieves the required outcome of running the legitimate accounting application without alerts, without weakening protection across the endpoint group or disabling unrelated modules.

Answer

Disable the Behavioral Threat protection module on the endpoint group via the agent settings policy

Answer

Move the endpoint into a new endpoint group that has the exploit protection module disabled

Answer

Add the application's file hash to the Block List in the Cortex XDR management console

Question 8

A Cortex XDR administrator is configuring a Malware profile to prevent the execution of known malicious files. The administrator wants the agent to block files based on hash reputation from WildFire and local analysis, but also wants to allow a specific internally developed tool that is sometimes flagged as a false positive. Which Cortex XDR feature should the administrator use to exclude the tool from being blocked while keeping the rest of the Malware profile active?

Accepted Answer

Add the tool's hash to the Allow List in the Malware profile.. The Allow List in a Malware profile is designed to exclude specific files or hashes from being blocked, even if they are flagged as malicious. This allows the administrator to keep the Malware profile active for all other files while ensuring the internally developed tool runs without interference. It is the most targeted and secure method for handling false positives.

Answer

Add the tool's hash to the Block List in the Malware profile.

Answer

Disable the Malware profile on the endpoint.

Answer

Create a new Malware profile with a lower action level and assign it to the endpoint.

Question 9

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

Accepted Answer

Vulnerability Protection Profile. The Vulnerability Protection Profile in Palo Alto Networks security policy is specifically designed to block exploits targeting known software vulnerabilities, including SQL injection, buffer overflows, and other application-layer attacks. It inspects traffic against a signature database of vulnerability exploits and applies actions like block, alert, or reset. Applying it to the relevant security policy rule enforces protection for the database servers against these exploit classes.

Answer

WildFire Analysis Profile

Answer

URL Filtering Profile

Answer

Antivirus Profile

Question 10

Which TWO pieces of information are displayed in the Cortex XDR Endpoint Management inventory table for a managed agent? (Choose two)

Accepted Answer

Operating system type and version.. Option D is correct because the Cortex XDR Endpoint Management inventory table reports each managed endpoint's operating system type and version, which is core asset data used for filtering and compliance. Option E is correct because the same inventory view lists the installed Cortex XDR agent version number, allowing administrators to verify agent builds and plan upgrades. These two fields are standard columns in the Endpoint Management inventory for a managed agent. Options A, B, and C are not part of that inventory table: printer queue status, BIOS manufacturer serial number/asset tag, and Wi-Fi SSID signal strength are not agent inventory attributes displayed there.

Answer

Local user printer queue statuses.

Answer

Current BIOS manufacturer serial number and asset tag.

Answer

Wi-Fi router SSID signal strength percentage.

Question 11

An organization is deploying an explicit Zero Trust micro-segmentation strategy using Palo Alto Networks Next-Generation Firewalls. They want to ensure that if a workstation is compromised in the engineering VLAN, lateral movement to the financial VLAN is blocked, even if both belong to internal corporate subnets. Which firewall feature must be configured to achieve this?

Accepted Answer

Inter-zone Security Policy rules inspecting traffic between the engineering and finance zones. Palo Alto Networks NGFWs enforce segmentation through zone-based security policies. By placing the engineering and finance VLANs in separate security zones and writing explicit inter-zone Security Policy rules that deny or tightly restrict traffic between them, the firewall blocks lateral movement even though both are internal subnets. This is the core mechanism of Zero Trust micro-segmentation on the platform.

Answer

GlobalProtect split-tunnel configuration for remote workers

Answer

NAT hairpinning configuration on the outside interface

Answer

Default inter-zone forwarding without explicit security profiles

Question 12

A security engineer is designing a defense-in-depth strategy for a new web application. The engineer wants to implement controls that map to the principle of least privilege and reduce the attack surface. Which two of the following controls best align with these goals? (Choose two.)

Accepted Answer

Disable unnecessary services and close unused ports on the web server.. The two controls that best align with least privilege and reducing attack surface are implementing RBAC and disabling unnecessary services/ports. RBAC ensures users have only the permissions needed for their roles, while disabling unused services removes potential entry points. The other options are security controls but do not directly address authorization limits or attack surface reduction in the same way.

Answer

Implement full-disk encryption on the web server to protect data at rest.

Answer

Deploy a web application firewall (WAF) to filter out malicious traffic.

Answer

Enforce a strong password policy that requires complex passwords and regular changes.

Question 13

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

Accepted Answer

Deploy the Cloud Identity Engine (CIE) agent and configure directory synchronization with Microsoft Entra ID.. The Cloud Identity Engine (CIE) agent synchronizes user and group information from directories such as Microsoft Entra ID into Prisma Access, enabling User-ID mapping to traffic logs without requiring users to authenticate through a captive portal. CIE is Palo Alto Networks' cloud-delivered identity service designed exactly for this cloud-directory-to-cloud-firewall mapping. It provides transparent identity resolution for remote workers and branches.

Answer

Configure an explicit SAML authentication proxy on the Panorama management plane.

Answer

Configure an explicit proxy PAC file pointing all browser traffic to the Prisma Access Remote Networks gateway IP.

Answer

Install a dedicated VM-Series User-ID Agent on an EC2 instance in every public cloud VPC.

Question 14

An administrator is configuring Prisma Cloud Compute to protect serverless functions in AWS Lambda. Which THREE features are supported for serverless function protection? (Choose three)

Accepted Answer

Compliance and configuration auditing of serverless function settings (such as overly permissive IAM roles or environment variables).. Option B is correct because Prisma Cloud Compute performs compliance and configuration auditing of serverless function settings, detecting issues like overly permissive IAM roles and insecure environment variables in AWS Lambda. Option C is correct because Prisma Cloud Compute scans serverless function code packages and their dependencies for known vulnerabilities before and after deployment. Option E is correct because Prisma Cloud Compute supports runtime defense for serverless functions, using instrumentation to detect and block unauthorized outbound network connections and anomalous function behavior. Option A is incorrect because direct physical RAID disk array encryption management is a hardware/storage concern, not a serverless function protection feature. Option D is incorrect because real-time BGP routing table advertisement to AWS Transit Gateway is a network routing function, unrelated to serverless function security in Prisma Cloud Compute.

Answer

Direct physical RAID disk array encryption management.

Answer

Real-time BGP routing table advertisement to AWS Transit Gateway.

Question 15

An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?

Accepted Answer

In the WildFire portal or Prisma Access Monitor > WildFire Submissions report, click on the specific sample hash to view the behavioral analysis report.. The WildFire portal and the Prisma Access Monitor > WildFire Submissions report both allow an administrator to click a specific sample's SHA-256 hash to open the detailed behavioral analysis report, which includes registry modifications, API calls, process activity, and network connections observed in the sandbox. This is the standard workflow for reviewing WildFire verdicts and forensic details.

Answer

In Prisma Cloud Compute > Defend > Access Control logs.

Answer

In the Prisma Access Cloud Identity Engine audit logs.

Answer

In Panorama > Managed Devices > WildFire Appliance CLI.