Cybersecurity-Practitioner Practice Test 19 — 15 Questions

Question 1

An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrate the Prisma Cloud Compute CI/CD scanner plugin into the pipeline to block builds containing critical vulnerabilities.. Prisma Cloud Compute provides CI/CD scanner plugins (Jenkins, GitLab, GitHub Actions, etc.) that evaluate container images during the build phase and fail the build if vulnerabilities exceed a specified threshold.

Answer

Configure an AWS CloudWatch alarm to trigger a Lambda function that deletes the ECR registry repository.

Answer

Enable Prisma Access Threat Prevention on the CI/CD runner network interface.

Answer

Configure Prisma Cloud CSPM to automatically revoke AWS IAM credentials for the CI/CD builder.

Question 2

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

Accepted Answer

Brute Force. Option C, Brute Force, is correct because it is listed under the MITRE ATT&CK Credential Access tactic (technique T1110), covering password guessing, credential stuffing, and password spraying to obtain valid accounts. Option E, OS Credential Dumping, is also correct because it belongs to the Credential Access tactic (technique T1003), describing extraction of credential material such as hashes or plaintext passwords from operating system memory or files (e.g., LSASS). The unmarked options do not belong: Masquerading (A) is a Defense Evasion technique (T1036), while Data Exfiltration Over C2 Channel (B, T1041) and Automated Exfiltration (D, T1020) are Exfiltration techniques, not Credential Access.

Answer

Masquerading

Answer

Data Exfiltration Over C2 Channel

Answer

Automated Exfiltration

Question 3

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping (e.g., via Mimikatz, ProcDump, or comsvcs.dll) is cataloged under the Credential Access tactic in MITRE ATT&CK (technique T1003.001, OS Credential Dumping: LSASS Memory). The tactic's definition is explicitly about stealing credentials such as account names and passwords to gain, escalate, or maintain access. Because the attacker's immediate objective is harvesting credential material from memory, Credential Access is the correct tactic.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 4

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

Accepted Answer

Privilege Escalation. Privilege Escalation is the MITRE ATT&CK tactic that describes an adversary's actions to gain higher-level permissions or access within a system or network. Unauthorized modification of user permissions to establish higher-level access is a classic example of privilege escalation, as the attacker is elevating their privileges beyond what was originally granted.

Answer

Initial Access

Answer

Exfiltration

Answer

Credential Access

Question 5

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance. The administrator wants to detect and block TCP port scans targeting the internal network from external sources. Which feature should the administrator configure to achieve this?

Accepted Answer

Zone Protection profile with Port Scan Protection. Zone Protection profiles include Port Scan Protection, which detects and blocks TCP port scans, host sweeps, and other reconnaissance attempts. Applying this profile to the external zone allows the firewall to identify scanning behavior and take action. Vulnerability Protection, Security policy applications, and DoS Protection do not provide the same level of port scan detection and blocking.

Answer

Vulnerability Protection profile with port scan signatures

Answer

Security policy rule with application 'tcp-port-scan'

Answer

DoS Protection profile with TCP SYN flood protection

Question 6

A Cortex XDR administrator is tuning the Behavioral Threat Protection module because several legitimate administrative scripts are generating false positives on managed endpoints. The administrator wants to keep the protection active while suppressing alerts only for the specific script paths involved, without disabling the module globally. What is the correct approach?

Accepted Answer

Create a Behavioral Threat Protection exception for the specific script paths in the Malware Profile.. Behavioral Threat Protection watches process behaviour for indicators such as script interpreters spawning unusual children. When trusted administrative scripts are misclassified, the precise fix is a scoped exception that names those script paths in the Malware Profile. This preserves behavioural coverage for all other activity while eliminating the specific false positives the administrator identified.

Answer

Add the script file hashes to the WildFire allow list in the Cortex XDR console.

Answer

Disable the Behavioral Threat Protection module in the Malware Profile for the affected endpoint group.

Answer

Lower the Behavioral Threat Protection severity threshold on the agent policy.

Question 7

Where in the Cortex XDR management console can an administrator view the operational health, connection status, and version of all deployed agents?

Accepted Answer

Endpoint Management view. The Endpoint Management view in the Cortex XDR management console provides a centralized dashboard to monitor the operational health, connection status, and version of all deployed agents. Administrators can see which endpoints are online, which agents need updates, and any issues affecting agent communication.

Answer

Incident Response workbench

Answer

WildFire Analysis submissions portal

Answer

Threat Intelligence Feed manager

Question 8

A security architect is designing a Zero Trust network segmentation model using Palo Alto Networks Next-Generation Firewalls. To prevent lateral movement of malware across internal VLANs, which operational rule must be strictly enforced?

Accepted Answer

Inspect and restrict all east-west internal traffic based on least-privilege application context. In a Zero Trust model, no traffic is trusted by default, even if it originates from internal subnets. To prevent lateral movement of malware, all east-west traffic between internal VLANs must be inspected and restricted based on least-privilege application context. This means enforcing granular security policies that allow only necessary applications and services, and denying all other traffic. This approach ensures that if a host is compromised, the malware cannot freely spread to other segments.

Answer

Trust all traffic originating from authenticated internal subnets by default

Answer

Permit all communication between endpoints sharing the same Active Directory domain

Answer

Rely solely on perimeter firewalls to block inbound threats from the internet

Question 9

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Accepted Answer

WildFire cloud-based analysis and automated signature generation. WildFire is Palo Alto Networks' cloud-based malware analysis service that automatically analyzes suspicious files in a sandboxed environment. When a novel malware sample is identified, WildFire generates a new signature and pushes it to all subscribed Next-Generation Firewalls globally within minutes, enabling automatic blocking without manual intervention. This directly addresses the requirement for rapid, automated, global protection against new threats.

Answer

Palo Alto Networks MineMeld open-source threat intelligence

Answer

Traps Advanced Endpoint Protection cloud service

Answer

AutoFocus Context-Aware Threat Intelligence service

Question 10

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

Accepted Answer

Never trust, always verify through continuous context. Zero Trust's foundational principle is 'never trust, always verify' — every access request must be authenticated and authorized based on identity, device posture, and context, regardless of network location. The scenario explicitly describes granting access based on explicit verification of user identity, device health, and application context rather than subnet placement, which is the textbook definition of this principle.

Answer

Perimeter-based defense centralization

Answer

Implicit trust verification via subnet placement

Answer

Static role-based implicit authorization

Question 11

A security architect is designing a Prisma Cloud deployment to protect workloads across AWS, Azure, and Google Cloud. The architect must ensure that Prisma Cloud can detect misconfigurations in cloud resources and identify risky network exposure. Which TWO capabilities should the architect enable? (Choose two.)

Accepted Answer

Cloud Network Security to analyze network paths and identify exposure of cloud workloads to the internet.. Detecting misconfigurations across cloud resources is the function of Cloud Security Posture Management, which continuously assesses configurations against policies. Identifying risky network exposure is the function of Cloud Network Security, which maps network paths and internet-facing entry points. Together they satisfy the architect's requirements. Workload protection, data security, and identity security address different risk domains and do not cover the specific needs stated.

Answer

Cloud Identity and Access Management security to detect overly permissive roles and risky identity configurations.

Answer

Data Security posture management to classify and protect sensitive data stored in cloud services.

Answer

Cloud Workload Protection (CWP) to scan hosts and containers for vulnerabilities and malware.

Question 12

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Accepted Answer

Create a Vulnerability Protection Exception for the specific threat ID, optionally restricting it to the source or destination IP. A Vulnerability Protection Exception allows the administrator to suppress a specific threat ID while leaving the rest of the profile active, and it can be scoped to a source, destination, or both to minimize the blast radius. This is the safe, surgical way to resolve a false positive without weakening overall threat coverage.

Answer

Disable the Vulnerability Protection profile globally across all security rules

Answer

Configure an Application Override policy for the custom API port

Answer

Delete the threat signature from the firewall's local database cache

Question 13

A security analyst is investigating unusual outbound traffic from an internal server. The analyst suspects the server may be communicating with a command-and-control server. Which Palo Alto Networks firewall feature should the analyst use to identify the application generating the traffic, regardless of the port being used?

Accepted Answer

App-ID. App-ID identifies applications by examining traffic behavior and signatures, not just port numbers, so it can reveal the actual application behind outbound traffic even when it uses non-standard ports. This is essential for detecting command-and-control activity that often hides on unexpected ports. User-ID, Content-ID, and decryption policy serve different purposes and do not provide application identification.

Answer

User-ID

Answer

Decryption policy

Answer

Content-ID

Question 14

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

Accepted Answer

It allows unauthorized applications to traverse standard ports like 80 and 443, expanding the attack surface. Allowing 'any' in the application field means the Security rule permits all applications, including those that may be unauthorized or malicious, to traverse the firewall on standard ports like 80 and 443. This expands the attack surface because attackers can use any application, including peer-to-peer, remote access, or custom malware, to communicate. Best practice is to allow only specific applications that are required for business, following the principle of least privilege.

Answer

It prevents the firewall from performing Layer 3 IP address routing

Answer

It disables the generation of threat logs for all established sessions

Answer

It automatically enables SSL decryption on all matching traffic flows

Question 15

An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?

Accepted Answer

Create a Behavioral Threat Protection exception specifying the application hash and the triggered rule ID.. Creating a Behavioral Threat Protection exception with the specific application hash and triggered rule ID allows the administrator to suppress the false positive for that exact behavior without affecting other applications. This granular approach maintains the protection of BTP for all other processes. It is the recommended method to handle legitimate applications that trigger BTP alerts.

Answer

Lower the threat severity threshold for Behavioral Threat Protection in the agent profile.

Answer

Set the Cortex XDR Agent to troubleshooting mode for the affected subnet.

Answer

Add the application directory to the system-wide exclusion list in the Malware Profile.