Cybersecurity-Practitioner Practice Test 2 — 10 Questions

Question 1

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. High management plane CPU can be caused by heavy logging/reporting queries, large external dynamic list (EDL) downloads, excessive Panorama synchronization, or frequent XML API requests.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 2

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

Accepted Answer

ICMP and UDP flood protection setting packet rate thresholds.. Zone Protection Profiles protect against SYN floods, ICMP/UDP floods, IP spoofing, packet-based attacks (e.g., overlapping fragments, land attacks), and reconnaissance.

Answer

Advanced URL filtering categorization of malicious phishing links.

Answer

Automatic kernel-level malware sandboxing of unknown executable attachments.

Question 3

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. Comprehensive outbound web protection requires URL Filtering (to block malicious sites) and Anti-Spyware or Antivirus/Vulnerability protection (to block malware and exploits).

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 4

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

Accepted Answer

HA Session Synchronization. Session synchronization ensures that active stateful session information is mirrored to the passive firewall so traffic continues seamlessly after failover.

Answer

Route Monitoring

Answer

HEC (High Availability Encryption)

Answer

Preemption

Question 5

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. Azure AD / Entra ID conditional access policies evaluate device compliance and identity claims during the SAML authentication token issuance phase before GlobalProtect grants network access.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 6

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) allows administrators to manage bandwidth and prioritize critical traffic classes over less important traffic.

Answer

User-ID

Answer

GlobalProtect

Answer

WildFire

Question 7

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Management plane security best practices include restricting access via IP, using dedicated management interfaces, and disabling unnecessary services.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 8

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

Accepted Answer

Privilege Escalation. Privilege Escalation (TA0004) consists of techniques that adversaries use to gain higher-level permissions on a system or network, such as modifying roles or permissions.

Answer

Initial Access

Answer

Exfiltration

Answer

Credential Access

Question 9

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping is classified under the Credential Access tactic (TA0006) as attackers attempt to acquire account names and passwords.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 10

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by their persistence, targeted focus, use of legitimate system tools (living off the land), and deliberate, stealthy manual intervention over automated destruction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals