Cybersecurity-Practitioner Practice Test 2 — 10 Questions

Question 1

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Actions on Objectives. The Lockheed Martin cyber kill chain defines seven sequential phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B, Actions on Objectives, is correct because it is the final phase where the attacker accomplishes their goal, such as encrypting files in a ransomware attack. Option C, Weaponization, is correct because it is the phase where the attacker pairs an exploit with a payload (e.g., a malicious macro or exploit kit) to create the deliverable malware. Option E, Delivery, is correct because it is the phase where the weaponized payload is transmitted to the target, such as via phishing email, USB drive, or web download. Option A, Mitigation, is not part of the kill chain; it is a defensive countermeasure category, not an attacker phase. Option D, Continuous Patching, is not part of the kill chain either; it is a vulnerability management practice, not an attack phase.

Answer

Mitigation

Answer

Continuous Patching

Question 2

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). In a URL Filtering profile, each URL category can be assigned one of several actions, and the three valid actions here are Continue, Block, and Alert. Option A, Continue, is correct because it allows the user to proceed only after being shown a warning/response page that requires acknowledgment, which is a standard URL Filtering action for cautioning users about risky categories. Option B, Block, is correct because it terminates the session and presents a response page, which is the primary enforcement action for malicious or disallowed URL categories. Option D, Alert, is correct because it permits the traffic while generating a URL log entry, enabling monitoring without blocking. Option C, Quarantine, is not a URL Filtering profile action; client isolation into an isolated VLAN is a function of host information/profile or quarantine features, not URL category actions. Option E, Encrypt, is not a URL Filtering action; SSL forward proxy decryption is configured in decryption policy/profiles, not as a per-URL-category action in a URL Filtering profile.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)

Question 3

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

Accepted Answer

Zero Trust Architecture. Zero Trust Architecture (ZTA) is built on the principle 'never trust, always verify' — every user and device must be continuously authenticated and authorized regardless of network location. Prisma Access implements ZTA by combining identity-based policy, device posture checks, and continuous session evaluation at a global security cloud. This directly replaces the implicit-trust assumption of perimeter defense.

Answer

Secure Access Service Edge (SASE) core routing

Answer

Defense-in-Depth

Answer

Network Access Control (NAC)

Question 4

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Option A is correct because disabling cleartext administrative services such as HTTP and Telnet and using HTTPS and SSH instead ensures that management sessions are encrypted and resistant to credential sniffing. Option B is correct because attaching a Management Profile to the management interface lets you permit administrative access only from specific, trusted source IP addresses and restrict which services are enabled, shrinking the attack surface. Option D is correct because placing management on a dedicated out-of-band network physically or logically separated from data traffic prevents compromised data-plane hosts from reaching the firewall's management plane. Option C is not recommended because granting every administrator the superuser role violates least privilege and increases the impact of a compromised account. Option E is not recommended because SSHv1 and SSLv2 are deprecated, cryptographically weak protocols that expose management sessions to known attacks.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 5

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

Accepted Answer

Automate the initial deployment configuration, licensing, software updates, and network settings without manual intervention.. Bootstrapping a VM-Series firewall in a public cloud refers to the automated initialization process that runs at first boot to apply the initial configuration, install licenses, pull software updates, and set network parameters without requiring manual console access. This is essential in cloud deployments where instances are ephemeral and often provisioned via automation (Terraform, CloudFormation, ARM templates), so manual configuration is impractical. The bootstrap package (init-cfg.txt, bootstrap.xml, license files) is typically stored in cloud storage and referenced via instance metadata or user data.

Answer

Perform vulnerability scanning on the cloud provider's underlying hypervisor.

Answer

Encrypt all cloud storage volumes attached to the firewall instance before runtime.

Answer

Establish a secure SSH tunnel from the public cloud to the Palo Alto Networks TAC portal.

Question 6

Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?

Accepted Answer

Resource Query Language (RQL). Prisma Cloud's Resource Query Language (RQL) is a SQL-like query language purpose-built for inspecting cloud resource configurations, audit trails, and compliance posture across multi-cloud environments. Security teams use RQL to write custom policies and investigate misconfigurations by querying normalized resource attributes. This is the defining feature for custom policy authoring in Prisma Cloud.

Answer

GlobalProtect Log Language (GPLL)

Answer

Panorama Security Query Language (PSQL)

Answer

WildFire Query Syntax (WQS)

Question 7

A security team wants to prevent a specific known-malicious executable from running on all Windows endpoints managed by Cortex XDR. The file's SHA-256 hash is known, but the filename may vary. They must ensure the block is enforced even if the file is renamed. Which Cortex XDR capability should they use?

Accepted Answer

Create a Malware profile with a hash-based blocklist entry for the SHA-256 hash.. Malware profiles support hash-based blocklists, allowing precise identification of malicious files by SHA-256. This method is effective even if the file is renamed or moved, because the hash remains constant. Other options either rely on mutable attributes like filename or path, or are designed for different purposes such as exploit mitigation or execution restrictions.

Answer

Add the file path to the Exploit Prevention module's exclusion list.

Answer

Configure a Behavioral Threat protection rule that flags processes with the same original filename.

Answer

Enable the Restriction policy to deny execution of unsigned binaries in the Downloads folder.

Question 8

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

Accepted Answer

Registry modification events.. Cortex XDR ingests endpoint telemetry from the Palo Alto Networks Cortex XDR agent, which includes process execution and termination telemetry (Option C) — the agent records process creation, command lines, parent-child relationships, and termination events to build the causality chain used in the Cortex XDR causality analysis engine. It also collects network connection and socket activity logs (Option D), capturing details such as source/destination IP addresses, ports, protocols, and the processes that opened sockets, which are essential for detecting command-and-control and lateral movement. Registry modification events (Option A) are likewise gathered, since the agent monitors Windows registry key/value changes (e.g., Run keys, services, and persistence locations) to surface malicious persistence and configuration tampering. Options B and E are not endpoint security telemetry: personal email bodies and browser photo uploads are user content that Cortex XDR does not ingest, and cafeteria menu preferences are entirely unrelated to endpoint visibility.

Answer

Personal user email message bodies and browser photo uploads.

Answer

Internal corporate cafeteria menu preferences.

Question 9

An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?

Accepted Answer

Antivirus Profile. An Antivirus Profile is the correct security profile to attach to a Security policy rule to prevent known malware and spyware from entering via downloaded files and web traffic. It scans traffic for viruses, spyware, and other malicious content, blocking or alerting based on configured actions. This directly addresses the requirement to stop known malware at the network perimeter.

Answer

DoS Protection Profile

Answer

Data Filtering Profile

Answer

URL Filtering Profile

Question 10

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

Accepted Answer

Implementing perimeter firewalls with threat prevention, internal segmentation firewalls, endpoint protection via Cortex XDR, and multi-factor authentication for user access.. Defense-in-depth means layering multiple independent controls so that no single failure compromises the environment. Option D combines perimeter firewalls, internal segmentation, endpoint protection (Cortex XDR), and MFA — four distinct layers covering network, endpoint, and identity domains, which is the textbook implementation of the principle.

Answer

Using automated patch management software as the sole security control for all internal servers.

Answer

Relying entirely on cloud-delivered security services without deploying physical or virtual firewalls on-premises.

Answer

Deploying a single, highly powerful firewall at the perimeter with all security profiles enabled and no internal segmentation.