Cybersecurity-Practitioner Practice Test 20 — 15 Questions

Question 1

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The organization has a internal certificate authority (CA) and wants to ensure that users do not receive certificate warnings. Which action must the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the forward trust certificate on the firewall and its CA certificate on user devices.. The forward trust certificate is used by the firewall to impersonate servers during decryption. For users to trust these impersonated certificates, the CA that signed the forward trust certificate must be installed as a trusted root on their devices. The forward untrust certificate is for sites that cannot be decrypted and is not relevant for user trust.

Answer

Install the forward trust certificate on the firewall and the forward untrust certificate on user devices.

Answer

Install the forward trust certificate on user devices and the forward untrust certificate on the firewall.

Answer

Install the forward untrust certificate on the firewall and its CA certificate on user devices.

Question 2

Which TWO methods can be utilized to distribute Cortex XDR agent installation packages across an enterprise Windows environment? (Choose two)

Accepted Answer

Active Directory Group Policy Object (GPO) software installation.. Option C is correct because Active Directory Group Policy Object (GPO) software installation is a native Windows mechanism that lets administrators assign or publish MSI packages to domain-joined computers, so the Cortex XDR agent installer can be pushed automatically at startup or logon across the enterprise. Option E is correct because centralized software deployment platforms such as Microsoft Endpoint Configuration Manager (SCCM) and Microsoft Intune are designed for large-scale, managed distribution of applications and can deploy the Cortex XDR agent package to Windows endpoints with reporting and targeting. Option A is not appropriate because Cortex XDR agent packages are not distributed through public app stores for self-service installation, and that would not provide centralized enterprise control. Option B is not appropriate because broadcasting an unencrypted installer over subnet broadcast domains is insecure and unreliable, and it is not a supported enterprise deployment method. Option D is not appropriate because emailing installer binaries as attachments exposes the package to interception and relies on manual user execution, which is neither secure nor scalable for enterprise-wide deployment.

Answer

Direct user self-service installation via public app store downloads.

Answer

Broadcasting the installer binary unencrypted over local subnet broadcast domains.

Answer

Embedding the installer inside incoming corporate email attachments for users to execute.

Question 3

During a threat hunting exercise on a Palo Alto Networks firewall, an analyst identifies an adversary scanning internal subnets to map out open ports and active hosts prior to launching an exploit. According to MITRE ATT&CK, which Tactic describes this phase?

Accepted Answer

Discovery. In MITRE ATT&CK, Discovery (TA0007) covers techniques adversaries use to gain knowledge about the system and internal network, including port scanning, host enumeration, and network mapping. Scanning internal subnets to identify open ports and active hosts before exploitation is the textbook definition of Discovery. This tactic precedes Lateral Movement and Execution, as the adversary gathers intelligence to plan the next phase.

Answer

Lateral Movement

Answer

Defense Evasion

Answer

Initial Access

Question 4

An administrator needs to temporarily disable the Cortex XDR agent on an endpoint for troubleshooting purposes. What mechanism is used to authorize this action locally using the command line?

Accepted Answer

An Anti-Tamper password generated from the Cortex XDR management console.. The Cortex XDR agent is protected by an Anti-Tamper mechanism that prevents unauthorized local users (even administrators) from stopping, uninstalling, or disabling the agent. To temporarily disable it for troubleshooting, the administrator must obtain an Anti-Tamper password (also called an uninstall password) generated from the Cortex XDR management console (Settings > Agent Configurations or endpoint details). This password is then supplied locally via the command line (e.g., using cytool or the agent's CLI) to authorize the action.

Answer

A local administrator password configured during OS installation.

Answer

A registry override key set by group policy.

Answer

A network firewall bypass token.

Question 5

A Cortex XDR administrator needs to confirm that a newly deployed Windows endpoint has successfully registered with the management console and is receiving policy updates. Which indicator in the Cortex XDR management console confirms that the endpoint is actively managed?

Accepted Answer

The endpoint appears in the Endpoint Management inventory with a status of Connected and a recent Last Seen timestamp. The Endpoint Management inventory is the authoritative source for confirming agent registration and connectivity. An endpoint listed with a Connected status and a recent Last Seen timestamp demonstrates that the agent has registered and is checking in, which means it is receiving policy updates from the management console as intended.

Answer

The endpoint's hostname is resolvable via DNS from the administrator's workstation

Answer

The endpoint responds to an ICMP ping from the management console's network segment

Answer

A user on the endpoint confirms that the Cortex XDR tray icon is visible in the system notification area

Question 6

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

Accepted Answer

User-ID Agent mapping and Windows Security Event Log polling. Option C is correct because PAN-OS supports the User-ID Agent, which can monitor Windows Security Event Logs (via WMI or the agent's server monitoring) to map users to IP addresses from logon events. Option E is correct because GlobalProtect logs supply user-to-IP mappings when clients connect, and captive portal authentication also generates User-ID mappings for users authenticating through the firewall. Option A is incorrect because ICMP ping sweeps only discover live hosts and cannot associate users with IP addresses. Option B is incorrect because BGP advertisements carry routing prefixes, not user identity mappings. Option D is incorrect because DNS zone transfers provide name resolution data, not User-ID mappings, and the firewall does not use them as a User-ID source.

Answer

ICMP Ping sweeps of internal subnet scopes

Answer

BGP routing table advertisements

Answer

Direct DNS Zone Transfer requests initiated by the firewall data plane

Question 7

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

Accepted Answer

Use of valid accounts for initial access or lateral movement. After credentials are captured via a phishing page, the attacker uses those valid accounts to log in, which corresponds to the 'Use of Valid Accounts' technique for initial access or lateral movement in the attack lifecycle. This phase immediately follows credential capture because the stolen credentials are now leveraged to access systems. It is a direct continuation of the credential-harvesting step.

Answer

Exploitation of client-side software vulnerabilities

Answer

Passive network sniffing to harvest additional certificates

Answer

Immediate domain controller encryption via ransomware

Question 8

A network security team is deploying a Palo Alto Networks firewall in Layer 2 mode between two internal segments. Users report that ARP resolution works but traffic between the segments is silently discarded. Which configuration element most likely explains why the traffic is dropped despite correct Layer 2 forwarding?

Accepted Answer

The Security policy uses zone-based rules but the Layer 2 interfaces are not assigned to zones, so no interzone rule matches.. Security policy is enforced in Layer 2 mode just as in Layer 3 mode, and it is zone-based. If the Layer 2 interfaces are not assigned to zones, no interzone rule can match, and the default deny silently discards the traffic. Binding interfaces to zones and adding the correct allow rules resolves the drop.

Answer

The firewall's DNS proxy is not configured, so it cannot resolve the destination addresses.

Answer

The firewall's management interface is on the same subnet as the user segments, causing a routing conflict.

Answer

The firewall requires a virtual router to be configured for Layer 2 interfaces to forward traffic.

Question 9

A financial services company is updating its incident response plan. The security manager wants to ensure the plan covers activities that occur during the containment, eradication, and recovery phases. Which two activities belong to those phases? (Choose two.)

Accepted Answer

Isolating an infected workstation from the network by disabling its switch port.. Containment stops the spread, eradication removes the threat and its root cause, and recovery restores normal operations. Isolating an infected host is containment, and removing malware plus patching the exploited flaw is eradication. Detection activities and post-incident reviews occur in other phases, so they fall outside the span the manager is mapping.

Answer

Documenting the initial alert that triggered the investigation and assigning a severity level.

Answer

Monitoring network traffic to detect the first signs of malicious activity.

Answer

Conducting a post-incident lessons-learned meeting with stakeholders.

Question 10

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Accepted Answer

Administrator activity and authentication logs recording login timestamps and source IPs. Option C is correct because administrator activity and authentication logs capture login timestamps and source IP addresses, providing the audit trail of who accessed the management plane and when, which is essential for administrative accountability under risk management frameworks. Option D is correct because Role-Based Access Control (RBAC) enforces least privilege by restricting each administrator to only the roles and tasks required, directly satisfying change-control and segregation-of-duties requirements. Option E is correct because Configuration Audit logs record every administrative commit, the specific configuration changes made, and the user responsible, delivering the traceability auditors require for change control. Option A does not belong because automated daily factory resets would wipe configuration and audit evidence, destroying accountability rather than supporting it. Option B does not belong because disabling all logging eliminates the audit trail entirely, which directly violates compliance and accountability requirements.

Answer

Automated daily factory reset scripts executed on the management plane

Answer

Disabling all logging to prevent unauthorized access to log databases

Question 11

An administrator is configuring disk encryption management in Cortex XDR for macOS endpoints. Which underlying native macOS technology does Cortex XDR manage and report on for disk encryption?

Accepted Answer

FileVault. Cortex XDR manages and reports on FileVault, which is the native full-disk encryption technology built into macOS. FileVault encrypts the startup disk using XTS-AES-128 with a 256-bit key, and Cortex XDR can enforce, monitor, and report on its status across managed macOS endpoints. This integration allows administrators to ensure compliance with disk encryption policies.

Answer

Apple Disk Utility RAID encryption

Answer

DM-Crypt / LUKS

Answer

BitLocker to Go

Question 12

A network administrator is documenting the security zones on a Palo Alto Networks firewall. The firewall has an interface connected to the public internet and another connected to a DMZ hosting a web server. Which zone type should be assigned to the interface facing the public internet to apply the strictest default posture?

Accepted Answer

Untrust zone. Interfaces facing the public internet should be placed in an Untrust zone so that all inbound traffic is denied unless a Security policy rule explicitly permits it. This enforces the default-deny model and clearly separates hostile external networks from internal Trust and DMZ zones, supporting least-privilege segmentation.

Answer

Trust zone

Answer

Tap zone

Answer

DMZ zone

Question 13

A software company wants to verify that its internally developed payment module does not introduce exploitable weaknesses before release. The security team will perform a review that examines the compiled application's behavior while it runs, without access to the original source code. Which activity matches this requirement?

Accepted Answer

Dynamic application security testing of the running payment module.. The requirement is to examine a running, compiled application without source access, which is the defining characteristic of dynamic application security testing. Static analysis needs source or bytecode, composition analysis targets dependencies, and threat modeling is a design-time exercise. Only dynamic testing observes real execution to uncover exploitable runtime weaknesses.

Answer

Threat modeling workshops with the development team before coding begins.

Answer

Software composition analysis of third-party libraries bundled with the module.

Answer

Static application security testing of the payment module's source repository.

Question 14

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Accepted Answer

GlobalProtect clientless VPN acting as a reverse proxy with SAML authentication. GlobalProtect clientless VPN acts as a reverse proxy that sits in front of legacy web applications, presenting them through a browser-based portal with SAML authentication. Because the proxy terminates the user session and re-initiates it to the backend, the legacy application never needs to support federation protocols — it only sees the proxy's connection.

Answer

Zone Protection SYN proxy configuration

Answer

WildFire cloud analysis submission API

Answer

App-ID custom application signature generator

Question 15

Which Palo Alto Networks product provides Cloud Infrastructure Entitlement Management (CIEM) to discover, analyze, and remediate excessive permissions and identities across multi-cloud environments?

Accepted Answer

Prisma Cloud IAM Security (CIEM). Prisma Cloud IAM Security is Palo Alto Networks' dedicated Cloud Infrastructure Entitlement Management (CIEM) module, delivered as part of the Prisma Cloud platform. It continuously discovers identities, roles, and service accounts across AWS, Azure, GCP, and OCI, then analyzes effective permissions to flag excessive or unused entitlements and offers least-privilege remediation guidance. The other options are either identity/access products that do not perform CIEM analysis or entirely fictional product names.

Answer

Prisma Access Identity Service

Answer

GlobalProtect Entitlement Manager

Answer

WildFire Entitlement Scanner