Cybersecurity-Practitioner Practice Exam 1 — 20 Questions

Question 1

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Proxy server address and port.. To enable communication through a forward proxy, the agent configuration must include the proxy server address and port, as well as authentication credentials if the proxy requires them. These settings allow the agent to establish a connection and authenticate with the proxy, ensuring that telemetry and management traffic reach the Cortex XDR management server.

Answer

DNS server addresses for the proxy.

Answer

Broker VM address and port.

Answer

SSL/TLS certificate for the proxy.

Question 2

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

Accepted Answer

Causality View. Causality View is designed specifically for visualizing process ancestry and the details of each process, including command-line arguments. In a scenario where a suspicious process is spawned by an Office application, this view enables the analyst to quickly see whether the PowerShell command is obfuscated or contains malicious parameters, thereby accelerating triage.

Answer

Incident Timeline

Answer

Threat Intelligence

Answer

Alert Details

Question 3

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

Accepted Answer

Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.. The Prisma Cloud GitHub Action is the purpose-built CI/CD integration that scans Infrastructure as Code (Terraform, CloudFormation, ARM, Kubernetes manifests) directly within the GitHub pull request workflow, catching misconfigurations before they are merged or deployed. It authenticates to the Prisma Cloud CSPM API, runs IaC policy checks against the templates, and reports findings as PR comments or status checks. This shifts security left, which is the core goal of scanning IaC in a repository.

Answer

Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.

Answer

Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.

Answer

Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.

Question 4

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

Accepted Answer

Modify the User-ID idle timeout and mapping aging timers in Device > User-ID > Edit settings.. User-ID mappings age out based on the idle timeout and mapping aging timers configured under Device > User-ID > Edit settings. Reducing these timers shortens how long the firewall retains a stale user-to-IP mapping after logoff, which directly addresses the 45-minute attribution problem.

Answer

Change the Security policy session timeout value to 5 minutes.

Answer

Enable Captive Portal as a primary authentication fallback mechanism.

Answer

Increase the GlobalProtect portal idle disconnect timer.

Question 5

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

Accepted Answer

The host is infected with malware that uses DGA to locate its command-and-control (C2) server.. The random-looking subdomains and regular intervals are classic signs of a domain generation algorithm (DGA) used by malware to find its command-and-control server. The host is likely infected and attempting to resolve domains until it reaches the attacker's active C2. This behavior is distinct from DNS amplification, domain fronting, or DNS tunneling, which have different traffic patterns.

Answer

The host is exfiltrating data via DNS tunneling to the domain.

Answer

The host is performing a DNS amplification attack against the domain.

Answer

The host is using a domain fronting technique to hide its traffic.

Question 6

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

Accepted Answer

Device > Setup > Management > General Settings. The idle timeout for firewall administrators logging into the Web Interface is configured under Device > Setup > Management > General Settings. Within this pane, the 'Idle Timeout' field (default 60 minutes) controls how long an inactive administrative session can remain open before the firewall forces re-authentication. Setting it to 15 minutes satisfies the requirement to auto-logout unattended consoles.

Answer

Policies > NAT

Answer

Network > Interfaces > Loopback

Answer

Objects > Tags

Question 7

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

Accepted Answer

Inline Machine Learning analysis that evaluates web traffic and categorizes Newly Registered Domains (NRDs) in real-time.. Advanced URL Filtering's inline machine learning engine analyzes web traffic in real time and can categorize Newly Registered Domains (NRDs) — domains registered within the last 24 hours (or a few hours) — as malicious even before they appear in any static blocklist. This is the feature that catches short-lived, fast-flux phishing and malware domains that traditional URL databases miss.

Answer

GlobalProtect endpoint registry checks for browser history.

Answer

Client-side proxy PAC file lookups against local browser blocklists.

Answer

Static URL database updates downloaded from Panorama once every 24 hours.

Question 8

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

Accepted Answer

The firewall detected TCP traffic that does not match any known application signature database entry.. When App-ID cannot match a session to any known application signature, the firewall falls back to a generic layer-4 classification such as unknown-tcp, unknown-udp, or unknown-p2p. This indicates the traffic is TCP but does not correspond to any application in the signature database, often because it is custom, encrypted without decryption, or evasive.

Answer

The traffic has been blocked by a Security policy rule.

Answer

The session is an encrypted SSL handshake that failed decryption.

Answer

The application is a predefined system service running on the management plane.

Question 9

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

Accepted Answer

Domain generation algorithm (DGA) activity. Domain generation algorithm (DGA) activity is the most likely explanation because malware uses DGAs to generate many random domain names and attempt to contact a command-and-control server. The pattern of numerous failed resolutions with occasional successes from a single host is a strong indicator of DGA-based malware communication, distinguishing it from other DNS-related attacks.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS tunneling

Question 10

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. A DoS Protection profile with classified and aggregate rate limiting rules is specifically designed to mitigate volumetric and application-layer floods, including HTTP GET floods, by rate-limiting based on source, destination, or application criteria while allowing legitimate traffic. This is the correct platform capability to tune for this attack.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic

Question 11

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Accepted Answer

Actions on Objectives. The Lockheed Martin cyber kill chain defines seven sequential phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B, Actions on Objectives, is correct because it is the final phase where the attacker accomplishes their goal, such as encrypting files in a ransomware attack. Option C, Weaponization, is correct because it is the phase where the attacker pairs an exploit with a payload (e.g., a malicious macro or exploit kit) to create the deliverable malware. Option E, Delivery, is correct because it is the phase where the weaponized payload is transmitted to the target, such as via phishing email, USB drive, or web download. Option A, Mitigation, is not part of the kill chain; it is a defensive countermeasure category, not an attacker phase. Option D, Continuous Patching, is not part of the kill chain either; it is a vulnerability management practice, not an attack phase.

Answer

Mitigation

Answer

Continuous Patching

Question 12

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). In a URL Filtering profile, each URL category can be assigned one of several actions, and the three valid actions here are Continue, Block, and Alert. Option A, Continue, is correct because it allows the user to proceed only after being shown a warning/response page that requires acknowledgment, which is a standard URL Filtering action for cautioning users about risky categories. Option B, Block, is correct because it terminates the session and presents a response page, which is the primary enforcement action for malicious or disallowed URL categories. Option D, Alert, is correct because it permits the traffic while generating a URL log entry, enabling monitoring without blocking. Option C, Quarantine, is not a URL Filtering profile action; client isolation into an isolated VLAN is a function of host information/profile or quarantine features, not URL category actions. Option E, Encrypt, is not a URL Filtering action; SSL forward proxy decryption is configured in decryption policy/profiles, not as a per-URL-category action in a URL Filtering profile.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)

Question 13

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

Accepted Answer

Zero Trust Architecture. Zero Trust Architecture (ZTA) is built on the principle 'never trust, always verify' — every user and device must be continuously authenticated and authorized regardless of network location. Prisma Access implements ZTA by combining identity-based policy, device posture checks, and continuous session evaluation at a global security cloud. This directly replaces the implicit-trust assumption of perimeter defense.

Answer

Secure Access Service Edge (SASE) core routing

Answer

Defense-in-Depth

Answer

Network Access Control (NAC)

Question 14

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Option A is correct because disabling cleartext administrative services such as HTTP and Telnet and using HTTPS and SSH instead ensures that management sessions are encrypted and resistant to credential sniffing. Option B is correct because attaching a Management Profile to the management interface lets you permit administrative access only from specific, trusted source IP addresses and restrict which services are enabled, shrinking the attack surface. Option D is correct because placing management on a dedicated out-of-band network physically or logically separated from data traffic prevents compromised data-plane hosts from reaching the firewall's management plane. Option C is not recommended because granting every administrator the superuser role violates least privilege and increases the impact of a compromised account. Option E is not recommended because SSHv1 and SSLv2 are deprecated, cryptographically weak protocols that expose management sessions to known attacks.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 15

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

Accepted Answer

Automate the initial deployment configuration, licensing, software updates, and network settings without manual intervention.. Bootstrapping a VM-Series firewall in a public cloud refers to the automated initialization process that runs at first boot to apply the initial configuration, install licenses, pull software updates, and set network parameters without requiring manual console access. This is essential in cloud deployments where instances are ephemeral and often provisioned via automation (Terraform, CloudFormation, ARM templates), so manual configuration is impractical. The bootstrap package (init-cfg.txt, bootstrap.xml, license files) is typically stored in cloud storage and referenced via instance metadata or user data.

Answer

Perform vulnerability scanning on the cloud provider's underlying hypervisor.

Answer

Encrypt all cloud storage volumes attached to the firewall instance before runtime.

Answer

Establish a secure SSH tunnel from the public cloud to the Palo Alto Networks TAC portal.

Question 16

Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?

Accepted Answer

Resource Query Language (RQL). Prisma Cloud's Resource Query Language (RQL) is a SQL-like query language purpose-built for inspecting cloud resource configurations, audit trails, and compliance posture across multi-cloud environments. Security teams use RQL to write custom policies and investigate misconfigurations by querying normalized resource attributes. This is the defining feature for custom policy authoring in Prisma Cloud.

Answer

GlobalProtect Log Language (GPLL)

Answer

Panorama Security Query Language (PSQL)

Answer

WildFire Query Syntax (WQS)

Question 17

A security team wants to prevent a specific known-malicious executable from running on all Windows endpoints managed by Cortex XDR. The file's SHA-256 hash is known, but the filename may vary. They must ensure the block is enforced even if the file is renamed. Which Cortex XDR capability should they use?

Accepted Answer

Create a Malware profile with a hash-based blocklist entry for the SHA-256 hash.. Malware profiles support hash-based blocklists, allowing precise identification of malicious files by SHA-256. This method is effective even if the file is renamed or moved, because the hash remains constant. Other options either rely on mutable attributes like filename or path, or are designed for different purposes such as exploit mitigation or execution restrictions.

Answer

Add the file path to the Exploit Prevention module's exclusion list.

Answer

Configure a Behavioral Threat protection rule that flags processes with the same original filename.

Answer

Enable the Restriction policy to deny execution of unsigned binaries in the Downloads folder.

Question 18

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

Accepted Answer

Registry modification events.. Cortex XDR ingests endpoint telemetry from the Palo Alto Networks Cortex XDR agent, which includes process execution and termination telemetry (Option C) — the agent records process creation, command lines, parent-child relationships, and termination events to build the causality chain used in the Cortex XDR causality analysis engine. It also collects network connection and socket activity logs (Option D), capturing details such as source/destination IP addresses, ports, protocols, and the processes that opened sockets, which are essential for detecting command-and-control and lateral movement. Registry modification events (Option A) are likewise gathered, since the agent monitors Windows registry key/value changes (e.g., Run keys, services, and persistence locations) to surface malicious persistence and configuration tampering. Options B and E are not endpoint security telemetry: personal email bodies and browser photo uploads are user content that Cortex XDR does not ingest, and cafeteria menu preferences are entirely unrelated to endpoint visibility.

Answer

Personal user email message bodies and browser photo uploads.

Answer

Internal corporate cafeteria menu preferences.

Question 19

An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?

Accepted Answer

Antivirus Profile. An Antivirus Profile is the correct security profile to attach to a Security policy rule to prevent known malware and spyware from entering via downloaded files and web traffic. It scans traffic for viruses, spyware, and other malicious content, blocking or alerting based on configured actions. This directly addresses the requirement to stop known malware at the network perimeter.

Answer

DoS Protection Profile

Answer

Data Filtering Profile

Answer

URL Filtering Profile

Question 20

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

Accepted Answer

Implementing perimeter firewalls with threat prevention, internal segmentation firewalls, endpoint protection via Cortex XDR, and multi-factor authentication for user access.. Defense-in-depth means layering multiple independent controls so that no single failure compromises the environment. Option D combines perimeter firewalls, internal segmentation, endpoint protection (Cortex XDR), and MFA — four distinct layers covering network, endpoint, and identity domains, which is the textbook implementation of the principle.

Answer

Using automated patch management software as the sole security control for all internal servers.

Answer

Relying entirely on cloud-delivered security services without deploying physical or virtual firewalls on-premises.

Answer

Deploying a single, highly powerful firewall at the perimeter with all security profiles enabled and no internal segmentation.