Cybersecurity-Practitioner Practice Exam 1 — 20 Questions

Question 1

An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

URL Filtering Profile attached to the relevant Security policy rule. URL Filtering Profiles allow administrators to categorize and block/allow specific web categories, and are attached to Security policy rules.

Answer

Zone Protection Profile applied to the external zone

Answer

Data Filtering Profile attached to the NAT policy

Answer

Authentication Profile configured under Device > Setup

Question 2

A firewall is deployed in an environment with asymmetric routing. Packets belonging to the same TCP session enter on different interfaces due to multi-path upstream routing. What configuration change is required on the Palo Alto Networks firewall to prevent the traffic from being dropped?

Accepted Answer

Set Asymmetric Path to 'bypass' or 'loose' under Device > Setup > Session > Session Settings.. Asymmetric routing causes path mismatch where SYN goes through one interface/firewall node and ACK goes through another. Asymmetric Path settings under Device > Setup > Session must be set to 'bypass' or 'loose-check'.

Answer

Configure an explicit Security policy rule with 'Any' to 'Any' action set to accept asymmetric flows.

Answer

Enable strict TCP validation under Device > Setup > Session.

Answer

Disable stateful inspection globally using a custom Application Override policy.

Question 3

An administrator needs to configure a security rule that applies specifically to traffic destined for a DMZ web server using its public NAT IP address (Destination NAT). Which IP address must be specified in the Destination field of the Security policy rule?

Accepted Answer

The public pre-NAT IP address assigned to the external interface.. Security rules must always reference the pre-NAT (original destination) IP address when evaluating incoming traffic from the untrusted zone, unless specified otherwise depending on PAN-OS version, but standard best practice dictates matching the zone and the pre-NAT destination IP address.

Answer

The loopback interface IP address of the firewall.

Answer

The MAC address of the DMZ server.

Answer

The private post-NAT IP address of the internal web server.

Question 4

An administrator notices that an internal client is infected with malware that is attempting to exfiltrate data over HTTPS using a custom encrypted protocol that evades standard signatures. The administrator wants to configure WildFire inline machine learning to block this zero-day threat in real-time. Which feature must be enabled and configured?

Accepted Answer

Enable Inline Machine Learning in the WildFire Analysis Profile attached to the Security policy rule.. WildFire inline machine learning provides real-time detection of zero-day threats during the initial session handshake. This requires a WildFire Analysis Profile with inline ML enabled, attached to the Security policy rule.

Answer

Enable SSL Decryption with a custom Decryption Forward Trust certificate.

Answer

Set the Anti-Spyware profile action to 'Reset Both' for all severity levels.

Answer

Configure a custom Application Override rule for the encrypted stream.

Question 5

An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?

Accepted Answer

QoS must be explicitly enabled on the egress Layer 3 interface settings with configured guaranteed and maximum bandwidth limits.. For QoS to function properly on Palo Alto Networks firewalls, QoS must be enabled on the egress interface settings, and clear-text or DSCP/IP Precedence classification mapping must be defined on the interface.

Answer

The firewall requires an active Advanced URL Filtering license to classify VoIP packets.

Answer

GlobalProtect VPN tunnels must be configured in full-tunnel mode to preserve QoS headers.

Answer

An Application Override policy must be created to bypass App-ID processing for VoIP streams.

Question 6

An administrator configures a decryption policy to 'No Decrypt' for financial institution websites to comply with privacy regulations. However, the firewall is still decrypting traffic to certain banking sites. Upon investigation, the administrator discovers that the firewall is matching a pre-defined PAN-OS SSL Decryption Exclusion list. How can the administrator override or modify this behavior?

Accepted Answer

Create a higher-precedence Decryption rule with action set to 'No Decrypt' and disable the dynamic decryption exclusion list if permitted.. PAN-OS includes built-in SSL Decryption Exclusions for sensitive sites (e.g., banking, healthcare) maintained by Palo Alto Networks. Administrators can view or manage these exclusions, but cannot directly disable built-in dynamic updates unless specifically configured via Decryption exclusions settings. Specifically, administrators can configure custom Decryption rules with a higher precedence or manage SSL Exclusion settings.

Answer

Delete the pre-defined system files directly from the FreeBSD CLI shell.

Answer

Change the Application Override policy to drop TLS handshake packets for banking apps.

Answer

Downgrade the WildFire dynamic content version to remove the hardcoded exclusion database.

Question 7

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection Profiles inspect traffic for known exploits, vulnerability signatures, and attacks like SQL injection and buffer overflows.

Answer

WildFire Analysis Profile

Answer

URL Filtering Profile

Answer

Antivirus Profile

Question 8

An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?

Accepted Answer

Layer 3 interface assigned to an Untrust security zone. Interfaces connected to external untrusted networks (like ISPs) are configured as Layer 3 interfaces and assigned to an Untrust security zone.

Answer

Tap interface assigned to an Internal zone

Answer

Virtual Wire interface assigned to a DMZ zone

Answer

HA1 interface assigned to the Management zone

Question 9

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Accepted Answer

Group related security rules into logical rule categories for easier management and auditing.. Best practices for security rules include grouping related rules into rule categories, using descriptive names, avoiding overly broad 'any-any' rules where possible, and leveraging Security-ID/App-ID rather than port-based rules.

Answer

Disable logging on all security rules to conserve management plane CPU resources.

Answer

Always use the 'any' source zone to ensure all internal subnets are covered simultaneously.

Answer

Place broad, permissive rules at the top of the security policy base to speed up rule evaluation.

Question 10

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

Accepted Answer

Verify that the DNS Proxy object has valid primary and secondary external DNS server IP addresses configured.. When configuring DNS Proxy on a Palo Alto Networks firewall, the administrator must ensure primary/secondary DNS servers are configured, the interface is enabled for DNS proxy, and client requests are pointed to the correct proxy interface IP.

Answer

Ensure captive portal redirection is enabled on the loopback address.

Answer

Verify that BGP routing is enabled on all Layer 2 trust interfaces.

Answer

Check that the GlobalProtect portal certificate is installed in the trusted root store.

Question 11

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. High management plane CPU can be caused by heavy logging/reporting queries, large external dynamic list (EDL) downloads, excessive Panorama synchronization, or frequent XML API requests.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 12

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

Accepted Answer

ICMP and UDP flood protection setting packet rate thresholds.. Zone Protection Profiles protect against SYN floods, ICMP/UDP floods, IP spoofing, packet-based attacks (e.g., overlapping fragments, land attacks), and reconnaissance.

Answer

Advanced URL filtering categorization of malicious phishing links.

Answer

Automatic kernel-level malware sandboxing of unknown executable attachments.

Question 13

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. Comprehensive outbound web protection requires URL Filtering (to block malicious sites) and Anti-Spyware or Antivirus/Vulnerability protection (to block malware and exploits).

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 14

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

Accepted Answer

HA Session Synchronization. Session synchronization ensures that active stateful session information is mirrored to the passive firewall so traffic continues seamlessly after failover.

Answer

Route Monitoring

Answer

HEC (High Availability Encryption)

Answer

Preemption

Question 15

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. Azure AD / Entra ID conditional access policies evaluate device compliance and identity claims during the SAML authentication token issuance phase before GlobalProtect grants network access.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 16

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) allows administrators to manage bandwidth and prioritize critical traffic classes over less important traffic.

Answer

User-ID

Answer

GlobalProtect

Answer

WildFire

Question 17

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Management plane security best practices include restricting access via IP, using dedicated management interfaces, and disabling unnecessary services.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 18

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

Accepted Answer

Privilege Escalation. Privilege Escalation (TA0004) consists of techniques that adversaries use to gain higher-level permissions on a system or network, such as modifying roles or permissions.

Answer

Initial Access

Answer

Exfiltration

Answer

Credential Access

Question 19

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping is classified under the Credential Access tactic (TA0006) as attackers attempt to acquire account names and passwords.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 20

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by their persistence, targeted focus, use of legitimate system tools (living off the land), and deliberate, stealthy manual intervention over automated destruction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals