Cybersecurity-Practitioner Practice Exam 2 — 20 Questions

Question 1

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Never trust, always verify through continuous context. Zero Trust mandates that access be granted based on continuous verification of context, identity, and posture, completely eliminating implicit trust zones.

Answer

Perimeter-based defense centralization

Answer

Implicit trust verification via subnet placement

Answer

Static role-based implicit authorization

Question 2

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. Assigning a customized Role Profile with read-only permissions ensures the user has only the access required to perform their job and nothing more.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.

Question 3

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

Accepted Answer

Command and Control. Command and Control (TA0011) consists of techniques that adversaries use to communicate with systems under their control within a victim network.

Answer

Execution

Answer

Lateral Movement

Answer

Initial Access

Question 4

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?

Accepted Answer

Defense Evasion. Defense Evasion (TA0005) consists of techniques that adversaries use to avoid detection throughout their compromise, such as obfuscating or encoding data and scripts.

Answer

Initial Access

Answer

Exfiltration

Answer

Collection

Question 5

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

Accepted Answer

Remote Services (e.g., SMB/Windows Admin Shares, RDP). Remote Services (T1021) and Exploitation of Remote Services (T1210) are classic techniques used by adversaries to move laterally through an environment.

Answer

Phishing via Spearphishing Link

Answer

Automated Exfiltration Over C2 Channel

Answer

Steal Web Session Cookie

Question 6

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Zero Trust identity strategies mandate continuous, risk-based adaptive verification and the strict enforcement of least-privilege access rather than relying on perimeter location or static trust.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 7

A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?

Accepted Answer

Least-privilege principles. Least-privilege principles dictate that users and accounts are granted only the minimum necessary access required to complete their designated tasks.

Answer

Role-Based Access Control expansion

Answer

Zero Trust Architecture

Answer

Federated Identity Management

Question 8

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

Accepted Answer

Custom command and control infrastructure and objectives focused on espionage. APTs are distinguished by their stealthy, long-term presence, customization to evade detection, and focus on espionage rather than rapid financial extortion.

Answer

Rapid data encryption and extortion demands

Answer

Low dwell time and heavy reliance on automated scanners

Answer

Exclusive use of built-in Living off the Land binaries

Question 9

A security analyst is provisioning a new User-ID agent to map IP addresses to usernames in a Windows Active Directory domain. To adhere to least-privilege principles, what level of access should be granted to the service account used by the User-ID agent?

Accepted Answer

Read-only access to Active Directory security logs and event viewer access. The User-ID agent service account requires read-only permissions to query Active Directory security logs and the security event log, avoiding administrative privileges.

Answer

Local Administrator on all domain controllers

Answer

Domain Administrator privileges

Answer

Schema Administrator privileges

Question 10

A SOC manager wants to restrict administrator access so that network engineers can modify firewall security policies, but cannot modify system-level settings or firewall high-availability (HA) parameters. Where should the manager configure this restriction in Panorama?

Accepted Answer

Panorama > Admin Roles. Admin Role Profiles in Panorama allow granular control over feature access, specifying exactly which tabs and actions an administrator can view or modify.

Answer

Objects > Custom Objects > URL Category

Answer

Network > Interfaces > VLAN

Answer

Device > Setup > Management

Question 11

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Accepted Answer

Persistence. Persistence (TA0003) consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions.

Answer

Impact

Answer

Collection

Answer

Reconnaissance

Question 12

An organization is deploying Zero Trust Network Access (ZTNA) via Prisma Access. The SOC notices that a user device with compromised posture (missing host integrity check) is successfully authenticated by the SAML IdP but is denied network access. Where is this runtime access enforcement happening?

Accepted Answer

At the Prisma Access cloud service node via GlobalProtect Gateway posture enforcement. Prisma Access evaluates the posture assessment and user context against the GlobalProtect Gateway agent settings and security rules to dynamically drop or restrict access at runtime.

Answer

Via the Panorama Syslog export settings to the SIEM

Answer

Within the Cortex XDR agent running on the endpoint

Answer

Inside the Active Directory Domain Controller Group Policy Objects

Question 13

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

Accepted Answer

User-ID Agent mapping and Windows Security Event Log polling. PAN-OS supports User-ID agent mapping, captive portal, Exchange monitoring, Syslog listening, and GlobalProtect as mapping sources.

Answer

ICMP Ping sweeps of internal subnet scopes

Answer

BGP routing table advertisements

Answer

Direct DNS Zone Transfer requests initiated by the firewall data plane

Question 14

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

Accepted Answer

Execute an automated Cortex XSOAR playbook task invoking the PAN-OS XML API to terminate the active user session. API-based session revocation or User-ID user logout commands can be invoked via Cortex XSOAR to immediately clear sessions on Prisma Access/firewalls.

Answer

Clear the Dynamic Address Group tags manually via a Syslog alert

Answer

Wait for the active DHCP lease to expire on the core switch

Answer

Restart the management server daemon on Panorama

Question 15

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

Accepted Answer

GlobalProtect with Host Information Profile (HIP) checking and SAML authentication. Combining GlobalProtect with HIP (Host Information Profile) checks and SAML authentication enforces continuous dynamic evaluation of user identity and device health.

Answer

Unauthenticated captive portal with static MAC address whitelisting

Answer

Static IP reservation combined with pre-shared key IPsec tunnels

Answer

SNMP trap forwarding combined with local database authentication

Question 16

A security operations team is reviewing MITRE ATT&CK Tactic classifications for an incident involving credential theft and subsequent unauthorized actions on a Palo Alto Networks protected network. Which THREE of the following Tactics fall under the 'Post-Compromise' or later stages of the attack lifecycle? (Choose three)

Accepted Answer

Exfiltration. In MITRE ATT&CK, tactics like Exfiltration, Lateral Movement, and Command and Control occur after initial access and execution.

Answer

Initial Access

Answer

Reconnaissance

Question 17

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. Using valid accounts for persistence falls under the Persistence tactic, and modifying group memberships to gain higher access falls under Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 18

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

Accepted Answer

Utilization of stealthy techniques designed to evade standard security monitoring tools. APTs are characterized by long dwell times, stealthy behavior to evade automated detection, and customized tools targeted at specific organizational objectives.

Answer

Exclusive reliance on publicly available penetration testing scripts

Answer

Short dwell times with aggressive, noisy data encryption

Question 19

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

Accepted Answer

Brute Force. Credential Access techniques are used by adversaries to steal credentials such as account names and passwords, including OS Credential Dumping and Brute Force attacks.

Answer

Masquerading

Answer

Data Exfiltration Over C2 Channel

Answer

Automated Exfiltration

Question 20

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

Accepted Answer

Deploy the Cloud Identity Engine (CIE) agent and configure directory synchronization with Microsoft Entra ID.. Prisma Access integrates with User-ID via the Syslog listener, GlobalProtect agent, or Cloud Identity Engine (CIE) to map IP addresses to usernames.

Answer

Configure an explicit SAML authentication proxy on the Panorama management plane.

Answer

Configure an explicit proxy PAC file pointing all browser traffic to the Prisma Access Remote Networks gateway IP.

Answer

Install a dedicated VM-Series User-ID Agent on an EC2 instance in every public cloud VPC.