Cybersecurity-Practitioner Practice Exam 3 — 20 Questions

Question 1

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Administrator role mapping via external LDAP/RADIUS group attributes. PAN-OS supports administrator role mapping, where external LDAP or RADIUS group attributes are mapped to PAN-OS administrator roles. This allows dynamic group membership in LDAP to determine the least-privilege role for each admin, eliminating static local accounts and enforcing Zero Trust least privilege.

Answer

Disabling authentication and relying on physical console keylocks

Answer

Local administrator accounts with never-expiring passwords

Answer

Shared superuser account with multi-person shared keys

Question 2

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID is the Palo Alto Networks feature that maps IP addresses to user identities, enabling security policies based on user or group rather than IP alone. Integrating a User-ID agent (or Panorama User-ID mapping) with the firewall populates the user-to-IP mapping table, which policy rules can then reference to enforce least-privilege access in a Zero Trust model.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud

Question 3

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. In Panorama, external log forwarding destinations such as syslog servers are defined under Panorama > Server Profiles > Syslog. This profile specifies the syslog server IP, port, transport (UDP/TCP/SSL), and format, and is then referenced in a Log Forwarding profile applied to security policies. Configuring it here enables encrypted TLS syslog forwarding to an external SIEM.

Answer

Objects > Security Profiles > Antivirus

Answer

Device > High Availability

Answer

Network > GlobalProtect > Gateways

Question 4

A SOC analyst is triaging a Cortex XDR alert for a Windows endpoint that shows a process named 'svchost.exe' making an outbound HTTPS connection to a known malicious IP address. The process path is C:\Users\Public\svchost.exe, and its parent process is 'explorer.exe'. Which of the following best describes the appropriate next step for the analyst?

Accepted Answer

Immediately isolate the endpoint and initiate a malware scan.. The correct answer is to immediately isolate the endpoint and initiate a malware scan. The process masquerading as svchost.exe from an unusual path with a suspicious parent process is a strong indicator of compromise. Isolation contains the threat, and a scan helps identify and remediate any additional malicious files or persistence mechanisms.

Answer

Ignore the alert because svchost.exe is a legitimate Windows process.

Answer

Kill the process and delete the file from the endpoint.

Answer

Submit the file to WildFire for analysis and wait for the verdict.

Question 5

A security engineer is investigating a Cortex XDR alert on a Windows endpoint. The alert indicates that a process attempted to create a scheduled task, which is a common persistence technique. The engineer wants to see the exact command line and parent process that initiated this action. Which Cortex XDR artifact should the engineer examine?

Accepted Answer

The Alert Details pane, which includes the process image path and command line.. The Alert Details pane is the primary interface for understanding the context of a Cortex XDR alert. It includes the process image path, command line, and parent process, which are essential for determining how a scheduled task was created. This directly provides the information the engineer needs without requiring additional queries.

Answer

The Threat Intelligence report, which provides reputation scores for files.

Answer

The Policy Audit log, which records changes to security policies.

Answer

The Endpoint Management inventory table, which lists installed agents.

Question 6

A SOC manager is reviewing alert triage metrics and notices a high number of false positives from a Cortex XDR BIOC rule. The manager wants to reduce noise without disabling the rule entirely. Which action should the SOC manager take?

Accepted Answer

Modify the BIOC rule to exclude known benign processes or users.. Tuning a BIOC rule by excluding known benign processes or users is the most effective way to reduce false positives while preserving detection for malicious behavior. It directly addresses the noise source without sacrificing security coverage, aligning with best practices for SOC alert management.

Answer

Increase the severity of the BIOC rule to prioritize it.

Answer

Create a new BIOC rule with a narrower scope.

Answer

Disable the BIOC rule and rely on other detections.

Question 7

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) for all administrator accounts. Option A is correct because enforcing Multi-Factor Authentication (MFA) for all administrator accounts adds a critical second authentication factor beyond passwords, mitigating credential theft, brute-force, and phishing attacks against Panorama's administrative logins. Option E is correct because restricting administrative access to dedicated out-of-band management networks or specific trusted IP addresses limits the attack surface by ensuring only authorized source networks can reach the management interface, blocking lateral movement and unauthorized external access. Options B, C, and D are incorrect: disabling HTTPS redirection would weaken security by allowing cleartext HTTP management sessions instead of forcing TLS-encrypted access; sharing a single superuser account destroys accountability and non-repudiation since actions cannot be attributed to individual analysts; and allowing unauthenticated HTTP management access from any internal IP exposes the management plane to eavesdropping, tampering, and unauthorized configuration changes.

Answer

Disable HTTPS redirection on the management interface

Answer

Share a single superuser account among all shift analysts to streamline shift handovers

Answer

Allow unauthenticated HTTP management access from any internal IP address

Question 8

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Accepted Answer

Persistence. Scheduled tasks and Windows Management Instrumentation (WMI) are both mechanisms that allow adversaries to maintain a foothold on a system across reboots. In MITRE ATT&CK, the Persistence tactic (TA0003) encompasses techniques like Scheduled Task/Job (T1053) and Windows Management Instrumentation Event Subscription (T1546.003), which are used to ensure continued access. These techniques are not about immediate damage, data gathering, or initial discovery, but about keeping access over time.

Answer

Impact

Answer

Collection

Answer

Reconnaissance

Question 9

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

Accepted Answer

WildFire Portal or firewall WildFire submission logs searched by file hash (SHA-256). The WildFire Portal and firewall WildFire submission logs both allow searching by file hash (SHA-256), which is the fastest way to check whether a specific sample has been analyzed across the enterprise. Searching by hash directly queries historical WildFire analysis results, matching the analyst's need.

Answer

Application Command Center (ACC) network activity tab

Answer

GlobalProtect client log exporter utility

Answer

Zone Protection event log viewer

Question 10

A SOC analyst receives an alert from Cortex XDR indicating that a user's endpoint has communicated with a known command-and-control (C2) server. The analyst verifies the alert and confirms the communication. According to the incident response process, which step should the analyst take first?

Accepted Answer

Isolate the endpoint from the network.. The correct answer is to isolate the endpoint from the network. This is the first containment step to stop communication with the C2 server and prevent further damage. Other actions like scanning or evidence collection should follow after isolation.

Answer

Collect forensic evidence from the endpoint.

Answer

Run a full antivirus scan on the endpoint.

Answer

Notify the user and ask them to disconnect from the network.

Question 11

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

Accepted Answer

Authentication Profile under Device > Authentication referencing the RADIUS server profile.. Option E is correct because the firewall must first define a RADIUS Server Profile under Device > Server Profiles > RADIUS, which specifies the RADIUS server's IP address, shared secret, port (default 1812 for authentication), and timeout/retry settings so the firewall can communicate with the external RADIUS server. Option D is correct because an Authentication Profile under Device > Authentication must be created to reference that RADIUS server profile, defining the authentication method and allowed user/group lists, and this profile is then applied to the management interface or administrative accounts to enforce RADIUS-based admin login. Option A is incorrect because an External Dynamic List is used to import IP addresses, URLs, or domains for policy enforcement, not to point to a RADIUS authentication database. Option B is incorrect because a WildFire Analysis Profile submits files to the WildFire cloud for malware analysis and has nothing to do with user authentication. Option C is incorrect because an SSL Decryption Profile is used to decrypt and inspect SSL/TLS traffic, not to authenticate administrative access on the management interface.

Answer

External Dynamic List (EDL) pointing to the RADIUS authentication database.

Answer

WildFire Analysis Profile set to authenticate users.

Answer

SSL Decryption Profile attached to the management interface.

Question 12

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. The question describes two distinct adversary behaviors: 'leveraged valid accounts to maintain persistence' and 'modifying group memberships to escalate privileges.' In MITRE ATT&CK, Valid Accounts (T1078) is explicitly categorized under both Initial Access and Persistence, while Account Manipulation (T1098) — which includes modifying group memberships — is categorized under Persistence and Privilege Escalation. Therefore, the two tactics that best describe these observed phases are Persistence and Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 13

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the best fit for zero trust because it makes access decisions based on a combination of attributes, including user identity, device health, and environmental context. This dynamic, policy-driven approach supports continuous verification and least privilege, which are core to zero trust.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 14

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore network connectivity to an isolated endpoint in Cortex XDR, the administrator goes to Endpoint Management, selects the endpoint, clicks Action, and chooses Remove Isolation. This action lifts the isolation policy and allows the endpoint to communicate on the network again. It is the standard, documented workflow after remediation is verified.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 15

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. The AWS Gateway Load Balancer (GWLB) quick start template for Palo Alto VM-Series is purpose-built to deploy the firewall in a transparent bump-in-the-wire architecture. GWLB uses GENEVE encapsulation (UDP port 6081) to forward traffic to the firewall's data interfaces, and the VM-Series decapsulates, inspects, and re-encapsulates the packet back to GWLB — no destination NAT is required because the original packet headers are preserved. This is the standard, supported deployment method documented by both AWS and Palo Alto.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.

Question 16

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

Accepted Answer

Prisma Autonomous DEM (ADEM) workspace in the Prisma Access management portal.. Prisma Autonomous DEM (ADEM) is a digital experience monitoring solution integrated with Prisma Access that provides end-to-end visibility into user experience, including path performance, latency, packet loss, and application response times. It uses synthetic agents on endpoints to continuously test and measure network conditions between users and applications, making it the correct tool for analyzing SaaS application performance issues from a branch office. ADEM's workspace in the Prisma Access management portal offers dashboards and drill-downs specifically for these metrics.

Answer

Panorama Traffic Log CSV export analyzed via spreadsheet formulas.

Answer

AWS CloudWatch Network Monitor dashboard.

Answer

WildFire Sample Analysis execution timeline graph.

Question 17

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

Accepted Answer

The file was unknown to WildFire at execution time and was subsequently sent for analysis, resulting in a retroactive verdict.. The most likely explanation is that the file was unknown to WildFire at execution time, so the local agent allowed it to run while submitting it for cloud analysis; WildFire then returned a malicious verdict, enabling retroactive blocking. This is the standard WildFire workflow: unknown files are detonated in the cloud, and the verdict is applied after analysis completes.

Answer

WildFire only analyzes network traffic passing through a Palo Alto Networks Next-Generation Firewall.

Answer

Local analysis blocks all files by default without cloud consultation.

Answer

The Cortex XDR agent does not integrate with WildFire cloud intelligence.

Question 18

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Accepted Answer

Data Filtering profile. The Data Filtering profile is specifically designed to inspect traffic for sensitive data patterns such as credit card numbers, Social Security numbers, and custom regex patterns, and to block or alert on that data leaving the network. It is the only PAN-OS security profile purpose-built for DLP-style content inspection of outbound flows. Tuning it involves defining data patterns, file types, and the action (alert, block, or forward) for each direction.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 19

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control. The repeated contacts from an endpoint to a known C2 server indicate that the attacker has established a communication channel to control the compromised system. This is the Command and Control phase of the Cyber Kill Chain, which follows installation and precedes actions on objectives. The other phases occur earlier in the attack lifecycle and do not involve active C2 traffic.

Answer

Reconnaissance

Answer

Actions on Objectives

Answer

Weaponization

Question 20

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

Accepted Answer

Define a device control rule that blocks the USB mass storage device class. A device control rule that blocks the USB mass storage device class establishes the restriction, and an exception for approved encrypted drives by vendor and product ID permits only authorized devices. Exploit protection, report-only mode, and malware profile blocklists do not enforce device access control, so they cannot satisfy the requirement.

Answer

Set the agent to report-only mode for device control

Answer

Enable the exploit protection module for USB drivers

Answer

Add the USB mass storage class to the malware profile blocklist