Cybersecurity-Practitioner Practice Exam 3 — 20 Questions

Question 1

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Actions on Objectives (exfiltrating data or lateral movement across internal zones). The Cyber Kill Chain phases involving active network traffic where firewalls play a role include Delivery, Command and Control, and Actions on Objectives (Exfiltration).

Answer

Reconnaissance (researching target organization via public social media without direct network interaction)

Answer

Weaponization (coupling an exploit with a backdoor in the attacker's offline lab environment)

Question 2

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect traffic for predefined or custom patterns (such as credit card numbers or social security numbers) and can block or log the transfer.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 3

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Accepted Answer

AutoFocus threat intelligence service. AutoFocus provides contextual threat intelligence derived from WildFire and other sources, allowing analysts to search threat groups, campaigns, and TTPs.

Answer

Panorama Log Collector forwarding engine

Answer

Application Command Center (ACC) dashboard

Answer

GlobalProtect Host Information Profile (HIP) engine

Question 4

Which TWO methods can be used to authenticate remote users connecting to Prisma Access via GlobalProtect? (Choose two)

Accepted Answer

LDAP or RADIUS authentication profiles configured via the Cloud Identity Engine or local firewalls.. Prisma Access supports multiple authentication methods including SAML 2.0 Identity Providers (IdPs) and LDAP/RADIUS directories via Cloud Identity Engine or explicit authentication profiles.

Answer

Physical USB smartcard hardware serial number validation via local PAN-OS USB ports on user laptops.

Answer

Plaintext HTTP Basic Authentication embedded in URL parameters.

Answer

Static MAC address whitelisting on enterprise Wi-Fi routers.

Question 5

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

Accepted Answer

Inline Machine Learning analysis that evaluates web traffic and categorizes Newly Registered Domains (NRDs) in real-time.. Advanced URL Filtering uses inline machine learning to analyze web traffic and categorize newly registered domains (NRDs) instantly.

Answer

GlobalProtect endpoint registry checks for browser history.

Answer

Client-side proxy PAC file lookups against local browser blocklists.

Answer

Static URL database updates downloaded from Panorama once every 24 hours.

Question 6

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

Accepted Answer

Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.. Prisma Cloud provides a Bridgecrew IaC scanner integrated as a GitHub Action or VCS integration to scan templates during the pull request phase.

Answer

Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.

Answer

Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.

Answer

Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.

Question 7

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

Accepted Answer

Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.. Prisma Cloud Cloud Security Posture Management (CSPM) evaluates resource configurations against compliance standards and policies in the Investigate or Alerts tab.

Answer

Navigate to Panorama > Cloud Services > Native Security to update IAM roles.

Answer

Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.

Answer

Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.

Question 8

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

Accepted Answer

Enable Source NAT (SNAT) on the VM-Series firewall untrust/trust interface policies so return traffic flows back through the active firewall IP.. Azure Standard Load Balancer supports HA ports and SNAT, but inbound asymmetric traffic routed via user-defined routes (UDRs) requires careful load balancer configuration or floating IP (Direct Server Return) considerations, or utilizing Azure Gateway Load Balancer. For standard load balancers with firewalls, SNAT is typically enabled on the load balancer or firewall to maintain flow symmetry.

Answer

Configure Azure ExpressRoute Global Reach to bypass the Azure Load Balancer entirely.

Answer

Deploy an Azure Bastion host to proxy all inbound administrative and application sessions.

Answer

Configure an Azure Application Gateway in front of the Standard Load Balancer to perform Layer 7 proxying.

Question 9

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

Accepted Answer

Prisma Autonomous DEM (ADEM) workspace in the Prisma Access management portal.. Autonomous DEM (ADEM) provides end-to-end digital experience monitoring from the endpoint or branch network to SaaS applications.

Answer

Panorama Traffic Log CSV export analyzed via spreadsheet formulas.

Answer

AWS CloudWatch Network Monitor dashboard.

Answer

WildFire Sample Analysis execution timeline graph.

Question 10

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. AWS GWLB uses Geneve encapsulation on port 6081 to securely exchange traffic between the GWLB and the VM-Series firewalls, allowing transparent inline inspection without SNAT/DNAT.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.

Question 11

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Accepted Answer

URL Filtering profile configured with Credential Theft Prevention settings. URL Filtering profiles include Credential Theft Prevention features that inspect HTTP submissions against corporate credential settings.

Answer

Data Filtering profile configured for credit card pattern matching

Answer

Vulnerability Protection profile with HTTP header inspection

Answer

Anti-Spyware profile configured with DNS sinkholing

Question 12

An organization wants to inspect east-west traffic between different microservices running inside an Amazon Elastic Kubernetes Service (EKS) cluster using VM-Series firewalls. Which architectural pattern is recommended?

Accepted Answer

Route inter-subnet pod traffic through VM-Series firewall interfaces using AWS VPC route tables and secondary IP configurations.. East-west inspection in Kubernetes or public cloud environments is typically handled by container-native controls or by routing inter-subnet traffic through VM-Series firewalls acting as gateway routers using AWS Transit Gateway or custom routing tables.

Answer

Deploy Panorama as a sidecar container inside every Kubernetes pod namespace.

Answer

Attach the Prisma Access remote network VPN gateway directly to the Kubernetes cgroup filesystem.

Answer

Configure AWS Route 53 to proxy all TCP traffic between pods.

Question 13

An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?

Accepted Answer

Integrate the Prisma Cloud Compute CI/CD scanner plugin into the pipeline to block builds containing critical vulnerabilities.. Prisma Cloud Compute provides CI/CD scanner plugins (Jenkins, GitLab, GitHub Actions, etc.) that evaluate container images during the build phase and fail the build if vulnerabilities exceed a specified threshold.

Answer

Configure an AWS CloudWatch alarm to trigger a Lambda function that deletes the ECR registry repository.

Answer

Enable Prisma Access Threat Prevention on the CI/CD runner network interface.

Answer

Configure Prisma Cloud CSPM to automatically revoke AWS IAM credentials for the CI/CD builder.

Question 14

An administrator is configuring a secure IPsec VPN tunnel between an on-premises Palo Alto Networks firewall and a Prisma Access Remote Networks mobile gateway. During negotiation, Phase 2 fails. Where should the administrator check to view detailed IKE and IPsec negotiation error messages?

Accepted Answer

Run the CLI command `tail follow yes mp-log ikemgr.log` or check the System and GlobalProtect logs in Panorama/Firewall.. IPsec VPN troubleshooting on Palo Alto Networks firewalls is performed using the CLI command `tail follow yes mp-log ikemgr.log` or through the System > Logs > System/GlobalProtect or CLI operational commands.

Answer

Review the AWS VPC Flow Logs in the Amazon CloudWatch console.

Answer

Navigate to Prisma Cloud Compute > Monitor > Audit logs.

Answer

Open the WildFire submission report for the crypto module hash.

Question 15

Which TWO metrics or features are provided by Prisma Autonomous DEM (ADEM) to troubleshoot remote user application performance issues? (Choose two)

Accepted Answer

Synthetic test monitoring that periodically simulates user interactions and application access from remote locations.. ADEM provides synthetic testing (scripted user actions) and real-user monitoring (capturing device metrics, Wi-Fi, CPU, and network path latency).

Answer

Automated quarantine of infected container workloads in public cloud Kubernetes clusters.

Answer

Direct decryption and viewing of private banking user passwords traversing HTTPS sessions.

Answer

Automated firmware flashing for branch office switch hardware.

Question 16

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

Accepted Answer

Panorama Centralized Management. Panorama provides centralized management for both physical and virtual (VM-Series and CN-Series) firewalls across multi-cloud and on-prem environments.

Answer

AWS Systems Manager Parameter Store

Answer

Prisma Access Cloud Management Portal (CMP) for Remote Networks only.

Answer

Prisma Cloud Compute Console

Question 17

An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)

Accepted Answer

Advanced URL Filtering. Prisma Access natively integrates Advanced WildFire for malware analysis and Advanced URL Filtering / Advanced Threat Prevention for threat inspection.

Answer

Azure Sentinel Log Forwarder

Answer

AWS GuardDuty Threat Intelligence Exporter

Answer

Google Cloud Chronicle SIEM Connector

Question 18

Which TWO actions can an administrator perform within the Prisma Cloud Cloud Security Posture Management (CSPM) console to remediate misconfigured cloud resources? (Choose two)

Accepted Answer

Execute automated single-click or automated API-driven remediation scripts for supported resource misconfigurations.. Prisma Cloud CSPM allows administrators to view remediation CLI scripts, execute automated API remediation, or integrate with ticketing/SOAR tools.

Answer

Modify the PAN-OS dataplane packet buffer allocation settings on remote VM-Series firewalls.

Answer

Reboot physical branch routers connected to Prisma Access remote networks.

Answer

Directly patch the Linux kernel version running inside an AWS EC2 instance via SSH terminal emulation.

Question 19

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

Accepted Answer

Zone Protection profile configured with SYN Flood protection (SYN cookies or random drop). Zone Protection profiles include defenses against TCP SYN floods, port scans, and other layer 3/4 network attacks.

Answer

WildFire inline machine learning analysis engine

Answer

User-ID syslog mapping listener service

Answer

URL Filtering profile configured with credential theft prevention

Question 20

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID integrates the firewall with enterprise directory services to map IP addresses to usernames, enabling policy enforcement based on user and group identity.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud