Cybersecurity-Practitioner Practice Exam 4 — 20 Questions

Question 1

An organization's security policy requires that any detected malware file must be automatically blocked from entering the network during download. Which security profile and action combination ensures inline prevention against known malware?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Antivirus profile with action set to 'block' for all malware types and decoders. Antivirus profiles inspect file transfers and can be configured to block known malware signatures in real-time inline.

Answer

WildFire analysis profile with file forwarding set to 'async'

Answer

Data Filtering profile configured to drop executable file extensions

Answer

URL Filtering profile configured to block malicious download categories

Question 2

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Accepted Answer

WildFire cloud-based analysis and automated signature generation. WildFire provides cloud-based automated analysis of unknown files and generates global protections within minutes without waiting for manual signature releases.

Answer

Palo Alto Networks MineMeld open-source threat intelligence

Answer

Traps Advanced Endpoint Protection cloud service

Answer

AutoFocus Context-Aware Threat Intelligence service

Question 3

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of ports, allowing administrators to restrict traffic between internal tiers (e.g., web to database) down to the specific application command.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 4

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Accepted Answer

Panorama Administrative Roles and external authentication profiles (RADIUS/TACACS+/SAML). Administrators can be authenticated via external directory services (TACACS+, RADIUS, SAML) and assigned specific Administrative Roles for RBAC.

Answer

WildFire API token generation and management

Answer

User-ID clientless mapping via Windows User-ID Agent

Answer

GlobalProtect Portal client configuration profiles

Question 5

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Accepted Answer

GlobalProtect Host Information Profiles (HIP) combined with Security policy zone and posture criteria. GlobalProtect HIP (Host Information Profile) checks endpoint security posture (OS version, disk encryption, patch level) and feeds into security policies to restrict access.

Answer

WildFire automated sandbox analysis combined with Data Filtering profiles

Answer

User-ID agent IP-to-user mapping combined with NAT translation tables

Answer

App-ID application signatures combined with URL Filtering categories

Question 6

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Zero Trust principles include verifying explicitly, using least privilege access, and assuming breach while inspecting all traffic.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance

Question 7

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Accepted Answer

HA Active/Active mode with session synchronization enabled. HA Active/Active mode allows both firewalls to process traffic simultaneously, requiring session synchronization and floating IP addresses.

Answer

Cluster mode with dynamic routing ECMP multipath load balancing

Answer

Virtual Router redundancy protocol (VRRP) standalone failover groups

Answer

HA Active/Passive mode with preemption enabled

Question 8

An organization is implementing compliance controls to ensure that employees do not upload proprietary source code to unauthorized cloud storage providers. Which security profile feature should be utilized to control and log specific file transfers within recognized cloud applications?

Accepted Answer

File Blocking profile configured to block specific application file types. File Blocking profiles can be configured to block or log the upload or download of specific file types (such as source code archives or executables) within applications.

Answer

Data Filtering profile configured with URL category exceptions

Answer

WildFire analysis profile configured for static code review

Answer

URL Filtering profile configured with Custom URL categories

Question 9

An organization's security policy mandates that all software vulnerabilities with a CVSS score above 7.0 must be blocked at the network perimeter within 24 hours of disclosure. A new zero-day vulnerability is announced. While awaiting vendor patches, how can a Palo Alto Networks administrator immediately mitigate this threat using built-in platform features?

Accepted Answer

Apply a custom Vulnerability Protection signature or update the predefined threat signature action to 'block' for the specific CVE. Administrators can update Vulnerability Protection profiles or create custom vulnerability signatures to block exploit attempts targeting the newly disclosed flaw before a vendor patch is available.

Answer

Configure a custom URL Filtering category to block the vendor advisory website

Answer

Deploy an Application Override policy to drop all traffic using the affected application port

Answer

Enable strict WildFire forwarding for all outbound DNS requests originating from the server subnet

Question 10

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). URL filtering profile categories can be assigned actions such as block, allow, alert, continue, or override.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)

Question 11

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. Zone protection or DoS Protection profiles with rate-limiting based on source IP and aggregate sessions protect against application-layer floods.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic

Question 12

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Accepted Answer

Command and Control. Command and control is the phase where an established malware or threat actor communicates with an external infrastructure to receive instructions or exfiltrate data, which matches outbound connections to a C2 IP.

Answer

Reconnaissance

Answer

Exploitation

Answer

Delivery

Question 13

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Accepted Answer

Security Profiles. Security profiles inspect data plane traffic for threats, malware, and policy violations and are collectively known as Security Profiles.

Answer

Zone Protection Profiles

Answer

Decryption Profiles

Answer

App-ID Custom Signature Objects

Question 14

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Accepted Answer

Create a Vulnerability Protection Exception for the specific threat ID, optionally restricting it to the source or destination IP. False positives in vulnerability protection can be resolved by creating a Vulnerability Protection Exception for the specific signature ID.

Answer

Disable the Vulnerability Protection profile globally across all security rules

Answer

Configure an Application Override policy for the custom API port

Answer

Delete the threat signature from the firewall's local database cache

Question 15

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Accepted Answer

GlobalProtect clientless VPN acting as a reverse proxy with SAML authentication. GlobalProtect service provider / SAML integration or Prisma Access proxy capabilities allow authentication enforcement before traffic reaches protected backend resources.

Answer

Zone Protection SYN proxy configuration

Answer

WildFire cloud analysis submission API

Answer

App-ID custom application signature generator

Question 16

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Accepted Answer

Administrator activity and authentication logs recording login timestamps and source IPs. Administrative accountability is maintained via Configuration Audit logs, Administrator Activity logs, and external authentication/RBAC.

Answer

Automated daily factory reset scripts executed on the management plane

Answer

Disabling all logging to prevent unauthorized access to log databases

Question 17

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Accepted Answer

Panorama Log Viewer / Firewall Traffic and Threat logs filtered by source IP address. Traffic logs combined with ACC (Application Command Center) or Panorama log queries allow detailed session-level forensic investigation per IP address.

Answer

Dynamic Address Group membership audit report

Answer

AutoFocus Campaign Tracker and malware family indicator list

Answer

GlobalProtect Clientless Portal connection history report

Question 18

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Accepted Answer

SQL Injection attacks. SQL injection and Cross-Site Scripting (XSS) are common application-layer web threats that can be detected by Vulnerability Protection signatures.

Answer

Fiber optic cable fiber cut

Answer

Physical server hardware power supply failure

Answer

Management plane cooling fan speed degradation

Question 19

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Accepted Answer

SSL Forward Proxy Decryption. SSL Forward Proxy decryption inspects outbound traffic to external servers by generating a forward proxy certificate on the firewall.

Answer

SSL Inbound Inspection Decryption

Answer

Kerberos Decryption Service integration

Answer

SSH Decryption Proxy mode

Question 20

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Accepted Answer

Antivirus profile. Antivirus and Vulnerability Protection profiles inspect content payloads for known malware and software exploit attempts, respectively.

Answer

Data Filtering profile

Answer

Zone Protection profile

Answer

URL Filtering profile