Cybersecurity-Practitioner Practice Test 21 — 15 Questions

Question 1

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL Decryption must be active, and the security rule must have a WildFire Analysis profile set to forward the specific file type to the WildFire cloud. For WildFire to analyze files downloaded over HTTPS, the firewall must first decrypt the traffic via an SSL Decryption policy. Then, the Security policy rule that permits the traffic must have a WildFire Analysis profile attached, and that profile must be configured to forward the specific file type (e.g., PE, PDF) to the WildFire cloud for analysis. Without both conditions, the file remains encrypted or is not forwarded, preventing WildFire from inspecting it.

Answer

The decryption policy must exempt WildFire inspection traffic to prevent performance degradation on the data plane

Answer

A custom URL Filtering profile must be applied to decrypt traffic matching the unknown-file category

Answer

The Security rule must utilize an application override to bypass App-ID processing for encrypted file transfers

Question 2

An administrator wants to configure the frequency at which the Cortex XDR agent checks in with the management server. Where is this heartbeat interval configured?

Accepted Answer

In the Agent Settings profile under Communication parameters.. The heartbeat interval for the Cortex XDR agent is a communication setting that controls how often the agent polls the management server for policy updates, telemetry uploads, and status checks. This is configured centrally in the Agent Settings profile under Communication parameters, which allows administrators to define the interval (e.g., every 5 minutes) and apply it to endpoint groups. Centralized configuration ensures consistency and avoids manual per-endpoint changes.

Answer

Directly within the local Windows registry on each endpoint.

Answer

In the Malware Prevention profile settings.

Answer

In the Global Protect Gateway configuration.

Question 3

A hospital's IT team is classifying the sensitivity of different data types to prioritize protection efforts. They label patient treatment records, real-time heart-rate monitor telemetry, and publicly published visitor parking maps. Which data classification scheme correctly reflects the risk-based handling these assets require?

Accepted Answer

Patient records and heart-rate telemetry are both Restricted, while visitor parking maps are Public.. Data classification must reflect the actual sensitivity and regulatory weight of each asset. Patient treatment records and live heart-rate telemetry are both high-impact clinical data requiring the strictest handling, while visitor parking maps are deliberately published and need no protection. This risk-based assignment ensures controls, retention, and access rules align with real impact.

Answer

Patient records are Internal, heart-rate telemetry is Restricted, and parking maps are Confidential.

Answer

Patient records are Public after patient consent, heart-rate telemetry is Internal, and parking maps are Restricted.

Answer

Patient records are Confidential, heart-rate telemetry is Public because it is only monitored internally, and parking maps are Internal.

Question 4

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script execution on a critical server. The analyst wants to determine the script's origin and whether it was executed interactively or via a scheduled task. Which Cortex XDR feature provides the most direct evidence for this determination?

Accepted Answer

Process Execution History with parent process and command-line details.. Process Execution History with parent process and command-line details directly shows the PowerShell process's parent and arguments, indicating whether it was spawned by a scheduled task or interactively. This evidence is crucial for understanding the attack vector and scope. Other features provide supporting data but do not directly answer the question of origin and execution method.

Answer

Network Connection Logs showing outbound connections from PowerShell.

Answer

File Inventory showing the PowerShell script file on disk.

Answer

Registry Monitoring for PowerShell-related registry keys.

Question 5

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

Accepted Answer

Using Captive Portal authentication to prompt unmapped users for credentials. Option C is correct because Captive Portal is a native User-ID method that intercepts HTTP/HTTPS traffic from unmapped source IPs and presents a web login page, allowing the firewall to authenticate the user and create an IP-to-username mapping in its User-ID table. Option D is correct because the Windows-based User-ID Agent can monitor Active Directory domain controllers' security event logs (e.g., 4624 logon events) and send user-to-IP mappings to the firewall, which is the standard enterprise method for identity-based policy enforcement. Option A is incorrect because App-ID custom signatures match application traffic patterns, not user identities, and do not produce IP-to-username mappings. Option B is incorrect because static IPv4-to-IPv6 NAT translation tables translate addresses between protocol versions and have nothing to do with identity mapping. Option E is incorrect because GlobalProtect clientless portal DNS proxy forwarding handles name resolution for clientless VPN access, not User-ID IP-to-username mapping.

Answer

Configuring App-ID custom signature regex patterns

Answer

Configuring static IPv4-to-IPv6 NAT translation tables

Answer

Enabling GlobalProtect clientless portal DNS proxy forwarding

Question 6

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

Accepted Answer

Zone Protection profile configured with SYN Flood protection (SYN cookies or random drop). A Zone Protection profile applied to the ingress zone is the Palo Alto Networks feature specifically designed to defend against volumetric attacks like SYN floods and reconnaissance scans. Within the profile, SYN Flood protection uses SYN cookies or random drop to absorb and mitigate half-open connection exhaustion at the ingress interface before the traffic reaches the target hosts.

Answer

WildFire inline machine learning analysis engine

Answer

User-ID syslog mapping listener service

Answer

URL Filtering profile configured with credential theft prevention

Question 7

A security team is hardening Windows endpoints managed by Cortex XDR and wants to reduce the attack surface exploited by common malware techniques. Which TWO capabilities does the Cortex XDR agent provide to restrict malicious behavior at the endpoint? (Choose two.)

Accepted Answer

Exploit protection that intercepts memory corruption attempts against vulnerable applications.. Cortex XDR restricts attacker behavior on the endpoint through Behavioral Threat protection, which blocks malicious activity chains, and Exploit protection, which mitigates memory corruption attempts against vulnerable applications. Together these enforcement modules reduce the techniques malware commonly relies on, which is the hardening outcome the team is pursuing.

Answer

Vulnerability scanning that inventories missing patches across the managed fleet.

Answer

Network-based intrusion prevention that inspects traffic at the perimeter firewall.

Answer

Full disk encryption management that secures data at rest on the endpoint drive.

Question 8

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

Accepted Answer

Communication with the Cortex XDR server and essential DNS/DHCP services.. When a Cortex XDR endpoint is isolated, all network traffic is blocked except for communication with the Cortex XDR server and essential services like DNS and DHCP. This allows the agent to continue receiving instructions and maintain connectivity for management purposes while preventing lateral movement.

Answer

All network protocols without restriction.

Answer

SMB and RDP traffic to internal domain controllers.

Answer

All outbound traffic to external internet websites via HTTPS.

Question 9

A security analyst is investigating a Windows endpoint where the Cortex XDR agent has blocked a series of suspicious process executions. The analyst wants to permanently allow a legitimate internal administrative tool that the agent keeps terminating, without weakening protection for other executables. Where should the analyst configure this exception in the Cortex XDR management console?

Accepted Answer

In the Exceptions page, by creating an exception rule that targets the Behavioral Threat protection module with the tool's process path.. Cortex XDR exceptions are applied per protection module, so the analyst must create an exception that targets Behavioral Threat protection. Scoping the exception to the specific process path stops the repeated termination of the legitimate administrative tool while leaving the module active for all other executables, which preserves the endpoint's overall protection posture.

Answer

In the Malware Protection profile under the Restriction settings, by adding the tool's hash to the allow list.

Answer

In the WildFire analysis profile, by adding the tool's file path to the benign file list so it is not detonated.

Answer

In the Agent Settings page, by disabling the Behavioral Threat protection module on the affected endpoint only.

Question 10

Which TWO actions can an administrator perform within the Prisma Cloud Cloud Security Posture Management (CSPM) console to remediate misconfigured cloud resources? (Choose two)

Accepted Answer

Execute automated single-click or automated API-driven remediation scripts for supported resource misconfigurations.. Option A is correct because Prisma Cloud CSPM supports automated remediation through one-click actions and API-driven workflows that invoke cloud provider APIs (e.g., AWS, Azure, GCP) to fix supported misconfigurations on resources such as S3 buckets or security groups. Option B is correct because the CSPM console also provides guided manual remediation, displaying step-by-step instructions and the exact CLI commands (for example, AWS CLI or Azure CLI syntax) an administrator can run to correct the resource configuration. Option C is incorrect because PAN-OS dataplane packet buffer tuning is a firewall performance setting unrelated to CSPM posture remediation. Option D is incorrect because rebooting physical branch routers is a Prisma Access networking operation, not a CSPM misconfiguration remediation action. Option E is incorrect because patching an EC2 instance's Linux kernel via SSH is host-level OS management, not a CSPM console remediation capability.

Answer

Modify the PAN-OS dataplane packet buffer allocation settings on remote VM-Series firewalls.

Answer

Reboot physical branch routers connected to Prisma Access remote networks.

Answer

Directly patch the Linux kernel version running inside an AWS EC2 instance via SSH terminal emulation.

Question 11

A cloud security architect is designing a Prisma Cloud Compute deployment to protect containers running in a Kubernetes cluster on Google Kubernetes Engine (GKE). The architect must ensure that the Defender can inspect container images and enforce runtime policies. Which component must be deployed and configured?

Accepted Answer

Prisma Cloud Compute Console with a Defender deployed as a DaemonSet on each node.. For Prisma Cloud Compute to protect containers in a Kubernetes cluster, a Defender must be deployed on each node to inspect containers and enforce runtime policies. The Console manages policies and aggregates data. Deploying the Defender as a DaemonSet ensures that every node has a Defender pod, providing comprehensive coverage. This is the standard and recommended deployment method for Kubernetes environments, including GKE.

Answer

Prisma Cloud Compute Console with a Defender deployed as a Kubernetes Job that runs periodically.

Answer

Prisma Cloud Compute Console with a Defender deployed as a sidecar container in each application pod.

Answer

Prisma Cloud Compute Defender deployed as a standalone VM outside the cluster, connecting to the Kubernetes API.

Question 12

During a Cortex XDR investigation, a SOC analyst notices that a process named 'svchost.exe' is making outbound connections to an IP address in a foreign country. The process path is 'C:\Windows\System32\svchost.exe', but the digital signature is invalid. Which Cortex XDR capability should the analyst use to determine if this is a masquerading attempt?

Accepted Answer

The process details view, which shows the process hash, signature status, and command-line arguments.. The process details view is the correct choice because it provides the digital signature status, hash, and command line of the process. An invalid signature on a System32 executable is a clear sign of masquerading. Other views like network connections or causality chain may provide context but do not directly verify the binary's authenticity.

Answer

The causality chain view, which shows the sequence of events leading to the alert.

Answer

The network connections map, which displays all active connections and associated processes.

Answer

The endpoint module list, which displays all loaded modules and their signatures.

Question 13

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

Accepted Answer

Remote Services (e.g., SMB/Windows Admin Shares, RDP). Option A, Remote Services (e.g., SMB/Windows Admin Shares, RDP), is correct because MITRE ATT&CK places it under the Lateral Movement tactic (T1021), covering techniques like using SMB/Windows Admin Shares, RDP, SSH, and VNC to log into and control remote systems across a network. Option D, Exploitation of Remote Services, is also correct because it is explicitly categorized under Lateral Movement (T1210), describing adversaries exploiting vulnerabilities in remote services such as SMB, RDP, or MSRPC to pivot into other hosts. Option B, Phishing via Spearphishing Link, belongs to the Initial Access tactic (T1566.002), not Lateral Movement. Option C, Automated Exfiltration Over C2 Channel, is an Exfiltration technique (T1020/T1041), and Option E, Steal Web Session Cookie, is a Credential Access technique (T1539), so neither fits the Lateral Movement tactic.

Answer

Phishing via Spearphishing Link

Answer

Automated Exfiltration Over C2 Channel

Answer

Steal Web Session Cookie

Question 14

A SOC analyst is investigating a Cortex XDR alert where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects credential theft but finds no evidence of malware on the user's endpoint. Which Cortex XDR capability should the analyst use to identify the source of the credential compromise?

Accepted Answer

Identity analytics. Identity analytics is the correct capability because it focuses on user behavior and authentication anomalies, which can reveal credential misuse even when the endpoint appears clean. It correlates data from various sources to detect compromised accounts and helps trace the source of the credential theft.

Answer

Network threat analytics

Answer

Endpoint behavioral threat protection

Answer

Host insights

Question 15

A security engineer is tuning a Decryption policy on a Palo Alto Networks firewall. The organization must inspect TLS traffic to a sanctioned SaaS application, but must not break sessions to a banking portal that uses certificate pinning. Which action in the Decryption policy rule should be applied to the banking portal traffic to achieve this?

Accepted Answer

Set the Decryption policy action to 'no-decrypt' for the banking portal destination, and place that rule above the decrypt rule.. Traffic must be inspected except where certificate pinning would break. A no-decrypt rule positioned above the decrypt rule matches the banking portal first, allowing the original TLS session to proceed without the firewall acting as a man-in-the-middle. This preserves pinned certificates while still decrypting the sanctioned SaaS traffic that must be inspected.

Answer

Disable SSL Forward Proxy globally in Device > Setup > Session and rely on the default decryption behavior.

Answer

Create a Security policy rule that blocks the banking portal application so the pinned certificate is not intercepted.

Answer

Set the Decryption policy action to 'decrypt' and enable the 'Forward Proxy' option for the banking portal destination.