Cybersecurity-Practitioner Practice Test 22 — 15 Questions

Question 1

A security administrator is reviewing traffic logs on a Palo Alto Networks firewall and notices that a large volume of sessions from the internal network is matching a Security policy rule that permits any application on any port. The administrator wants to reduce the attack surface by ensuring that only specific applications are allowed, even when they use non-standard ports. Which feature should the administrator implement to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

App-ID with application filters and Security policy rules that allow only the required applications.. App-ID identifies applications regardless of port, protocol, or encryption, so it enforces the actual application rather than the port. By creating Security policy rules that allow only the necessary applications, the administrator ensures that even if a non-standard port is used, only sanctioned applications are permitted. This directly reduces the attack surface by preventing unknown or unwanted applications from traversing the firewall.

Answer

Decryption policies that inspect SSL/TLS traffic for threats.

Answer

Service objects that define the exact TCP and UDP ports used by the applications.

Answer

URL Filtering profiles that block categories of websites.

Question 2

A security operations team is using Prisma Cloud Compute to protect containers in a Kubernetes cluster. They want to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked. Which Prisma Cloud Compute feature should they configure to enforce this requirement?

Accepted Answer

Admission Control. Prisma Cloud Compute Admission Control integrates with the Kubernetes API server to evaluate pod creation requests against configured policies. By defining rules that allow only approved images, it can block unapproved images from being deployed. This is the correct feature for enforcing image admission policies in a Kubernetes environment.

Answer

Vulnerability Management

Answer

Compliance Management

Answer

Runtime Defense

Question 3

A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?

Accepted Answer

Collect and analyze the process hash, parent process, and network connection details to validate the alert.. The correct first step in incident response is to validate the alert by collecting and analyzing relevant artifacts. The suspicious process path and network connection require investigation to determine if they indicate malicious activity. This aligns with the 'identification' phase of the incident response lifecycle, ensuring that containment and remediation are based on confirmed threats.

Answer

Escalate the alert to the incident response team without further investigation.

Answer

Isolate the endpoint from the network to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the endpoint to remove any potential malware.

Question 4

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Accepted Answer

Security Profiles. Security Profiles are the collective set of configurable inspection modules — Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis — that are attached to a Security policy rule to enforce content inspection on allowed traffic. They define what the firewall scans for and what action to take (alert, block, reset) once a session matches the rule.

Answer

Zone Protection Profiles

Answer

Decryption Profiles

Answer

App-ID Custom Signature Objects

Question 5

A security administrator is configuring a Palo Alto Networks firewall to protect against brute force attacks on the management interface. The administrator wants to limit the number of failed login attempts and automatically block the source IP after a threshold is reached. Which configuration should be implemented?

Accepted Answer

Enable the 'Brute Force Protection' feature under Device > Setup > Management and configure the failure threshold and block duration.. The built-in Brute Force Protection feature on Palo Alto Networks firewalls specifically addresses failed management login attempts. By enabling it under Device > Setup > Management, administrators can set thresholds and block durations. This natively blocks source IPs after repeated failures, providing effective protection without external dependencies.

Answer

Configure a Zone Protection profile with a 'Reject' action for SYN flood attacks and apply it to the management zone.

Answer

Create an Authentication profile that locks the account after three failed attempts and apply it to all administrative accounts.

Answer

Create a Security policy rule that blocks traffic from the source IP after multiple failed attempts, using a Dynamic Address Group.

Question 6

A security analyst is investigating an alert from Prisma Cloud Compute indicating that a container in a Kubernetes cluster attempted to write to the host filesystem. The analyst needs to determine which container image and which node were involved. Which Prisma Cloud Compute component provides this runtime visibility?

Accepted Answer

The Prisma Cloud Compute Console, which aggregates runtime events and shows the image, container, and host associated with the event.. Runtime events in Prisma Cloud Compute are detected by the Defender on the host and reported to the Console, which aggregates them and provides context such as the container image, container, and node. The admission controller and registry scanner operate at admission and image analysis stages, and the Defender alone is not the investigation interface. The Console is where the analyst correlates the alert to the image and node.

Answer

The Prisma Cloud Compute Defender, which stores the event locally on the node and exposes it through the node's audit log.

Answer

The Prisma Cloud Compute admission controller, which logs the image and node for every pod that passes admission.

Answer

The Prisma Cloud Compute registry scanner, which records which nodes pulled the image and when.

Question 7

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Accepted Answer

AutoFocus threat intelligence service. AutoFocus is Palo Alto Networks' threat intelligence service that aggregates WildFire, Unit 42, and third-party intel, letting analysts research TTPs, threat actors, and campaigns by industry sector. It provides contextual threat hunting through tags, actors, campaigns, and malware families, and correlates them with the organization's own telemetry. This is the correct tool for understanding sector-specific threat exposure and TTPs.

Answer

Panorama Log Collector forwarding engine

Answer

Application Command Center (ACC) dashboard

Answer

GlobalProtect Host Information Profile (HIP) engine

Question 8

A security operations analyst is investigating asymmetric routing through a Palo Alto Networks firewall. Return traffic from an external server arrives on a different interface than the interface that forwarded the original outbound request. Which firewall behavior should the analyst expect to see, and what is the appropriate mitigation?

Accepted Answer

The firewall drops the return traffic because the session lookup fails; the mitigation is to enable asymmetric routing support by disabling strict TCP sequence checking and ensuring both paths traverse the same firewall.. Asymmetric routing can cause return packets to arrive on an interface where the firewall cannot match them to the existing session, leading to drops. Allowing asymmetric routing by disabling strict TCP sequence checking, and ensuring both directions traverse the same firewall, restores session matching so the return traffic is processed correctly.

Answer

The firewall forwards the return traffic without inspection because it is stateful; the mitigation is to enable packet buffer protection on the ingress interface.

Answer

The firewall automatically creates a new session for the return path and forwards it; the mitigation is to enable jumbo frames on both interfaces.

Answer

The firewall performs Network Address Translation on the return traffic and drops it; the mitigation is to disable NAT on the egress interface.

Question 9

Which TWO platforms are officially supported for deploying the Cortex XDR Agent? (Choose two)

Accepted Answer

Apple macOS endpoints.. Option B (Apple macOS endpoints) is correct because the Cortex XDR agent officially supports macOS (e.g., macOS 10.15 Catalina and later Intel/Apple Silicon builds), allowing endpoint protection, EDR telemetry, and policy enforcement on Mac workstations. Option C (Microsoft Windows workstations and servers) is correct because the agent officially supports Windows client and server editions (such as Windows 10/11 and Windows Server 2016/2019/2022), which are core supported platforms for Cortex XDR deployment. The unmarked options do not belong: personal gaming consoles (A) run closed console OSes with no supported agent package, legacy 1980s mainframe operating systems (D) are not supported endpoint platforms, and consumer smart home IoT routers (E) run embedded proprietary firmware that cannot host the Cortex XDR agent.

Answer

Personal gaming consoles.

Answer

Legacy mainframe operating systems from the 1980s.

Answer

Consumer smart home IoT routers running embedded proprietary firmware.

Question 10

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

Accepted Answer

Enable Source NAT (SNAT) on the VM-Series firewall untrust/trust interface policies so return traffic flows back through the active firewall IP.. In Azure, when a VM-Series firewall is placed behind an Azure Standard Load Balancer (which is a Layer 4, flow-based load balancer), return traffic from backend VMs may bypass the firewall because Azure's SDN uses flow symmetry based on the original 5-tuple. Enabling Source NAT (SNAT) on the VM-Series firewall ensures that outbound/return traffic is rewritten with the firewall's IP as the source, forcing the return path back through the same firewall instance. This maintains stateful inspection and prevents asymmetric routing, which would otherwise cause the firewall to drop packets due to incomplete session state.

Answer

Configure Azure ExpressRoute Global Reach to bypass the Azure Load Balancer entirely.

Answer

Deploy an Azure Bastion host to proxy all inbound administrative and application sessions.

Answer

Configure an Azure Application Gateway in front of the Standard Load Balancer to perform Layer 7 proxying.

Question 11

An analyst investigating an APT campaign notes that the threat group modified Windows registry run keys to maintain persistence. In the context of MITRE ATT&CK, under which Tactic should this specific technique be documented?

Accepted Answer

Persistence. Modifying Windows registry run keys to maintain persistence is a technique categorized under the Persistence tactic in MITRE ATT&CK. Persistence tactics cover techniques adversaries use to keep access to systems across restarts, changed credentials, and other interruptions. Registry Run keys (T1547.001) are a classic persistence mechanism.

Answer

Impact

Answer

Execution

Answer

Credential Access

Question 12

A SOC analyst receives a Cortex XDR alert indicating that a process attempted to write to a protected system directory. The analyst wants to quickly gather all related events, including file modifications, registry changes, and network connections, to understand the full scope. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident investigation view. The Incident Investigation view is purpose-built to aggregate all telemetry associated with an incident, presenting a unified timeline and event details. This enables the analyst to quickly assess the full impact, including file, registry, and network activities, without manual correlation.

Answer

Dashboard and reporting module

Answer

Threat Intelligence platform

Answer

Query Builder with XQL

Question 13

An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?

Accepted Answer

QoS must be explicitly enabled on the egress Layer 3 interface settings with configured guaranteed and maximum bandwidth limits.. In PAN-OS, a QoS profile defines the classes and their bandwidth guarantees/limits, but it does nothing until QoS is enabled on the egress Layer 3 interface and the interface is configured with guaranteed and maximum egress bandwidth. Without that interface-level enablement, packets are never placed into the QoS classes defined by the profile, which explains why VoIP traffic still suffers latency despite the profile being attached to security rules.

Answer

The firewall requires an active Advanced URL Filtering license to classify VoIP packets.

Answer

GlobalProtect VPN tunnels must be configured in full-tunnel mode to preserve QoS headers.

Answer

An Application Override policy must be created to bypass App-ID processing for VoIP streams.

Question 14

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by long-term, human-driven operations with a specific mission: they maintain persistence, use custom or tailored tooling, and exfiltrate data slowly to avoid detection. The combination of custom C2, low-and-slow exfiltration, and living-off-the-land binaries reflects a methodical, targeted adversary rather than automated commodity malware. This matches the defining traits of an APT: persistence, targeting, and human direction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals

Question 15

A security architect is designing a network segmentation strategy using Palo Alto Networks firewalls. The design must limit lateral movement and enforce least privilege between internal tiers. Which TWO practices support this goal? (Choose two.)

Accepted Answer

Place each application tier in its own security zone and permit only the specific interzone flows required between tiers.. Effective segmentation requires distinct zones per tier and explicit least-privilege interzone rules, plus Security profiles on the permitted flows to inspect allowed traffic. Together these limit how far an attacker can move and reduce the chance that an allowed connection is abused, directly supporting the stated design goal.

Answer

Assign all servers to a single flat zone and rely on host-based firewalls for segmentation.

Answer

Disable logging on interzone rules to reduce management overhead.

Answer

Create a broad intrazone allow rule for all internal zones to simplify administration.