Cybersecurity-Practitioner Practice Test 23 — 15 Questions

Question 1

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

Accepted Answer

The application risk level (ranging from 1 to 5). Option A is correct because the App-ID engine assigns each identified application a risk level on a scale of 1 to 5, which helps security teams assess how dangerous the detected traffic is. Option E is correct because App-ID identifies and reports the specific application name, such as 'ssl', 'zoom-video', or 'ms-office-365', rather than relying only on port or protocol. These two data points—application identity and risk—are core outputs of App-ID for every recognized session. Option B is incorrect because BIOS versions of client workstations are not part of firewall App-ID session data. Option C is incorrect because chassis ambient temperature is hardware telemetry, not application identification. Option D is incorrect because App-ID does not provide the destination server's physical MAC address as a session identification attribute.

Answer

The exact BIOS version of the client workstation

Answer

The ambient room temperature of the firewall chassis hardware

Answer

The physical MAC address of the destination server

Question 2

An administrator is deploying Cortex XDR agents to a large fleet of Windows servers. A small subset of servers runs a legacy application that the Behavioral Threat protection module repeatedly terminates. The administrator wants to keep the module active on these servers but stop the false positives, and must ensure the exception is applied before the application runs again. What is the most appropriate approach?

Accepted Answer

Create a Behavioral Threat protection exception scoped by the legacy application's file path and signer, then verify the policy was applied on the endpoints.. The false positives come from Behavioral Threat protection, so the exception must target that module. Scoping it by the legacy application's path and signer limits the allowance to that binary while keeping the module active for all other processes, and verifying policy application ensures the exception is enforced before the application runs again.

Answer

Add the legacy application's hash to the Malware protection allow list and wait for the next content update to propagate.

Answer

Disable the legacy application's auto-start service and restart it manually after the exception is created.

Answer

Move the affected servers into a separate policy group with Behavioral Threat protection set to report-only mode.

Question 3

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server. The administrator wants to allow only HTTP and HTTPS traffic to the server from the internet while blocking all other inbound traffic. Which type of security policy rule should be created to achieve this?

Accepted Answer

A rule with source zone 'Untrust' and destination zone 'DMZ', application 'web-browsing' and 'ssl', action 'allow'. To allow only HTTP and HTTPS from the internet to an internal web server, the rule must have source zone Untrust and destination zone DMZ, with applications web-browsing and ssl, and action allow. This restricts inbound traffic to the necessary services. The implicit deny will block all other traffic. Other options either reverse the zones or allow too many applications.

Answer

A rule with source zone 'DMZ' and destination zone 'Untrust', application 'web-browsing' and 'ssl', action 'allow'

Answer

A rule with source zone 'Untrust' and destination zone 'DMZ', application 'any', action 'allow'

Answer

A rule with source zone 'Trust' and destination zone 'Untrust', application 'any', action 'allow'

Question 4

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

Accepted Answer

Change the exploit protection behavior for the specific technique to 'Report' instead of 'Terminate'.. Changing the exploit protection action for the specific technique from 'Terminate' to 'Report' allows the browser plugin to continue running while Cortex XDR logs the exploit attempt, giving the administrator visibility into whether the crash is actually caused by that protection rule. This is the surgical approach: it isolates the offending rule without weakening the rest of the exploit protection profile or disabling memory protection entirely.

Answer

Add the browser executable path to the OS exclusions list in Cortex XDR.

Answer

Disable memory protection features globally in the agent settings profile.

Answer

Enable Agent Self-Protection to prevent local interference.

Question 5

When setting up Prisma Access Mobile Users, what is the recommended client software installed on end-user laptops to establish secure connections to the cloud security processing nodes?

Accepted Answer

GlobalProtect app. GlobalProtect is Palo Alto Networks' endpoint client software that establishes secure connections from end-user laptops to Prisma Access Mobile Users cloud security processing nodes. It provides the VPN/ZTNA tunnel, enforces security policy, and integrates with Prisma Access for user-based policy enforcement. This is the standard and recommended client for Prisma Access Mobile Users deployments.

Answer

Panorama Admin Agent

Answer

Prisma Cloud Defender Agent

Answer

Prisma Access CLI Client

Question 6

A SOC team is using Cortex XDR to monitor for credential dumping attempts. They want to create a BIOC (Behavioral Indicator of Compromise) rule that detects when a process attempts to access the memory of lsass.exe. Which field combination should they use in the BIOC rule to specifically detect this behavior?

Accepted Answer

action = 'process memory read' AND target_process_name = 'lsass.exe'. Credential dumping from LSASS typically involves reading its memory to extract plaintext passwords or hashes. The BIOC rule must specify the memory read action and target lsass.exe to accurately detect such behavior. Other actions like write, process create, or file read do not align with the technique and would fail to identify the threat.

Answer

action = 'file read' AND target_process_name = 'lsass.exe'

Answer

action = 'process memory write' AND target_process_name = 'lsass.exe'

Answer

action = 'process create' AND target_process_name = 'lsass.exe'

Question 7

A security engineer is configuring Prisma Cloud Compute to protect containers in a Kubernetes cluster. The engineer wants to enforce runtime protection that prevents containers from executing unauthorized binaries. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Deploy a Defender DaemonSet on each node in the cluster. To enforce runtime protection that prevents containers from executing unauthorized binaries, a Defender DaemonSet must be deployed on each node to monitor and enforce policies, and a runtime policy must be created to define which binaries are blocked. The Defender enforces the policy at the kernel level, while the policy provides the rules. Together, they enable blocking of unauthorized process execution in containers.

Answer

Configure a host-based firewall rule to deny outbound traffic from containers

Answer

Enable audit mode to log all process executions without blocking

Answer

Enable the Kubernetes admission controller to block non-compliant pods

Question 8

Which TWO benefits are achieved by integrating Prisma Cloud with cloud provider audit logs (such as AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs)? (Choose two)

Accepted Answer

Ability to perform forensic investigations to track which user or IAM role performed specific resource modifications.. Option C is correct because ingesting cloud provider audit logs (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs) gives Prisma Cloud a record of API calls with identity context, so investigators can attribute resource modifications to a specific user, IAM role, or service principal for forensic analysis. Option D is correct because those same audit log streams feed Prisma Cloud's behavioral analytics and UEBA engine, enabling real-time detection of suspicious API activity and anomalous user behavior across the cloud environment. Option A is wrong because kernel-level OS patching is a host/vulnerability-management function, not something achieved by consuming cloud audit logs. Option B is wrong because hardware-level TLS encryption acceleration is a data-plane capability of VM-Series firewalls, unrelated to audit log integration. Option E is wrong because load balancing across availability zones is handled by cloud load balancers, not by Prisma Cloud audit log ingestion.

Answer

Automatic kernel-level patching of vulnerable operating systems inside cloud virtual machines.

Answer

Hardware-level encryption acceleration for TLS traffic traversing VM-Series firewalls.

Answer

Automated load balancing of inbound web traffic across multiple availability zones.

Question 9

An organization uses Prisma Cloud Compute to protect containers running in a Kubernetes cluster. A security engineer needs to ensure that a container image cannot run if it contains a critical vulnerability, but the team still wants developers to be able to deploy the image to a staging namespace for testing. Which Prisma Cloud Compute capability should the engineer configure to meet both requirements?

Accepted Answer

Admission control with a rule scoped to the production namespace. Admission control in Prisma Cloud Compute intercepts workload creation requests and can deny them when the image violates a vulnerability policy. Scoping the rule to the production namespace enforces the restriction only where required, while staging remains open for developer testing. This provides a pre-deployment gate that runtime policies and host scans cannot deliver, directly satisfying both the security and testing requirements.

Answer

Host vulnerability scan scheduled against the Kubernetes nodes

Answer

Runtime policy with a rule that blocks the process after deployment

Answer

Compliance benchmark for the Kubernetes CIS distribution

Question 10

A security team wants Cortex XDR to automatically terminate a process and quarantine the associated file when a known ransomware behavior is detected on an endpoint, without requiring analyst intervention. Which policy setting must be enabled to achieve automatic response?

Accepted Answer

Configure the behavioral threat protection module with the 'Block and terminate' action. Configuring the behavioral threat protection module with the block-and-terminate action is correct because Cortex XDR can automatically terminate a malicious process and quarantine its file upon detecting known ransomware behavior. Block mode on a malware profile only prevents execution, report-only mode takes no action, and allow-listing the hash would permit the threat, so none of those meet the automatic response requirement.

Answer

Enable the malware profile in block mode

Answer

Add the ransomware hash to the allow list

Answer

Set the agent to report-only mode for behavioral threats

Question 11

A security operations center (SOC) receives an alert that a user's workstation is communicating with a known command-and-control (C2) server. The analyst checks the firewall logs and sees that the traffic is allowed because it uses TCP port 443 and the destination IP is not on any blocklist. The analyst wants to quickly determine whether this is a false positive or a real compromise. Which of the following is the MOST appropriate next step to validate the alert?

Accepted Answer

Check the reputation of the destination IP address and domain using threat intelligence sources.. The correct answer is to check the reputation of the destination IP and domain using threat intelligence. This directly addresses whether the communication is likely malicious, given that the traffic was allowed. Threat intelligence provides context about the IP/domain, enabling the analyst to quickly classify the alert as true or false positive without disrupting operations.

Answer

Review the workstation's DNS query logs to see if the domain resolves to the same IP.

Answer

Immediately isolate the workstation from the network to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the workstation to check for malware.

Question 12

A company's risk management framework requires multi-factor authentication (MFA) for all remote access connections. The organization utilizes GlobalProtect for remote workers. Where should the administrator configure the authentication profile to enforce MFA during the GlobalProtect connection phase?

Accepted Answer

Within the GlobalProtect Portal and Gateway configurations referencing an Authentication Profile tied to an MFA provider. In Palo Alto Networks GlobalProtect, MFA is enforced by attaching an Authentication Profile (which references an MFA provider such as RADIUS, SAML, or LDAP with OTP) to the GlobalProtect Portal and/or Gateway configuration. The portal authenticates users to download the client and configuration; the gateway authenticates the tunnel. Configuring the profile in both places ensures MFA is required at connection time.

Answer

Via the Decryption policy rule pointing to an external LDAP server

Answer

Through the App-ID custom signature editor

Answer

Inside the Zone Protection profile attached to the external untrusted zone interface

Question 13

Which THREE security modules are included as core components of the Cortex XDR agent architecture? (Choose three)

Accepted Answer

Behavioral Threat Protection (BTP) module. The Cortex XDR agent architecture includes the Behavioral Threat Protection (BTP) module (A), which analyzes process behavior and chains of events locally to detect and block malicious activity such as ransomware and fileless attacks. The Exploit Prevention module (C) is also a core component, protecting endpoints against exploitation of software vulnerabilities by techniques like memory corruption and ROP, independent of signature updates. The Anti-Malware prevention module (E) is likewise core, providing signature- and heuristic-based scanning and blocking of known and unknown malware on the endpoint. Options B and D are incorrect because an Enterprise BGP Routing protocol daemon and a Stateful Packet Inspection Firewall core routing engine are network infrastructure functions, not components of the Cortex XDR endpoint agent.

Answer

Enterprise BGP Routing protocol daemon

Answer

Stateful Packet Inspection Firewall core routing engine

Question 14

A Cortex XDR administrator wants to ensure that endpoints can continue to receive updated threat signatures and policy changes even when they are roaming outside the corporate network. Which agent capability supports this requirement?

Accepted Answer

Direct communication with the Cortex XDR cloud service over the internet. Direct communication with the Cortex XDR cloud service over the internet enables roaming endpoints to receive signature and policy updates without relying on corporate network access. Local caching, manual cytool imports, and internal WSUS synchronization do not provide automatic updates for endpoints outside the corporate perimeter, so they fail to meet the requirement.

Answer

Local analysis with cached signatures only

Answer

Manual signature import via the cytool utility

Answer

Scheduled synchronization through an internal WSUS server

Question 15

A SOC analyst at a financial institution receives a high-severity alert from Cortex XDR indicating that a user's workstation executed a PowerShell script that downloaded and ran a file from a known malicious IP. The analyst wants to immediately contain the endpoint to prevent lateral movement, but must preserve forensic evidence. Which action should the analyst take first?

Accepted Answer

Isolate the endpoint from the network using the Cortex XDR isolate endpoint action.. The correct action is to isolate the endpoint using Cortex XDR's isolation capability. This immediately severs network connectivity while preserving the endpoint's state, including memory and running processes, which are essential for forensic analysis. Shutting down, scanning, or disabling the user account do not achieve immediate containment while preserving evidence.

Answer

Run a full antivirus scan on the endpoint to remove the malware.

Answer

Disable the user's Active Directory account to prevent further access.

Answer

Shut down the endpoint to stop any malicious processes.