Cybersecurity-Practitioner Practice Test 2 — 25 Questions

Question 1

A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

App-ID. App-ID identifies applications regardless of port, protocol, or encryption, using signatures and behavioral analysis. This allows the engineer to create policies based on applications rather than ports, ensuring accurate identification and control of applications using non-standard ports. Port-based rules, SSL decryption, and User-ID do not provide this capability on their own.

Answer

SSL decryption

Answer

Port-based rules

Answer

User-ID

Question 2

An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?

Accepted Answer

Device > Dynamic Updates. In PAN-OS, the installation schedule for dynamic updates (Antivirus, WildFire, etc.) is configured under Device > Dynamic Updates. This section allows administrators to set when downloaded updates are installed, separate from the download schedule. If updates download but do not install, the installation schedule settings here need to be verified.

Answer

Policies > Management

Answer

Device > Setup > Management > Software

Answer

Objects > Certificates

Question 3

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Option A is correct because Zero Trust identity requires strong authentication such as MFA combined with continuous, risk-based adaptive validation, meaning access decisions are re-evaluated based on signals like user behavior, location, and device health rather than granted once at login. Option C is correct because Zero Trust enforces least-privilege access, granting only the minimum permissions needed and dynamically scoping them to user role, device posture, and contextual factors such as time and location. Option B is incorrect because permanent administrative access after a one-time compliance check violates Zero Trust's continuous verification and least-privilege principles. Option D is incorrect because implicitly trusting traffic from a corporate VPN contradicts the Zero Trust tenet of never trusting based on network location. Option E is incorrect because bypassing authentication for internal applications, even from managed assets, undermines the requirement to authenticate and authorize every access request.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 4

An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?

Accepted Answer

Authentication. Authentication is the IAM function that verifies a claimed identity by validating credentials such as passwords, MFA tokens, or SAML assertions. In a SAML 2.0 flow, the Okta Identity Provider authenticates the user and issues a signed assertion that Prisma Cloud (the Service Provider) trusts. Authorization, by contrast, determines what the authenticated user is permitted to do.

Answer

Authorization

Answer

Auditing

Answer

Accounting

Question 5

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

Accepted Answer

Utilization of stealthy techniques designed to evade standard security monitoring tools. Option B is correct because APT actors prioritize operational security, employing stealthy techniques such as living-off-the-land binaries (LOLBins), fileless malware, and encrypted C2 channels specifically to evade EDR, SIEM, and other standard monitoring tools. Option C is correct because APTs typically build or acquire bespoke command-and-control infrastructure (e.g., custom implants, domain fronting, or victim-specific redirectors) tailored to the target's environment, rather than using commodity tooling that defenders can easily signature. Option E is correct because the defining characteristic of an APT is the 'persistent' element: adversaries establish long-term footholds using mechanisms like scheduled tasks, WMI subscriptions, or registry Run keys, maintaining access for months or years to conduct espionage or lateral movement. Option A is incorrect because exclusive reliance on public pentest scripts describes commodity or script-kiddie activity, whereas APTs develop or purchase custom exploits and zero-days. Option D is incorrect because short dwell times and noisy, aggressive encryption describe ransomware or smash-and-grab operations, not the low-and-slow, stealthy, long-dwell behavior of APTs.

Answer

Exclusive reliance on publicly available penetration testing scripts

Answer

Short dwell times with aggressive, noisy data encryption

Question 6

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Accepted Answer

Group related security rules into logical rule categories for easier management and auditing.. Option A is correct because grouping related security rules into logical categories (for example, by function, department, or traffic type) improves readability, simplifies auditing, and makes policy maintenance far more manageable as rulebases grow. Option D is correct because using specific Application definitions via App-ID instead of generic port/protocol rules provides granular, application-aware enforcement, reduces the attack surface, and aligns with Palo Alto Networks best practices for least-privilege policy design. Option B is wrong because disabling logging on all rules destroys the visibility and forensic data needed for threat detection, troubleshooting, and compliance, and logging does not meaningfully burden the management plane in that way. Option C is wrong because using 'any' source zone is overly permissive and violates least-privilege principles; specific source zones should be defined. Option E is wrong because broad, permissive rules at the top of the rulebase undermine security and, since PAN-OS evaluates rules top-down, they would shadow more specific rules rather than improve security posture.

Answer

Disable logging on all security rules to conserve management plane CPU resources.

Answer

Always use the 'any' source zone to ensure all internal subnets are covered simultaneously.

Answer

Place broad, permissive rules at the top of the security policy base to speed up rule evaluation.

Question 7

An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?

Accepted Answer

Real-time cloud-based machine learning analytics that analyze DNS query patterns and domain generation algorithms (DGAs).. Palo Alto DNS Security uses cloud-based machine learning and predictive analytics to identify malicious domains in real time, including newly registered domains and DGA-generated C2 domains that have no existing signature. This behavioral analysis is what allows it to block zero-day DNS threats that signature-based approaches miss.

Answer

Enforcing DNSSEC validation on all outbound UDP port 53 traffic traversing the untrust interface.

Answer

Performing automated zone transfers (AXFR) with public root DNS servers every hour.

Answer

Local DNS response caching on the firewall hard drive to block blacklisted IP addresses.

Question 8

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

Accepted Answer

Implement App-ID policies to permit only explicitly required business applications and inspect all allowed traffic using WildFire and Anti-Spyware profiles.. To adhere to least privilege for outbound traffic, the administrator should implement App-ID policies that permit only explicitly required business applications and inspect all allowed traffic with WildFire and Anti-Spyware profiles. This enforces application-level allow-listing, blocks unknown or unauthorized egress, and applies threat inspection to catch exfiltration attempts. It is the only option that both restricts outbound traffic to what is needed and inspects it for malicious content.

Answer

Disable decryption entirely to prevent performance degradation and rely solely on source IP zoning.

Answer

Allow all outbound traffic on standard ports such as 80 and 443 to ensure uninterrupted business application functionality.

Answer

Create a single any-to-any allow rule for the internal development subnet to speed up troubleshooting.

Question 9

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

Accepted Answer

Prisma Cloud Compute. Prisma Cloud Compute is the module that delivers Cloud Workload Protection, covering containers, hosts, and serverless functions with runtime defense, vulnerability management, compliance scanning, and identity-based microsegmentation. It is the workload-centric counterpart to Prisma Cloud CSPM, which focuses on cloud posture and configuration. CWP capabilities like runtime process monitoring and image scanning map directly to Prisma Cloud Compute.

Answer

Prisma Access Network Security

Answer

Prisma Cloud IAM Security

Answer

Prisma Cloud CSPM

Question 10

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

Accepted Answer

Anti-Tamper Protection. Cortex XDR's Anti-Tamper Protection prevents end users and non-privileged processes from stopping, uninstalling, or modifying the agent, ensuring continuous endpoint visibility and enforcement. It works by protecting the agent's processes, files, and registry keys from tampering, and requires administrative or uninstall-password authorization to remove. This is the built-in feature designed specifically for agent self-protection.

Answer

Active Directory Software Restriction Policies

Answer

GlobalProtect Client Lockdown

Answer

Windows User Account Control (UAC)

Question 11

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. The principle of least privilege requires granting only the minimum access needed to perform a role. Creating a custom Admin Role Profile with read-only permissions for configuration and logs, then assigning it to the junior analyst, enforces this precisely. This restricts the user to viewing without any ability to modify firewall settings or policies.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.

Question 12

An administrator is configuring a Palo Alto Networks firewall to provide secure remote access for employees. The requirement is to allow employees to connect to the corporate network from home using a client that establishes an encrypted tunnel to the firewall. Which feature should the administrator configure?

Accepted Answer

GlobalProtect.. GlobalProtect provides secure remote access by using a client that establishes an encrypted tunnel to the firewall. It supports various authentication methods and can enforce security policies on remote users. This directly meets the requirement of allowing employees to connect from home using a client that creates an encrypted tunnel to the corporate network.

Answer

IPsec site-to-site VPN.

Answer

SSL Decryption.

Answer

DNS Proxy.

Question 13

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

Accepted Answer

Panorama Centralized Management. Panorama provides centralized management for both physical and virtual (VM-Series and CN-Series) firewalls across multi-cloud and on-prem environments.

Answer

AWS Systems Manager Parameter Store

Answer

Prisma Access Cloud Management Portal (CMP) for Remote Networks only.

Answer

Prisma Cloud Compute Console

Question 14

An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?

Accepted Answer

Create an explicit Decryption rule at the top of the Decryption policy with action 'No Decrypt', specifying the custom port and destination server address.. A decryption exclusion list only covers pre-defined applications/URLs on standard ports; a pinned certificate on a non-standard port like TCP 8443 will not match those signatures, so it continues to be decrypted. The reliable fix is an explicit Decryption policy rule placed at the top with action 'No Decrypt', scoped to the destination server address and custom port 8443, so the firewall bypasses decryption for that specific flow before any other rule matches.

Answer

Add the medical portal's URL to the File Blocking Profile under Objects.

Answer

Enable strict SSL Decryption fallback on the Decryption Profile.

Answer

Disable App-ID inspection on port 8443 using an Application Override policy.

Question 15

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

Accepted Answer

Initiate a remote PowerShell session or run triage scripts via Remote Response.. Option B is correct because Cortex XDR's Remote Response capability lets analysts open a live terminal (including a remote PowerShell session on Windows) and execute triage scripts or commands directly on the compromised endpoint from the management console. Option E is correct because the console provides a one-click Endpoint Isolation action that severs the host's network connectivity (except to the Cortex XDR management channel) to contain the threat and prevent lateral movement. Options A, C, and D are incorrect because reflashing BIOS firmware, upgrading physical RAM, and reinstalling the OS from a golden image are hardware/firmware or imaging operations that fall outside the Cortex XDR console's agent-based response actions and would require separate tools or physical/out-of-band access.

Answer

Reflash the physical BIOS firmware remotely to remove persistent bootkits.

Answer

Upgrade the physical RAM hardware configuration.

Answer

Reinstall the host operating system from a golden cloud image.

Question 16

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

Accepted Answer

Administrator role mapping via external LDAP/RADIUS group attributes. PAN-OS supports administrator role mapping, where external LDAP or RADIUS group attributes are mapped to PAN-OS administrator roles. This allows dynamic group membership in LDAP to determine the least-privilege role for each admin, eliminating static local accounts and enforcing Zero Trust least privilege.

Answer

Disabling authentication and relying on physical console keylocks

Answer

Local administrator accounts with never-expiring passwords

Answer

Shared superuser account with multi-person shared keys

Question 17

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID is the Palo Alto Networks feature that maps IP addresses to user identities, enabling security policies based on user or group rather than IP alone. Integrating a User-ID agent (or Panorama User-ID mapping) with the firewall populates the user-to-IP mapping table, which policy rules can then reference to enforce least-privilege access in a Zero Trust model.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud

Question 18

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. In Panorama, external log forwarding destinations such as syslog servers are defined under Panorama > Server Profiles > Syslog. This profile specifies the syslog server IP, port, transport (UDP/TCP/SSL), and format, and is then referenced in a Log Forwarding profile applied to security policies. Configuring it here enables encrypted TLS syslog forwarding to an external SIEM.

Answer

Objects > Security Profiles > Antivirus

Answer

Device > High Availability

Answer

Network > GlobalProtect > Gateways

Question 19

A SOC analyst is triaging a Cortex XDR alert for a Windows endpoint that shows a process named 'svchost.exe' making an outbound HTTPS connection to a known malicious IP address. The process path is C:\Users\Public\svchost.exe, and its parent process is 'explorer.exe'. Which of the following best describes the appropriate next step for the analyst?

Accepted Answer

Immediately isolate the endpoint and initiate a malware scan.. The correct answer is to immediately isolate the endpoint and initiate a malware scan. The process masquerading as svchost.exe from an unusual path with a suspicious parent process is a strong indicator of compromise. Isolation contains the threat, and a scan helps identify and remediate any additional malicious files or persistence mechanisms.

Answer

Ignore the alert because svchost.exe is a legitimate Windows process.

Answer

Kill the process and delete the file from the endpoint.

Answer

Submit the file to WildFire for analysis and wait for the verdict.

Question 20

A security engineer is investigating a Cortex XDR alert on a Windows endpoint. The alert indicates that a process attempted to create a scheduled task, which is a common persistence technique. The engineer wants to see the exact command line and parent process that initiated this action. Which Cortex XDR artifact should the engineer examine?

Accepted Answer

The Alert Details pane, which includes the process image path and command line.. The Alert Details pane is the primary interface for understanding the context of a Cortex XDR alert. It includes the process image path, command line, and parent process, which are essential for determining how a scheduled task was created. This directly provides the information the engineer needs without requiring additional queries.

Answer

The Threat Intelligence report, which provides reputation scores for files.

Answer

The Policy Audit log, which records changes to security policies.

Answer

The Endpoint Management inventory table, which lists installed agents.