Cybersecurity-Practitioner Practice Test 4 — 25 Questions

Question 1

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Administrator activity and authentication logs recording login timestamps and source IPs. Administrative accountability is maintained via Configuration Audit logs, Administrator Activity logs, and external authentication/RBAC.

Answer

Automated daily factory reset scripts executed on the management plane

Answer

Disabling all logging to prevent unauthorized access to log databases

Question 2

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Accepted Answer

Panorama Log Viewer / Firewall Traffic and Threat logs filtered by source IP address. Traffic logs combined with ACC (Application Command Center) or Panorama log queries allow detailed session-level forensic investigation per IP address.

Answer

Dynamic Address Group membership audit report

Answer

AutoFocus Campaign Tracker and malware family indicator list

Answer

GlobalProtect Clientless Portal connection history report

Question 3

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Accepted Answer

SQL Injection attacks. SQL injection and Cross-Site Scripting (XSS) are common application-layer web threats that can be detected by Vulnerability Protection signatures.

Answer

Fiber optic cable fiber cut

Answer

Physical server hardware power supply failure

Answer

Management plane cooling fan speed degradation

Question 4

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Accepted Answer

SSL Forward Proxy Decryption. SSL Forward Proxy decryption inspects outbound traffic to external servers by generating a forward proxy certificate on the firewall.

Answer

SSL Inbound Inspection Decryption

Answer

Kerberos Decryption Service integration

Answer

SSH Decryption Proxy mode

Question 5

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Accepted Answer

Antivirus profile. Antivirus and Vulnerability Protection profiles inspect content payloads for known malware and software exploit attempts, respectively.

Answer

Data Filtering profile

Answer

Zone Protection profile

Answer

URL Filtering profile

Question 6

An organization requires compliance reporting showing that all endpoints are actively protected by Cortex XDR modules (Anti-Malware, Exploit Prevention, Behavioral Threat Protection). Where can an administrator generate this comprehensive compliance report in the Cortex XDR management console?

Accepted Answer

Navigate to Cortex XDR Dashboards and Reports > Report Builder / Compliance views.. Reporting and dashboard views provide status summaries and compliance reporting for agent protection modules.

Answer

Run 'cytool report generate' on each endpoint locally.

Answer

Check the Windows Security Center dashboard on individual machines.

Answer

Export the raw endpoint inventory to CSV and correlate with firewall logs.

Question 7

A security analyst wants to configure a custom alert rule in Cortex XDR that triggers whenever a specific command-line pattern is observed across multiple endpoints. Which feature should the analyst use to create this behavioral alert?

Accepted Answer

Custom BIOC (Behavioral Indicator of Compromise) rules. BIOC (Behavioral Indicator of Compromise) rules allow administrators to define custom detection criteria based on process behaviors and command lines.

Answer

WildFire Signature Generator

Answer

Agent Profile Exploit Exception builder

Answer

Host Insights Scheduled Query task

Question 8

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

Accepted Answer

Configure permitted IP address lists on the management interface to allow access only from secure jump hosts. Management plane security best practices include restricting management access via dedicated management interfaces, using IP whitelisting (permitted IP lists), and enforcing strong authentication.

Answer

Disable administrative password complexity requirements to simplify login

Answer

Configure the management interface with a public IP address accessible from the entire internet

Question 9

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

Accepted Answer

Implement App-ID policies to permit only explicitly required business applications and inspect all allowed traffic using WildFire and Anti-Spyware profiles.. Least privilege mandates restricting access and capabilities to only what is strictly necessary for operational needs, which includes blocking unexpected outbound ports and protocols.

Answer

Disable decryption entirely to prevent performance degradation and rely solely on source IP zoning.

Answer

Allow all outbound traffic on standard ports such as 80 and 443 to ensure uninterrupted business application functionality.

Answer

Create a single any-to-any allow rule for the internal development subnet to speed up troubleshooting.

Question 10

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

Accepted Answer

Threat likelihood and impact magnitude. NIST SP 800-30 defines risk as a function of the likelihood of a given threat source exercising a particular potential vulnerability and the resulting impact of that adverse event.

Answer

Network bandwidth consumption and CPU utilization overhead

Answer

Patch availability time and vendor support lifecycle status

Answer

Asset replacement cost and regulatory fine amounts

Question 11

An administrator is deploying Cortex XDR Agent to Windows workstations using an Active Directory Group Policy Object (GPO). Which installation parameter must be used to ensure the agent registers correctly with the assigned Cortex XDR tenant using a specific installation token?

Accepted Answer

Use the /INSTALLTOKEN= parameter followed by the unique registration token string.. The INSTALLTOKEN parameter is required during unattended or mass installations to associate the agent instance with the correct tenant in Cortex XDR.

Answer

Use the /REGKEY= parameter followed by the tenant activation password.

Answer

Use the /SERVER= parameter to define the cloud instance URL.

Answer

Use the /TENANTID= parameter followed by the fully qualified domain name.

Question 12

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Accepted Answer

Dynamic behavioral analysis. WildFire uses dynamic analysis (behavioral analysis) in a sandbox environment to observe how unknown files behave when executed, identifying malicious actions like registry tampering and process injection.

Answer

URL category filtering

Answer

DNS sinkholing

Answer

Static signature matching

Question 13

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

Accepted Answer

Use of valid accounts for initial access or lateral movement. After obtaining valid user credentials through phishing, the adversary enters the credential access phase and typically moves to lateral movement or initial access using those compromised credentials.

Answer

Exploitation of client-side software vulnerabilities

Answer

Passive network sniffing to harvest additional certificates

Answer

Immediate domain controller encryption via ransomware

Question 14

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore connectivity, the administrator must navigate to the Endpoint Management view, select the isolated endpoint, and issue the Remove Isolation action.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 15

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Accepted Answer

Actions on Objectives. The cyber kill chain includes Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.

Answer

Mitigation

Answer

Continuous Patching

Question 16

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

Accepted Answer

Cortex XDR Remote Response tool. Remote Response is the Cortex XDR feature that provides a secure interactive shell and script execution capability on managed endpoints.

Answer

Host Insights Response Actions

Answer

Agent Profile Distribution task

Answer

BIOC automated remediation playbooks

Question 17

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

Accepted Answer

Registry modification events.. Cortex XDR ingests process execution telemetry, registry modifications, and network connection logs.

Answer

Personal user email message bodies and browser photo uploads.

Answer

Internal corporate cafeteria menu preferences.

Question 18

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Hashing the specific file or using a signed certificate exception provides targeted remediation without compromising endpoint security.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 19

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

Accepted Answer

Communication with the Cortex XDR server and essential DNS/DHCP services.. When an endpoint is isolated, network access is blocked except for communication with the Cortex XDR management server and specified DNS/DHCP services.

Answer

All network protocols without restriction.

Answer

SMB and RDP traffic to internal domain controllers.

Answer

All outbound traffic to external internet websites via HTTPS.

Question 20

Which TWO methods can be utilized to distribute Cortex XDR agent installation packages across an enterprise Windows environment? (Choose two)

Accepted Answer

Active Directory Group Policy Object (GPO) software installation.. Enterprise deployment typically relies on Active Directory GPO or centralized software deployment tools like SCCM/Intune.

Answer

Direct user self-service installation via public app store downloads.

Answer

Broadcasting the installer binary unencrypted over local subnet broadcast domains.

Answer

Embedding the installer inside incoming corporate email attachments for users to execute.