Cybersecurity-Practitioner Practice Test 4 — 25 Questions

Question 1

A Cortex XDR administrator needs to prevent a specific known-malicious executable from running on all Windows endpoints in the environment, regardless of file name changes. Which Cortex XDR capability should be configured to block the file based on its hash?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Malware profile with a hash-based blocklist entry. Configuring a malware profile with a hash-based blocklist entry is the correct approach because Cortex XDR can match files by their SHA-256 hash, which remains constant even when the file name changes. Exploit protection, behavioral threat protection, and path-based restriction policies do not provide hash-based blocking, so they cannot reliably stop a renamed malicious executable.

Answer

Behavioral threat protection policy with a process exception

Answer

Exploit protection module with a custom signature

Answer

Restriction policy with a path-based allow list

Question 2

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Accepted Answer

Vishing. The scenario involves a telephone-based deception in which an attacker impersonates IT support to obtain a one-time passcode. Voice phishing, or vishing, is the correct classification because the manipulation occurs through a live phone call. Recognizing the delivery channel is essential, since email phishing, SMS phishing, and physical intrusion techniques each have distinct indicators that do not match this situation.

Answer

Smishing

Answer

Watering hole attack

Answer

Tailgating

Question 3

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

Accepted Answer

The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.. The EDL is configured as type 'IP', meaning it expects a list of IPv4 addresses. If the file contains domain names instead, the firewall cannot parse them as IP addresses, resulting in 'parsing error' entries and the EDL failing to populate correctly. Consequently, security rules referencing the EDL do not match any IPs and fail to block traffic.

Answer

External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.

Answer

The firewall management plane does not have an outbound route to the internet to download the file.

Answer

The EDL update schedule is set to 'daily' instead of 'real-time'.

Question 4

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of port or protocol, allowing internal segmentation firewalls to enforce granular, application-aware policies between tiers in the same zone. This lets the firewall permit, for example, only database traffic from the app tier to the DB tier while blocking everything else, achieving microsegmentation.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 5

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

Accepted Answer

Execution. Under MITRE ATT&CK, the Execution tactic (TA0002) covers techniques that result in adversary-controlled code running on a local or remote system, including Command and Scripting Interpreter (T1059) for PowerShell and Signed Binary Proxy Execution / System Binary Proxy Execution (T1218) for Certutil. Using living-off-the-land binaries to download and run payloads is a classic Execution-tactic behavior.

Answer

Resource Development

Answer

Exfiltration

Answer

Reconnaissance

Question 6

A security team is using Prisma Cloud to monitor their AWS environment. They want to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should they use to detect this misconfiguration?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is designed to continuously assess cloud resource configurations against security policies. It can detect misconfigurations like publicly accessible S3 buckets by evaluating bucket policies and ACLs. Other features like CWPP, Cloud Network Security, and DLP focus on different aspects such as runtime protection, network controls, and data content, respectively, and do not directly detect storage misconfigurations.

Answer

Cloud Workload Protection Platform (CWPP)

Answer

Cloud Network Security

Answer

Data Loss Prevention (DLP)

Question 7

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

Accepted Answer

Configure automatic scheduled agent upgrades within the Distributions and Software management view.. Cortex XDR provides a centralized 'Distributions and Software management' view (under Endpoints > Agent Management) where administrators can configure automatic scheduled agent upgrades. This allows defining a target agent version, a schedule, and distribution rules (e.g., by endpoint group or tag), which minimizes network congestion by controlling the rollout pace and avoiding simultaneous downloads. It also provides reporting on upgrade status.

Answer

Execute 'cytool upgrade force' remotely using a PowerShell remoting script.

Answer

Enable the 'Auto-Update' feature in the Windows Update service settings.

Answer

Manually download the MSI and push it via group policy to all endpoints simultaneously.

Question 8

A cloud security engineer is reviewing Prisma Cloud alerts for an Azure subscription. Several alerts indicate that storage accounts allow public blob access. The engineer wants to remediate the issue at scale across all current and future storage accounts in the subscription without disrupting applications that legitimately serve public content through a CDN. What should the engineer do?

Accepted Answer

Apply an Azure Policy definition at the subscription scope that denies creation of storage accounts with public blob access enabled, and remediate existing accounts.. Enforcing a configuration standard across all current and future resources in an Azure subscription is the role of Azure Policy. A subscription-scoped policy with a deny effect prevents creation of storage accounts that allow public blob access, and a remediation task corrects existing accounts. Prisma Cloud compliance standards and Azure Defender provide visibility and detection but do not enforce the storage account property change.

Answer

Create a Prisma Cloud compliance standard that includes the public blob access policy and assign it to the subscription.

Answer

Enable the Prisma Cloud policy that blocks public blob access and let the platform automatically modify the storage account firewall settings.

Answer

Configure Azure Defender for Storage to automatically disable public access when it detects anonymous access.

Question 9

An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?

Accepted Answer

Prisma Access Remote Network with local internet breakout. Local internet breakout at the Remote Network allows internet-bound traffic to egress directly from the Prisma Access location closest to the branch, eliminating the need to backhaul traffic to the corporate data center. This improves user experience for cloud and SaaS applications while still enforcing security policies. Service Connections are for internal resource access, and Explicit Proxy is for web proxy scenarios, not for direct internet breakout from remote networks.

Answer

Prisma Access Remote Network with a default route to the internet

Answer

Prisma Access Explicit Proxy

Answer

Prisma Access Service Connection

Question 10

A security team is onboarding a new AWS account into Prisma Cloud. The cloud account was created under AWS Organizations, and the team wants to grant Prisma Cloud the least-privilege permissions needed to discover resources and read CloudTrail logs. Which onboarding method should the team use?

Accepted Answer

Deploy a Prisma Cloud IAM role in the account using a CloudFormation template that creates a cross-account role trusted by Prisma Cloud.. Onboarding an AWS account that belongs to AWS Organizations should use the CloudFormation template that creates a cross-account IAM role trusted by Prisma Cloud. This grants the platform the minimum permissions for resource discovery and CloudTrail ingestion while eliminating long-lived access keys. IAM users, SSO permission sets, and Config aggregator sharing do not establish the required cross-account trust and are not the documented least-privilege onboarding path.

Answer

Configure an AWS SSO permission set that grants Prisma Cloud administrative access to the account.

Answer

Create an IAM user with programmatic access and an access key/secret key, then enter those credentials in Prisma Cloud.

Answer

Enable AWS Config and grant Prisma Cloud access by sharing the Config aggregator with the Prisma Cloud service account.

Question 11

An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)

Accepted Answer

Trusted Images. Admission Control and Trusted Images work together to enforce that only approved container images are deployed. Admission Control intercepts pod creation requests and applies policies, while Trusted Images defines which registries or images are considered trusted. This combination allows the organization to block unapproved images at deployment time. Image Scanning and Runtime Defense are detection and response tools, and Cloud Discovery provides visibility, but none of these enforce admission policies.

Answer

Runtime Defense

Answer

Image Scanning

Answer

Cloud Discovery

Question 12

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

Accepted Answer

Application-based security policies. Application-based security policies are the correct approach because they enable enforcement based on the actual application, not just port and protocol. This allows the firewall to identify and control applications regardless of the ports they use, which is essential for modern traffic that often evades port-based rules. Security profiles and application filters serve different purposes.

Answer

Application filters

Answer

Service objects

Answer

Security profiles

Question 13

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

Accepted Answer

Application-level encryption of ePHI using keys managed by the organization, independent of device encryption. Application-level encryption with organization-managed keys ensures ePHI remains unreadable if a device is lost or stolen, because decryption requires keys the organization controls. This approach works consistently across managed desktops and personal mobile devices and does not depend on native device encryption, satisfying the stated requirement. Remote wipe and DLP reduce risk but do not guarantee confidentiality of data at rest.

Answer

Data loss prevention (DLP) policies that block ePHI from being copied to removable media

Answer

Remote wipe capabilities that erase all data on lost or stolen devices

Answer

Full-disk encryption on all managed desktops and mobile devices

Question 14

A security team has onboarded an AWS account into Prisma Cloud and enabled the Cloud Security Posture Management (CSPM) policy set. During the initial scan, the team notices that several S3 buckets flagged previously as non-compliant are no longer generating alerts, even though no remediation occurred. The team wants to understand which mechanism could suppress these alerts without deleting the policy. Which Prisma Cloud capability should the team review?

Accepted Answer

Alert dismissal rules and policy suppression on the resource. Prisma Cloud CSPM supports dismissing alerts and applying policy suppression to specific resources so that known or accepted risks stop generating findings. Since the policy itself remains intact and no remediation happened, the change in alerting must come from a suppression or dismissal mechanism. Reviewing those settings reveals whether an analyst or automation suppressed the buckets, which is the correct diagnostic path.

Answer

WildFire inline malware signature update pushing new verdicts

Answer

AWS Config recorder stopping evaluation of S3 bucket rules

Answer

Cloud account read-only role trust relationship expiration

Question 15

A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM) with predefined and custom policies.. Prisma Cloud's CSPM capability continuously assesses cloud resource configurations against best practices, while compliance reporting maps those findings to standards like CIS and PCI DSS. Together, they provide the detection and reporting needed to maintain a secure posture across multi-cloud environments. Other capabilities like CWPP, CIEM, and CNS address different security domains.

Answer

Cloud Infrastructure Entitlement Management (CIEM) for analyzing identity permissions.

Answer

Cloud Network Security (CNS) for microsegmentation and firewall policy management.

Answer

Cloud Workload Protection Platform (CWPP) for runtime defense of virtual machines.

Question 16

A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)

Accepted Answer

Detection of misconfigured cloud resources, such as publicly accessible storage buckets.. Prisma Cloud CSPM is designed to continuously monitor cloud environments for misconfigurations and compliance violations. It detects issues like publicly accessible storage buckets and provides compliance reporting against standards such as CIS, GDPR, and HIPAA. It does not handle runtime protection, network traffic inspection, or automated remediation of IAM policies. Those are handled by other modules or require additional tools.

Answer

Automated remediation of identity and access management (IAM) policies across cloud accounts.

Answer

Runtime protection for serverless functions, including blocking malicious invocations.

Answer

Network traffic inspection and intrusion prevention for east-west traffic in Kubernetes clusters.

Question 17

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The organization wants to ensure that users' web traffic is inspected for threats and that acceptable use policies are enforced. Which Prisma Access component is responsible for applying security policies to web traffic from remote users?

Accepted Answer

Mobile Users. The Mobile Users component of Prisma Access is designed to secure remote user traffic to the internet and internal resources. It uses GlobalProtect to connect users and applies security policies, including threat prevention and URL filtering, to their web traffic. Other components like Remote Network, Service Connection, and Explicit Proxy serve different connectivity purposes.

Answer

Service Connection

Answer

Remote Network

Answer

Explicit Proxy

Question 18

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The administrator wants to ensure that web traffic from remote users is inspected for threats and that malicious sites are blocked. Which Prisma Access component is responsible for this inspection?

Accepted Answer

Prisma Access security processing node. In Prisma Access, security processing nodes are the components that perform threat inspection and enforce security policies for remote user traffic. When a remote user connects via GlobalProtect, their traffic is routed to a security processing node, where it is inspected for threats and URL filtering is applied. The GlobalProtect portal handles authentication and configuration, while service connections provide network connectivity. The mobile user license is for licensing.

Answer

GlobalProtect portal

Answer

Prisma Access mobile user license

Answer

Prisma Access service connection

Question 19

An organization uses Prisma Access for secure internet access and wants to prevent users from uploading sensitive documents to unsanctioned cloud storage services. The security team already has data patterns defined for sensitive content. Which Prisma Access capability should be configured to inspect uploads and block the transfer?

Accepted Answer

A Data Loss Prevention profile applied to the security policy that governs the traffic.. To inspect uploads for sensitive content and block the transfer, the security policy that permits the traffic must reference a Data Loss Prevention profile. DLP profiles evaluate content against defined data patterns and can block or alert. URL Filtering and File Blocking operate on destination category or file type, and SaaS Security API integrations scan sanctioned applications rather than inline unsanctioned uploads.

Answer

SaaS Security inline API integration with the cloud storage provider.

Answer

A File Blocking profile that blocks executable file types on the cloud storage applications.

Answer

URL Filtering with a custom URL category for cloud storage services.

Question 20

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

Accepted Answer

Implementing endpoint detection and response (EDR) with behavioral analytics and process lineage tracking. EDR with behavioral analytics and process lineage tracking detects malicious activity by monitoring how processes behave and relate to one another, which is effective against LOLBins and fileless attacks that leave no malicious files. Signature-based antivirus, network capture, and vulnerability scanning do not provide the endpoint behavioral visibility required to identify such intrusions.

Answer

Enabling full packet capture at the network perimeter to inspect all traffic for malicious payloads

Answer

Increasing the frequency of vulnerability scans to identify unpatched software that could be exploited

Answer

Deploying additional signature-based antivirus engines with broader malware definition sets