Cybersecurity-Practitioner Practice Test 5 — 25 Questions

Question 1

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

Accepted Answer

Anti-Tamper Protection. Anti-Tamper protection prevents unauthorized users from stopping services, modifying files, or uninstalling the agent.

Answer

Active Directory Software Restriction Policies

Answer

GlobalProtect Client Lockdown

Answer

Windows User Account Control (UAC)

Question 2

An organization deploys Cortex XDR disk encryption management. An endpoint fails to escrow its BitLocker recovery key to the Cortex XDR console. What is the most effective troubleshooting step to verify escrow status using the agent command-line tool?

Accepted Answer

Run 'cytool encryption status' to check BitLocker integration and key escrow status.. The cytool command-line interface provides specific commands to query disk encryption and key escrow status.

Answer

Run 'manage-bde -status' from an elevated command prompt.

Answer

Review the Windows Application event log for BitLocker Group Policy errors.

Answer

Run 'cytool set-token' to re-register the encryption keys.

Question 3

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

Accepted Answer

Embedded machine learning classifiers executed directly on the endpoint.. Local Analysis uses embedded machine learning models running locally on the endpoint to evaluate file features.

Answer

Periodic scheduled scans against the Palo Alto Networks threat intelligence cloud.

Answer

Real-time signature matching against a local antivirus definition database.

Answer

Continuous DNS tunneling queries sent to WildFire.

Question 4

An administrator is reviewing endpoint security profiles and notices the term 'BIOC'. What does BIOC stand for in the context of Cortex XDR?

Accepted Answer

Behavioral Indicator of Compromise. BIOC stands for Behavioral Indicator of Compromise, representing rules that detect suspicious behaviors.

Answer

Blocked Internal Operating Component

Answer

Basic Intelligent Output Control

Answer

Binary Indicator of Code

Question 5

Where in the Cortex XDR management console can an administrator view the operational health, connection status, and version of all deployed agents?

Accepted Answer

Endpoint Management view. The Endpoint Management view provides a centralized inventory and status list of all managed endpoints.

Answer

Incident Response workbench

Answer

WildFire Analysis submissions portal

Answer

Threat Intelligence Feed manager

Question 6

An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?

Accepted Answer

Device > Dynamic Updates. Dynamic updates scheduling (Antivirus, Applications, WildFire, Threat) is configured under Device > Dynamic Updates. Each update type has configuration options for Download Only, Download and Install, or Download and Schedule.

Answer

Policies > Management

Answer

Device > Setup > Management > Software

Answer

Objects > Certificates

Question 7

Which THREE parameters or settings can be configured within a Cortex XDR Agent Settings profile? (Choose three)

Accepted Answer

Agent heartbeat and check-in frequency intervals.. Agent Settings profiles govern communication intervals, proxy servers, and operational modes.

Answer

GlobalProtect VPN gateway tunnel encryption keys.

Answer

Palo Alto Networks firewall security policy rulebases.

Question 8

Which THREE diagnostic or troubleshooting steps can be performed using the 'cytool' command-line utility on a local endpoint? (Choose three)

Accepted Answer

Generating support logs and diagnostic dumps ('cytool support dump').. Cytool supports querying agent status, checking protection module states, and dumping support logs.

Answer

Configuring enterprise LDAP domain controller replication schedules.

Answer

Modifying global firewall NAT routing tables on the core switch.

Question 9

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

Accepted Answer

The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.. EDLs have strict formatting requirements (plain text, one IP/URL per line, max limits). If the list contains invalid IP formatting, CIDR masks outside /0-/32, or HTML headers instead of pure text, the parser fails.

Answer

External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.

Answer

The firewall management plane does not have an outbound route to the internet to download the file.

Answer

The EDL update schedule is set to 'daily' instead of 'real-time'.

Question 10

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

Accepted Answer

Inside the Prisma Access Cloud Security Processing Node (SPN) cloud infrastructure.. Prisma Access inspects branch-to-branch traffic within the cloud security processing nodes (SPNs) managed by Palo Alto Networks.

Answer

Inside the customer-managed AWS Transit Gateway associated with the remote network.

Answer

On the Panorama management server located in the customer's primary datacenter.

Answer

On the local physical firewall at the originating branch office before it leaves the LAN.

Question 11

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

Accepted Answer

Prisma Cloud Compute. Prisma Cloud Compute is the module dedicated to Cloud Workload Protection (CWP).

Answer

Prisma Access Network Security

Answer

Prisma Cloud IAM Security

Answer

Prisma Cloud CSPM

Question 12

An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?

Accepted Answer

In the WildFire portal or Prisma Access Monitor > WildFire Submissions report, click on the specific sample hash to view the behavioral analysis report.. WildFire provides detailed behavioral threat analysis reports showing process trees, registry changes, file modifications, and network connections.

Answer

In Prisma Cloud Compute > Defend > Access Control logs.

Answer

In the Prisma Access Cloud Identity Engine audit logs.

Answer

In Panorama > Managed Devices > WildFire Appliance CLI.

Question 13

What is the primary function of the Prisma Cloud Data Security module?

Accepted Answer

Discover, classify, and protect sensitive data (such as PII and financial records) stored in cloud object storage like AWS S3.. Prisma Cloud Data Security discovers, classifies, and protects sensitive data stored in cloud object storage like AWS S3 buckets.

Answer

Tunnel database traffic securely from on-premises data centers to AWS RDS instances.

Answer

Encrypt database tables in Microsoft Azure SQL using customer-managed HSM keys.

Answer

Inspect TLS certificates on public-facing load balancers for expiration dates.

Question 14

When setting up Prisma Access Mobile Users, what is the recommended client software installed on end-user laptops to establish secure connections to the cloud security processing nodes?

Accepted Answer

GlobalProtect app. GlobalProtect is the client software used to connect mobile users to Prisma Access.

Answer

Panorama Admin Agent

Answer

Prisma Cloud Defender Agent

Answer

Prisma Access CLI Client

Question 15

Which Palo Alto Networks product provides Cloud Infrastructure Entitlement Management (CIEM) to discover, analyze, and remediate excessive permissions and identities across multi-cloud environments?

Accepted Answer

Prisma Cloud IAM Security (CIEM). Prisma Cloud provides CIEM capabilities to manage identities and permissions across multi-cloud environments.

Answer

Prisma Access Identity Service

Answer

GlobalProtect Entitlement Manager

Answer

WildFire Entitlement Scanner

Question 16

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

Accepted Answer

Attach the Prisma Cloud Compute Lambda layer and configure the runtime wrapper to automatically scan the function upon invocation.. Prisma Cloud Compute uses serverless defenders that are added directly to the Lambda function layer to inspect function code and dependencies.

Answer

Mount an Amazon EFS volume containing the Prisma Cloud scanner binary to the Lambda execution environment.

Answer

Configure AWS Inspector to forward Lambda scan results directly to the Prisma Cloud Console via an SNS topic.

Answer

Deploy a Prisma Cloud Compute Defender container inside the same VPC subnet as the Lambda functions.

Question 17

An enterprise deploying VM-Series firewalls in Google Cloud Platform (GCP) requires centralized license management via Panorama. Which licensing mode should be configured so that firewalls automatically obtain their licenses from Panorama based on consumption or pre-purchased credits?

Accepted Answer

Configure VM-Series Bootstrap with a Panorama AuthKey and Plugin for VM-Series Auto-Registration and Software-based Licensing.. VM-Series firewalls support AuthCodes or VM-Series Bootstrap with Panorama using the CSS (Customer Support Portal) plugin and Smart Licensing / AuthCode provisioning. For cloud-native dynamic scaling, bootstrapping with Panorama auth keys and Auto-Registration is used.

Answer

Configure GCP Secret Manager to inject floating MAC addresses into the management interface.

Answer

Connect each VM-Series firewall directly to an on-premises hardware License Key Server (LKS) via a dedicated VPN.

Answer

Manually upload a permanent .lic license file via SSH to every autosscaled GCP instance upon boot.

Question 18

An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?

Accepted Answer

Real-time cloud-based machine learning analytics that analyze DNS query patterns and domain generation algorithms (DGAs).. DNS Security uses machine learning and predictive analytics in the cloud to identify malicious domains in real-time.

Answer

Enforcing DNSSEC validation on all outbound UDP port 53 traffic traversing the untrust interface.

Answer

Performing automated zone transfers (AXFR) with public root DNS servers every hour.

Answer

Local DNS response caching on the firewall hard drive to block blacklisted IP addresses.

Question 19

An administrator needs to configure Prisma Access to inspect traffic from remote workers using explicit proxy mode rather than the GlobalProtect tunnel. Which component or configuration is required for explicit proxy support in Prisma Access?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect portal agent configuration, specifying the Prisma Access proxy FQDN and port.. Prisma Access supports explicit proxy configurations, allowing mobile users to send HTTP/HTTPS requests to Prisma Access proxy nodes without establishing a full VPN tunnel.

Answer

Enable transparent proxy mode on the VM-Series trust interface using Generic Routing Encapsulation (GRE).

Answer

Configure AWS Route 53 resolver rules to forward proxy requests to WildFire.

Answer

Deploy an Apache Squid proxy server inside an AWS VPC and peer it with Panorama.

Question 20

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

Accepted Answer

Automate the initial deployment configuration, licensing, software updates, and network settings without manual intervention.. Bootstrapping automates the initial configuration, licensing, and software versioning of a VM-Series firewall upon first boot.

Answer

Perform vulnerability scanning on the cloud provider's underlying hypervisor.

Answer

Encrypt all cloud storage volumes attached to the firewall instance before runtime.

Answer

Establish a secure SSH tunnel from the public cloud to the Palo Alto Networks TAC portal.