Cybersecurity-Practitioner Practice Test 5 — 25 Questions

Question 1

An administrator is using Prisma Cloud to monitor a multi-cloud environment. They need to ensure that any Amazon S3 bucket containing sensitive data is encrypted at rest. Which Prisma Cloud capability should be used to continuously enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Config Policy. Config Policies are the foundation for enforcing configuration requirements in Prisma Cloud. By defining a policy that requires S3 buckets to be encrypted, Prisma Cloud continuously scans and alerts on any bucket that violates this policy. Compliance Standards, Audit Trail, and Data Security Dashboard provide reporting, logging, or visibility, but they do not enforce the configuration. Config Policies are the proactive control that ensures encryption at rest.

Answer

Compliance Standard

Answer

Data Security Dashboard

Answer

Audit Trail

Question 2

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

Accepted Answer

Use client-side encryption with customer-managed keys stored outside the cloud provider's infrastructure. Client-side encryption with customer-managed keys stored outside the provider's infrastructure ensures that the cloud provider only ever handles ciphertext, so it cannot access plaintext data. Provider-managed encryption, TLS, and CASB solutions do not prevent the provider from accessing plaintext, failing the scenario's requirement.

Answer

Enable TLS 1.3 for all connections and store data in an encrypted database managed by the provider

Answer

Rely on the cloud provider's default encryption at rest and in transit

Answer

Implement a cloud access security broker (CASB) to monitor and control data flows to the cloud

Question 3

A retail company wants to reduce the risk that a terminated employee's account is still usable hours after departure. Which identity and access management practice best addresses this specific risk?

Accepted Answer

Automate account deprovisioning so the identity management system disables the account immediately upon HR termination processing.. The core risk is an active credential after employment ends. Automating deprovisioning from the authoritative HR system minimizes the delay between termination and account disablement. Password policies affect credential strength or rotation but do not revoke access, so they leave the terminated account usable until someone manually disables it.

Answer

Shorten the password expiration interval for all employees to thirty days.

Answer

Increase password complexity requirements to sixteen characters with symbols.

Answer

Enable self-service password reset so users can recover access without contacting the help desk.

Question 4

A security administrator is configuring a Palo Alto Networks firewall to block malicious downloads. They want to ensure that when a user attempts to download a file that is identified as malicious by WildFire, the download is blocked and the user is notified. Which two actions must the administrator take? (Choose two.)

Accepted Answer

Configure a file blocking profile to block files with a WildFire verdict of malicious.. To block malicious downloads using WildFire, the administrator must attach a WildFire analysis profile to the security policy to submit files for analysis, and a file blocking profile to block files based on WildFire verdicts. These two profiles work together to inspect and enforce policy. Other options like SSL decryption or URL filtering do not directly achieve the goal.

Answer

Set up a URL filtering profile to block malicious sites.

Answer

Configure a decryption profile to block sessions with untrusted certificates.

Answer

Enable SSL decryption for all traffic.

Question 5

A security administrator is configuring data protection for a cloud environment monitored by Prisma Cloud. The administrator wants the platform to detect when sensitive information such as credit card numbers is stored in object storage buckets and to generate an alert without blocking access. Which Prisma Cloud capability should the administrator enable?

Accepted Answer

Data Security scanning with data classification policies. Data Security in Prisma Cloud discovers and classifies sensitive information in supported cloud storage by scanning objects and applying classification policies. It generates findings and alerts when patterns such as credit card numbers are detected, operating in a detective mode that does not block access. This aligns exactly with the administrator's goal of alerting on sensitive data without disrupting storage access.

Answer

Admission control rules applied to object storage buckets

Answer

Host vulnerability scanning on the instances accessing the buckets

Answer

DNS Security policy applied to the storage service endpoint

Question 6

A healthcare organization is using Prisma Cloud to secure its multi-cloud environment. The security team needs to identify all Amazon EC2 instances that have public IP addresses and are not protected by a security group restricting inbound traffic to only necessary ports. Which Prisma Cloud capability should they use to quickly find these instances?

Accepted Answer

Prisma Cloud Config RQL. Prisma Cloud Config RQL is designed for querying cloud resource configurations using a SQL-like syntax. It can filter EC2 instances based on attributes like public IP address and associated security group rules, enabling the team to quickly find those with overly permissive inbound access. Other capabilities like Compute Radar, Inventory, and Threat Detection do not provide this level of configuration querying, making Config RQL the correct choice.

Answer

Prisma Cloud Inventory

Answer

Prisma Cloud Compute Radar

Answer

Prisma Cloud Threat Detection

Question 7

A security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. They want to ensure that all traffic is logged at session start and session end for auditing purposes. Which setting should they configure in the security policy?

Accepted Answer

Enable both Log at Session Start and Log at Session End.. To log both session start and end, the security policy must have both Log at Session Start and Log at Session End enabled. These settings are found in the Actions tab of the security policy rule. Enabling both ensures that the firewall generates logs at the beginning and end of each session, providing a complete audit trail.

Answer

Set the Log at Session Start option to enabled.

Answer

Configure a syslog server profile to send logs to an external server.

Answer

Set the Log at Session End option to enabled.

Question 8

A cloud operations team manages an AWS organization with many accounts and wants to onboard all current and future accounts into Prisma Cloud CSPM with minimal manual effort. The team needs new accounts created under the organization to be monitored automatically without repeating individual onboarding steps. Which onboarding approach should the team use?

Accepted Answer

Use the AWS organization onboarding with a CloudFormation stack set or organization trail integration. Onboarding at the AWS organization level lets Prisma Cloud discover member accounts and apply the necessary role and trust relationships across them, including accounts added later. This avoids per-account manual onboarding and provides continuous, automatic coverage. Approaches that require enabling services or deploying agents in each account do not deliver the same organization-wide, low-effort onboarding outcome.

Answer

Onboard each account individually using a cross-account IAM role created per account

Answer

Enable AWS Security Hub in each account and forward findings to Prisma Cloud

Answer

Deploy a Prisma Cloud Compute Defender to each account's default VPC

Question 9

A SOC analyst at a company using Cortex XDR notices that several endpoints triggered a behavioral threat alert indicating a process injected code into a remote process and then created a network connection to an unfamiliar external IP. The analyst wants to quickly determine whether this activity is related to a known adversary technique and gather context about the process lineage. Which Cortex XDR feature should the analyst use to view the causal chain and map the activity to MITRE ATT&CK techniques?

Accepted Answer

The Causality View in the incident investigation, which shows the process ancestry and associated MITRE ATT&CK techniques.. The Causality View in Cortex XDR is designed to visualize the full process tree, including injection and network connections, and automatically correlates observed behaviors with MITRE ATT&CK techniques. This gives the analyst immediate context about the attack chain without manual query building or relying solely on indicator reputation, making it the most efficient tool for triaging a behavioral threat alert.

Answer

The Query Builder, which allows writing XQL queries to search for the specific process name across all endpoints.

Answer

The Threat Intelligence module, which provides reputation scores and WHOIS data for the external IP address.

Answer

The Policy Audit page, which shows which security policies were applied to the endpoint during the alert.

Question 10

A security administrator is configuring a Palo Alto Networks firewall to protect a web server in a DMZ zone. The administrator wants the firewall to inspect the HTTP traffic for known attack patterns and block malicious requests while allowing legitimate web traffic. Which Security Profile type should the administrator apply to the Security policy rule that permits HTTP traffic to the web server?

Accepted Answer

Vulnerability Protection profile. The Vulnerability Protection profile is specifically designed to inspect traffic for known exploits and attack patterns. When applied to a Security policy rule that permits HTTP traffic to a DMZ web server, it can detect and block malicious requests such as SQL injection or buffer overflow attempts. URL Filtering, File Blocking, and Data Filtering profiles serve different purposes and do not provide the required attack inspection.

Answer

Data Filtering profile

Answer

URL Filtering profile

Answer

File Blocking profile

Question 11

A security operations center analyst is reviewing an alert about an internal workstation that resolved a domain name belonging to a known malware command-and-control (C2) server. The analyst wants to confirm whether the workstation actually established a connection to that C2 server, rather than just performing a DNS lookup. Which data source should the analyst correlate with the DNS logs to make this determination?

Accepted Answer

Network flow or firewall session logs. Determining whether a suspicious DNS resolution led to real command-and-control traffic requires evidence of an actual network session. Firewall session tables and network flow records capture the source, destination, port, and volume of connections, so they can confirm or refute an established session to the resolved address. DNS logs alone only prove a name lookup occurred, not that the workstation contacted the C2 infrastructure.

Answer

Email gateway message tracking logs

Answer

Authentication logs from the identity provider

Answer

Endpoint file integrity monitoring logs

Question 12

A security administrator is implementing the principle of least privilege for a group of developers who need to deploy code to a production server. Currently, they have full administrative rights. The administrator wants to restrict their access to only what is necessary for deployment. Which of the following best describes the principle of least privilege?

Accepted Answer

Granting users the minimum levels of access or permissions needed to perform their job functions.. The principle of least privilege dictates that users should be granted only the minimum access necessary to perform their job functions. In this case, developers should receive deployment-specific permissions instead of full administrative rights. This minimizes the potential impact of a compromised account and reduces the risk of accidental misconfigurations. The other options describe different security controls that do not directly address limiting permissions.

Answer

Implementing multi-factor authentication for all administrative accounts to add an extra layer of security.

Answer

Rotating user passwords frequently to prevent credential theft and unauthorized access.

Answer

Ensuring that all users have the same level of access to simplify management and reduce complexity.

Question 13

An administrator is configuring Prisma Cloud Compute to protect a Kubernetes cluster. The security team wants to enforce runtime policies that prevent containers from running as root and from mounting sensitive host paths. Which TWO actions must the administrator take to achieve this? (Choose two.)

Accepted Answer

Deploy a Defender DaemonSet to every node in the cluster.. To enforce runtime policies in Kubernetes, the administrator must deploy Defenders to each node and create the appropriate runtime policies in the Prisma Cloud Compute Console. Defenders are the enforcement points that monitor and block container behavior, while the policies define what to enforce. Admission Controllers, audit logs, and network policies do not provide runtime enforcement for root user or host path mounts, making those options incorrect.

Answer

Enable Kubernetes Audit Logs and forward them to Prisma Cloud Compute.

Answer

Configure Prisma Cloud Compute to use Kubernetes Network Policies.

Answer

Configure Kubernetes Admission Controllers to block non-compliant pods.

Question 14

A security analyst is investigating a potential data breach and needs to determine the integrity of a critical file that may have been tampered with. The analyst has a known-good hash of the file from a trusted backup. Which of the following should the analyst do to verify the file's integrity?

Accepted Answer

Compare the file's current hash with the known-good hash using a cryptographic hash function like SHA-256.. To verify file integrity, the analyst should compute the current cryptographic hash of the file and compare it to the known-good hash. Cryptographic hash functions like SHA-256 are designed to detect any alteration, making them the most reliable method. Timestamps, antivirus scans, and file size comparisons do not provide the same level of assurance and can be bypassed or misinterpreted.

Answer

Check the file's last modified timestamp and compare it to the backup date.

Answer

Run an antivirus scan on the file to detect any malicious modifications.

Answer

Use file compression to create a checksum and compare it to the original file size.

Question 15

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

Accepted Answer

Create a rule that allows web-browsing and ssl, and apply a URL Filtering profile that blocks proxy-avoidance-and-anonymizers category.. To allow general internet access while blocking proxy sites and anonymizers, the administrator should allow web-browsing and ssl applications and apply a URL Filtering profile that blocks the proxy-avoidance-and-anonymizers category. This ensures users can access legitimate websites but cannot use proxies to bypass security controls. The other options either restrict HTTPS access or do not block proxy sites.

Answer

Create a rule that allows any application, and apply a Vulnerability Protection profile to block proxy exploits.

Answer

Create a rule that allows web-browsing and ssl, and apply a Data Filtering profile to block proxy credentials.

Answer

Create a rule that allows web-browsing only, and apply a File Blocking profile to block proxy downloads.

Question 16

A security administrator is reviewing a Palo Alto Networks firewall configuration and notices that a Security policy rule allowing outbound web traffic has no security profiles attached. The administrator wants to ensure that the rule is protected against known vulnerabilities, malware, and command-and-control traffic. Which security profile group should the administrator attach to the rule to provide this protection?

Accepted Answer

A Security profile group containing Antivirus, Anti-Spyware, and Vulnerability Protection profiles. A Security profile group that includes Antivirus, Anti-Spyware, and Vulnerability Protection profiles delivers the layered threat inspection needed to detect malware, command-and-control traffic, and exploits. Applying a group is more efficient than attaching individual profiles and ensures consistent protection. The single-profile options each cover only part of the threat landscape and would leave gaps in the required coverage.

Answer

An Antivirus profile only

Answer

A custom URL Filtering profile only

Answer

A Vulnerability Protection profile only

Question 17

A hospital must ensure that electronic protected health information remains available and unaltered even if a ransomware incident encrypts production servers. The security officer is selecting a recovery control that provides a guaranteed, isolated copy of data that cannot be modified by an attacker who has compromised the production domain. Which control best meets this requirement?

Accepted Answer

An immutable, offline or air-gapped backup copy with separate credentials and retention locks. The requirement is for a recovery copy that remains intact even when the production domain is fully compromised. Immutable storage with retention locks prevents alteration or deletion, and keeping the copy offline or air-gapped with separate credentials places it beyond the attacker's reach. Replication and same-array snapshots improve resilience to hardware faults but faithfully reproduce malicious changes, so they cannot guarantee a clean recovery point.

Answer

A replicated database cluster that synchronously mirrors all writes to a second node

Answer

A storage area network snapshot retained for twenty-four hours on the same array

Answer

A nightly backup written to a share on the same domain with domain admin write access

Question 18

A security analyst notices that an internal web server is receiving a high volume of requests containing long strings of special characters in URL parameters, and the application log shows database error messages being returned to clients. The analyst suspects the application is vulnerable to an injection attack. Which practice most directly prevents this class of vulnerability in the application code?

Accepted Answer

Using parameterized queries with strict input validation. Injection vulnerabilities arise when untrusted input is concatenated into interpreter statements, letting data change the structure of a command or query. Parameterized queries, also called prepared statements, keep code and data separate so input cannot alter query logic, and strict validation rejects malformed values early. Network filtering and error handling may reduce exposure or aid detection, but they do not remove the coding flaw that enables the attack.

Answer

Deploying a web application firewall in blocking mode in front of the server

Answer

Enabling verbose error messages so developers can debug failures faster

Answer

Rotating database service account passwords every thirty days

Question 19

A security administrator is configuring a NAT policy on a Palo Alto Networks firewall. Internal users in the 10.1.1.0/24 subnet need to access the internet, but the organization has only a single public IP address, 203.0.113.5, on the untrusted interface. The administrator wants all internal users to share this public IP address when accessing external resources. Which NAT type should the administrator configure?

Accepted Answer

Source NAT with Dynamic IP and Port (DIPP). Source NAT with Dynamic IP and Port allows many internal hosts to share a single public IP address by translating both source IP and source port. This is the standard method for enabling outbound internet access for a subnet when only one public IP is available. Destination NAT, Dynamic IP only, and Static IP do not provide the port multiplexing needed for many-to-one translation.

Answer

Source NAT with Static IP

Answer

Destination NAT

Answer

Source NAT with Dynamic IP only

Question 20

An administrator is configuring Cortex XDR to allow a legitimate application that performs process injection for accessibility purposes. The application is currently being blocked by the agent's protection modules. Which action should the administrator take to allow the application while minimizing the reduction in security?

Accepted Answer

Create a Behavioral Threat exception for the specific process name and the injection behavior.. Behavioral Threat exceptions are designed to permit specific behaviors for specific processes, providing a surgical way to allow legitimate applications that might otherwise be blocked. This approach maintains protection against the same behavior from other processes, unlike disabling modules or creating global exclusions. It is the most precise and secure method.

Answer

Disable the Exploit Prevention module entirely on the endpoint.

Answer

Create a global exclusion for all process injection events on all endpoints.

Answer

Add the application's digital signature to the allow list in the Malware profile.