Cybersecurity-Practitioner Practice Test 3 — 10 Questions

Question 1

A Cortex XDR administrator wants to reduce alert noise from a custom internal application that legitimately writes to the Windows registry Run key during installation. The administrator needs to suppress future alerts for this specific behavior on a defined group of developer endpoints without disabling the Behavioral Threat module globally. Which Cortex XDR capability should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an exception rule scoped to the developer endpoint group for the specific behavior and process. Exception rules provide granular, scoped suppression for specific behaviors, processes, and endpoint groups while leaving the broader Behavioral Threat module active. By targeting only the internal application on developer endpoints, the administrator eliminates the false-positive noise without weakening protection elsewhere. This is the recommended approach for balancing operational efficiency with security coverage.

Answer

Disable the Behavioral Threat module for the developer endpoint group

Answer

Lower the alert severity of the Run key behavior to Informational in the policy

Answer

Add the internal application's hash to the Allow List in the Malware profile

Question 2

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. In a SAML integration between Microsoft Entra ID and GlobalProtect, conditional access policies that evaluate device compliance (managed vs. unmanaged) are enforced by the identity provider (Microsoft Entra ID) during authentication and token issuance. Microsoft Entra ID evaluates the device state via Intune or hybrid Microsoft Entra ID join and either issues or denies the SAML assertion; the GlobalProtect gateway simply consumes the assertion and grants access based on the attributes returned.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 3

What is the primary function of the Prisma Cloud Data Security module?

Accepted Answer

Discover, classify, and protect sensitive data (such as PII and financial records) stored in cloud object storage like AWS S3.. Prisma Cloud's Data Security module (DSPM) is purpose-built to discover, classify, and protect sensitive data at rest in cloud storage services such as AWS S3, Azure Blob, and GCP Cloud Storage. It scans object stores for PII, financial records, and other regulated data, then applies policies to prevent exposure. This matches option C precisely.

Answer

Tunnel database traffic securely from on-premises data centers to AWS RDS instances.

Answer

Encrypt database tables in Microsoft Azure SQL using customer-managed HSM keys.

Answer

Inspect TLS certificates on public-facing load balancers for expiration dates.

Question 4

A security operations team is using Prisma Cloud to monitor their AWS environment. They receive an alert about an S3 bucket that is publicly accessible. The team wants to quickly identify which users or roles have permissions to modify the bucket policy. Which Prisma Cloud feature should they use?

Accepted Answer

Resource Query Language (RQL) to query the bucket's configuration and related IAM policies.. Resource Query Language (RQL) in Prisma Cloud enables custom queries across cloud resources and their relationships. To identify which users or roles can modify an S3 bucket policy, the team can use RQL to query IAM policies that grant s3:PutBucketPolicy permissions and correlate them with the bucket. This provides a precise and efficient way to answer the question, unlike other features that focus on compliance, data security, or runtime protection.

Answer

Prisma Cloud Compute's runtime defense to monitor API calls to the S3 bucket.

Answer

Prisma Cloud's Data Security dashboard to view the bucket's access logs.

Answer

Prisma Cloud's compliance reports to check against CIS benchmarks for S3 permissions.

Question 5

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

Accepted Answer

Custom command and control infrastructure and objectives focused on espionage. The [CORRECT] answer is D because APTs are defined by their tailored, persistent approach: they build or rent custom C2 infrastructure (e.g., Cobalt Strike, Sliver, or bespoke implants) and pursue long-term intelligence collection rather than immediate financial gain. This contrasts with opportunistic ransomware, which typically uses commodity tooling and prioritizes speed over stealth. The espionage objective explains the long dwell times, stealthy lateral movement, and custom tooling described in the scenario.

Answer

Rapid data encryption and extortion demands

Answer

Low dwell time and heavy reliance on automated scanners

Answer

Exclusive use of built-in Living off the Land binaries

Question 6

A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?

Accepted Answer

App-ID. App-ID identifies applications regardless of port, protocol, or encryption, using signatures and behavioral analysis. This allows the engineer to create policies based on applications rather than ports, ensuring accurate identification and control of applications using non-standard ports. Port-based rules, SSL decryption, and User-ID do not provide this capability on their own.

Answer

SSL decryption

Answer

Port-based rules

Answer

User-ID

Question 7

An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?

Accepted Answer

Device > Dynamic Updates. In PAN-OS, the installation schedule for dynamic updates (Antivirus, WildFire, etc.) is configured under Device > Dynamic Updates. This section allows administrators to set when downloaded updates are installed, separate from the download schedule. If updates download but do not install, the installation schedule settings here need to be verified.

Answer

Policies > Management

Answer

Device > Setup > Management > Software

Answer

Objects > Certificates

Question 8

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Option A is correct because Zero Trust identity requires strong authentication such as MFA combined with continuous, risk-based adaptive validation, meaning access decisions are re-evaluated based on signals like user behavior, location, and device health rather than granted once at login. Option C is correct because Zero Trust enforces least-privilege access, granting only the minimum permissions needed and dynamically scoping them to user role, device posture, and contextual factors such as time and location. Option B is incorrect because permanent administrative access after a one-time compliance check violates Zero Trust's continuous verification and least-privilege principles. Option D is incorrect because implicitly trusting traffic from a corporate VPN contradicts the Zero Trust tenet of never trusting based on network location. Option E is incorrect because bypassing authentication for internal applications, even from managed assets, undermines the requirement to authenticate and authorize every access request.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 9

An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?

Accepted Answer

Authentication. Authentication is the IAM function that verifies a claimed identity by validating credentials such as passwords, MFA tokens, or SAML assertions. In a SAML 2.0 flow, the Okta Identity Provider authenticates the user and issues a signed assertion that Prisma Cloud (the Service Provider) trusts. Authorization, by contrast, determines what the authenticated user is permitted to do.

Answer

Authorization

Answer

Auditing

Answer

Accounting

Question 10

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

Accepted Answer

Utilization of stealthy techniques designed to evade standard security monitoring tools. Option B is correct because APT actors prioritize operational security, employing stealthy techniques such as living-off-the-land binaries (LOLBins), fileless malware, and encrypted C2 channels specifically to evade EDR, SIEM, and other standard monitoring tools. Option C is correct because APTs typically build or acquire bespoke command-and-control infrastructure (e.g., custom implants, domain fronting, or victim-specific redirectors) tailored to the target's environment, rather than using commodity tooling that defenders can easily signature. Option E is correct because the defining characteristic of an APT is the 'persistent' element: adversaries establish long-term footholds using mechanisms like scheduled tasks, WMI subscriptions, or registry Run keys, maintaining access for months or years to conduct espionage or lateral movement. Option A is incorrect because exclusive reliance on public pentest scripts describes commodity or script-kiddie activity, whereas APTs develop or purchase custom exploits and zero-days. Option D is incorrect because short dwell times and noisy, aggressive encryption describe ransomware or smash-and-grab operations, not the low-and-slow, stealthy, long-dwell behavior of APTs.

Answer

Exclusive reliance on publicly available penetration testing scripts

Answer

Short dwell times with aggressive, noisy data encryption