Cybersecurity-Practitioner Practice Test 2 — 30 Questions

Question 1

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Persistence. Persistence (TA0003) consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions.

Answer

Impact

Answer

Collection

Answer

Reconnaissance

Question 2

An organization is deploying Zero Trust Network Access (ZTNA) via Prisma Access. The SOC notices that a user device with compromised posture (missing host integrity check) is successfully authenticated by the SAML IdP but is denied network access. Where is this runtime access enforcement happening?

Accepted Answer

At the Prisma Access cloud service node via GlobalProtect Gateway posture enforcement. Prisma Access evaluates the posture assessment and user context against the GlobalProtect Gateway agent settings and security rules to dynamically drop or restrict access at runtime.

Answer

Via the Panorama Syslog export settings to the SIEM

Answer

Within the Cortex XDR agent running on the endpoint

Answer

Inside the Active Directory Domain Controller Group Policy Objects

Question 3

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

Accepted Answer

User-ID Agent mapping and Windows Security Event Log polling. PAN-OS supports User-ID agent mapping, captive portal, Exchange monitoring, Syslog listening, and GlobalProtect as mapping sources.

Answer

ICMP Ping sweeps of internal subnet scopes

Answer

BGP routing table advertisements

Answer

Direct DNS Zone Transfer requests initiated by the firewall data plane

Question 4

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

Accepted Answer

Execute an automated Cortex XSOAR playbook task invoking the PAN-OS XML API to terminate the active user session. API-based session revocation or User-ID user logout commands can be invoked via Cortex XSOAR to immediately clear sessions on Prisma Access/firewalls.

Answer

Clear the Dynamic Address Group tags manually via a Syslog alert

Answer

Wait for the active DHCP lease to expire on the core switch

Answer

Restart the management server daemon on Panorama

Question 5

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

Accepted Answer

GlobalProtect with Host Information Profile (HIP) checking and SAML authentication. Combining GlobalProtect with HIP (Host Information Profile) checks and SAML authentication enforces continuous dynamic evaluation of user identity and device health.

Answer

Unauthenticated captive portal with static MAC address whitelisting

Answer

Static IP reservation combined with pre-shared key IPsec tunnels

Answer

SNMP trap forwarding combined with local database authentication

Question 6

A security operations team is reviewing MITRE ATT&CK Tactic classifications for an incident involving credential theft and subsequent unauthorized actions on a Palo Alto Networks protected network. Which THREE of the following Tactics fall under the 'Post-Compromise' or later stages of the attack lifecycle? (Choose three)

Accepted Answer

Exfiltration. In MITRE ATT&CK, tactics like Exfiltration, Lateral Movement, and Command and Control occur after initial access and execution.

Answer

Initial Access

Answer

Reconnaissance

Question 7

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. Using valid accounts for persistence falls under the Persistence tactic, and modifying group memberships to gain higher access falls under Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 8

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

Accepted Answer

Utilization of stealthy techniques designed to evade standard security monitoring tools. APTs are characterized by long dwell times, stealthy behavior to evade automated detection, and customized tools targeted at specific organizational objectives.

Answer

Exclusive reliance on publicly available penetration testing scripts

Answer

Short dwell times with aggressive, noisy data encryption

Question 9

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

Accepted Answer

Brute Force. Credential Access techniques are used by adversaries to steal credentials such as account names and passwords, including OS Credential Dumping and Brute Force attacks.

Answer

Masquerading

Answer

Data Exfiltration Over C2 Channel

Answer

Automated Exfiltration

Question 10

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

Accepted Answer

Deploy the Cloud Identity Engine (CIE) agent and configure directory synchronization with Microsoft Entra ID.. Prisma Access integrates with User-ID via the Syslog listener, GlobalProtect agent, or Cloud Identity Engine (CIE) to map IP addresses to usernames.

Answer

Configure an explicit SAML authentication proxy on the Panorama management plane.

Answer

Configure an explicit proxy PAC file pointing all browser traffic to the Prisma Access Remote Networks gateway IP.

Answer

Install a dedicated VM-Series User-ID Agent on an EC2 instance in every public cloud VPC.

Question 11

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Accepted Answer

Actions on Objectives (exfiltrating data or lateral movement across internal zones). The Cyber Kill Chain phases involving active network traffic where firewalls play a role include Delivery, Command and Control, and Actions on Objectives (Exfiltration).

Answer

Reconnaissance (researching target organization via public social media without direct network interaction)

Answer

Weaponization (coupling an exploit with a backdoor in the attacker's offline lab environment)

Question 12

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect traffic for predefined or custom patterns (such as credit card numbers or social security numbers) and can block or log the transfer.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 13

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Accepted Answer

AutoFocus threat intelligence service. AutoFocus provides contextual threat intelligence derived from WildFire and other sources, allowing analysts to search threat groups, campaigns, and TTPs.

Answer

Panorama Log Collector forwarding engine

Answer

Application Command Center (ACC) dashboard

Answer

GlobalProtect Host Information Profile (HIP) engine

Question 14

Which TWO methods can be used to authenticate remote users connecting to Prisma Access via GlobalProtect? (Choose two)

Accepted Answer

LDAP or RADIUS authentication profiles configured via the Cloud Identity Engine or local firewalls.. Prisma Access supports multiple authentication methods including SAML 2.0 Identity Providers (IdPs) and LDAP/RADIUS directories via Cloud Identity Engine or explicit authentication profiles.

Answer

Physical USB smartcard hardware serial number validation via local PAN-OS USB ports on user laptops.

Answer

Plaintext HTTP Basic Authentication embedded in URL parameters.

Answer

Static MAC address whitelisting on enterprise Wi-Fi routers.

Question 15

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

Accepted Answer

Inline Machine Learning analysis that evaluates web traffic and categorizes Newly Registered Domains (NRDs) in real-time.. Advanced URL Filtering uses inline machine learning to analyze web traffic and categorize newly registered domains (NRDs) instantly.

Answer

GlobalProtect endpoint registry checks for browser history.

Answer

Client-side proxy PAC file lookups against local browser blocklists.

Answer

Static URL database updates downloaded from Panorama once every 24 hours.

Question 16

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

Accepted Answer

Configure the Prisma Cloud GitHub Action to scan Terraform and CloudFormation templates during the pull request stage.. Prisma Cloud provides a Bridgecrew IaC scanner integrated as a GitHub Action or VCS integration to scan templates during the pull request phase.

Answer

Deploy the Prisma Cloud Defender daemonset on the GitHub runner nodes to monitor runtime file system changes.

Answer

Establish a VPC endpoint between the GitHub repository and Prisma Cloud Compute console.

Answer

Enable Prisma Cloud CloudTrail integration to parse GitHub audit logs via AWS EventBridge.

Question 17

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

Accepted Answer

Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.. Prisma Cloud Cloud Security Posture Management (CSPM) evaluates resource configurations against compliance standards and policies in the Investigate or Alerts tab.

Answer

Navigate to Panorama > Cloud Services > Native Security to update IAM roles.

Answer

Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.

Answer

Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.

Question 18

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

Accepted Answer

Enable Source NAT (SNAT) on the VM-Series firewall untrust/trust interface policies so return traffic flows back through the active firewall IP.. Azure Standard Load Balancer supports HA ports and SNAT, but inbound asymmetric traffic routed via user-defined routes (UDRs) requires careful load balancer configuration or floating IP (Direct Server Return) considerations, or utilizing Azure Gateway Load Balancer. For standard load balancers with firewalls, SNAT is typically enabled on the load balancer or firewall to maintain flow symmetry.

Answer

Configure Azure ExpressRoute Global Reach to bypass the Azure Load Balancer entirely.

Answer

Deploy an Azure Bastion host to proxy all inbound administrative and application sessions.

Answer

Configure an Azure Application Gateway in front of the Standard Load Balancer to perform Layer 7 proxying.

Question 19

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

Accepted Answer

Prisma Autonomous DEM (ADEM) workspace in the Prisma Access management portal.. Autonomous DEM (ADEM) provides end-to-end digital experience monitoring from the endpoint or branch network to SaaS applications.

Answer

Panorama Traffic Log CSV export analyzed via spreadsheet formulas.

Answer

AWS CloudWatch Network Monitor dashboard.

Answer

WildFire Sample Analysis execution timeline graph.

Question 20

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. AWS GWLB uses Geneve encapsulation on port 6081 to securely exchange traffic between the GWLB and the VM-Series firewalls, allowing transparent inline inspection without SNAT/DNAT.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.