Cybersecurity-Practitioner Practice Test 2 — 30 Questions

Question 1

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Group related security rules into logical rule categories for easier management and auditing.. Option A is correct because grouping related security rules into logical categories (for example, by function, department, or traffic type) improves readability, simplifies auditing, and makes policy maintenance far more manageable as rulebases grow. Option D is correct because using specific Application definitions via App-ID instead of generic port/protocol rules provides granular, application-aware enforcement, reduces the attack surface, and aligns with Palo Alto Networks best practices for least-privilege policy design. Option B is wrong because disabling logging on all rules destroys the visibility and forensic data needed for threat detection, troubleshooting, and compliance, and logging does not meaningfully burden the management plane in that way. Option C is wrong because using 'any' source zone is overly permissive and violates least-privilege principles; specific source zones should be defined. Option E is wrong because broad, permissive rules at the top of the rulebase undermine security and, since PAN-OS evaluates rules top-down, they would shadow more specific rules rather than improve security posture.

Answer

Disable logging on all security rules to conserve management plane CPU resources.

Answer

Always use the 'any' source zone to ensure all internal subnets are covered simultaneously.

Answer

Place broad, permissive rules at the top of the security policy base to speed up rule evaluation.

Question 2

An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?

Accepted Answer

Real-time cloud-based machine learning analytics that analyze DNS query patterns and domain generation algorithms (DGAs).. Palo Alto DNS Security uses cloud-based machine learning and predictive analytics to identify malicious domains in real time, including newly registered domains and DGA-generated C2 domains that have no existing signature. This behavioral analysis is what allows it to block zero-day DNS threats that signature-based approaches miss.

Answer

Enforcing DNSSEC validation on all outbound UDP port 53 traffic traversing the untrust interface.

Answer

Performing automated zone transfers (AXFR) with public root DNS servers every hour.

Answer

Local DNS response caching on the firewall hard drive to block blacklisted IP addresses.

Question 3

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement App-ID policies to permit only explicitly required business applications and inspect all allowed traffic using WildFire and Anti-Spyware profiles.. To adhere to least privilege for outbound traffic, the administrator should implement App-ID policies that permit only explicitly required business applications and inspect all allowed traffic with WildFire and Anti-Spyware profiles. This enforces application-level allow-listing, blocks unknown or unauthorized egress, and applies threat inspection to catch exfiltration attempts. It is the only option that both restricts outbound traffic to what is needed and inspects it for malicious content.

Answer

Disable decryption entirely to prevent performance degradation and rely solely on source IP zoning.

Answer

Allow all outbound traffic on standard ports such as 80 and 443 to ensure uninterrupted business application functionality.

Answer

Create a single any-to-any allow rule for the internal development subnet to speed up troubleshooting.

Question 4

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

Accepted Answer

Prisma Cloud Compute. Prisma Cloud Compute is the module that delivers Cloud Workload Protection, covering containers, hosts, and serverless functions with runtime defense, vulnerability management, compliance scanning, and identity-based microsegmentation. It is the workload-centric counterpart to Prisma Cloud CSPM, which focuses on cloud posture and configuration. CWP capabilities like runtime process monitoring and image scanning map directly to Prisma Cloud Compute.

Answer

Prisma Access Network Security

Answer

Prisma Cloud IAM Security

Answer

Prisma Cloud CSPM

Question 5

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

Accepted Answer

Anti-Tamper Protection. Cortex XDR's Anti-Tamper Protection prevents end users and non-privileged processes from stopping, uninstalling, or modifying the agent, ensuring continuous endpoint visibility and enforcement. It works by protecting the agent's processes, files, and registry keys from tampering, and requires administrative or uninstall-password authorization to remove. This is the built-in feature designed specifically for agent self-protection.

Answer

Active Directory Software Restriction Policies

Answer

GlobalProtect Client Lockdown

Answer

Windows User Account Control (UAC)

Question 6

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. The principle of least privilege requires granting only the minimum access needed to perform a role. Creating a custom Admin Role Profile with read-only permissions for configuration and logs, then assigning it to the junior analyst, enforces this precisely. This restricts the user to viewing without any ability to modify firewall settings or policies.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.

Question 7

An administrator is configuring a Palo Alto Networks firewall to provide secure remote access for employees. The requirement is to allow employees to connect to the corporate network from home using a client that establishes an encrypted tunnel to the firewall. Which feature should the administrator configure?

Accepted Answer

GlobalProtect.. GlobalProtect provides secure remote access by using a client that establishes an encrypted tunnel to the firewall. It supports various authentication methods and can enforce security policies on remote users. This directly meets the requirement of allowing employees to connect from home using a client that creates an encrypted tunnel to the corporate network.

Answer

IPsec site-to-site VPN.

Answer

SSL Decryption.

Answer

DNS Proxy.

Question 8

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

Accepted Answer

Panorama Centralized Management. Panorama provides centralized management for both physical and virtual (VM-Series and CN-Series) firewalls across multi-cloud and on-prem environments.

Answer

AWS Systems Manager Parameter Store

Answer

Prisma Access Cloud Management Portal (CMP) for Remote Networks only.

Answer

Prisma Cloud Compute Console

Question 9

An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?

Accepted Answer

Create an explicit Decryption rule at the top of the Decryption policy with action 'No Decrypt', specifying the custom port and destination server address.. A decryption exclusion list only covers pre-defined applications/URLs on standard ports; a pinned certificate on a non-standard port like TCP 8443 will not match those signatures, so it continues to be decrypted. The reliable fix is an explicit Decryption policy rule placed at the top with action 'No Decrypt', scoped to the destination server address and custom port 8443, so the firewall bypasses decryption for that specific flow before any other rule matches.

Answer

Add the medical portal's URL to the File Blocking Profile under Objects.

Answer

Enable strict SSL Decryption fallback on the Decryption Profile.

Answer

Disable App-ID inspection on port 8443 using an Application Override policy.

Question 10

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

Accepted Answer

Initiate a remote PowerShell session or run triage scripts via Remote Response.. Option B is correct because Cortex XDR's Remote Response capability lets analysts open a live terminal (including a remote PowerShell session on Windows) and execute triage scripts or commands directly on the compromised endpoint from the management console. Option E is correct because the console provides a one-click Endpoint Isolation action that severs the host's network connectivity (except to the Cortex XDR management channel) to contain the threat and prevent lateral movement. Options A, C, and D are incorrect because reflashing BIOS firmware, upgrading physical RAM, and reinstalling the OS from a golden image are hardware/firmware or imaging operations that fall outside the Cortex XDR console's agent-based response actions and would require separate tools or physical/out-of-band access.

Answer

Reflash the physical BIOS firmware remotely to remove persistent bootkits.

Answer

Upgrade the physical RAM hardware configuration.

Answer

Reinstall the host operating system from a golden cloud image.

Question 11

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

Accepted Answer

Administrator role mapping via external LDAP/RADIUS group attributes. PAN-OS supports administrator role mapping, where external LDAP or RADIUS group attributes are mapped to PAN-OS administrator roles. This allows dynamic group membership in LDAP to determine the least-privilege role for each admin, eliminating static local accounts and enforcing Zero Trust least privilege.

Answer

Disabling authentication and relying on physical console keylocks

Answer

Local administrator accounts with never-expiring passwords

Answer

Shared superuser account with multi-person shared keys

Question 12

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID is the Palo Alto Networks feature that maps IP addresses to user identities, enabling security policies based on user or group rather than IP alone. Integrating a User-ID agent (or Panorama User-ID mapping) with the firewall populates the user-to-IP mapping table, which policy rules can then reference to enforce least-privilege access in a Zero Trust model.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud

Question 13

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. In Panorama, external log forwarding destinations such as syslog servers are defined under Panorama > Server Profiles > Syslog. This profile specifies the syslog server IP, port, transport (UDP/TCP/SSL), and format, and is then referenced in a Log Forwarding profile applied to security policies. Configuring it here enables encrypted TLS syslog forwarding to an external SIEM.

Answer

Objects > Security Profiles > Antivirus

Answer

Device > High Availability

Answer

Network > GlobalProtect > Gateways

Question 14

A SOC analyst is triaging a Cortex XDR alert for a Windows endpoint that shows a process named 'svchost.exe' making an outbound HTTPS connection to a known malicious IP address. The process path is C:\Users\Public\svchost.exe, and its parent process is 'explorer.exe'. Which of the following best describes the appropriate next step for the analyst?

Accepted Answer

Immediately isolate the endpoint and initiate a malware scan.. The correct answer is to immediately isolate the endpoint and initiate a malware scan. The process masquerading as svchost.exe from an unusual path with a suspicious parent process is a strong indicator of compromise. Isolation contains the threat, and a scan helps identify and remediate any additional malicious files or persistence mechanisms.

Answer

Ignore the alert because svchost.exe is a legitimate Windows process.

Answer

Kill the process and delete the file from the endpoint.

Answer

Submit the file to WildFire for analysis and wait for the verdict.

Question 15

A security engineer is investigating a Cortex XDR alert on a Windows endpoint. The alert indicates that a process attempted to create a scheduled task, which is a common persistence technique. The engineer wants to see the exact command line and parent process that initiated this action. Which Cortex XDR artifact should the engineer examine?

Accepted Answer

The Alert Details pane, which includes the process image path and command line.. The Alert Details pane is the primary interface for understanding the context of a Cortex XDR alert. It includes the process image path, command line, and parent process, which are essential for determining how a scheduled task was created. This directly provides the information the engineer needs without requiring additional queries.

Answer

The Threat Intelligence report, which provides reputation scores for files.

Answer

The Policy Audit log, which records changes to security policies.

Answer

The Endpoint Management inventory table, which lists installed agents.

Question 16

A SOC manager is reviewing alert triage metrics and notices a high number of false positives from a Cortex XDR BIOC rule. The manager wants to reduce noise without disabling the rule entirely. Which action should the SOC manager take?

Accepted Answer

Modify the BIOC rule to exclude known benign processes or users.. Tuning a BIOC rule by excluding known benign processes or users is the most effective way to reduce false positives while preserving detection for malicious behavior. It directly addresses the noise source without sacrificing security coverage, aligning with best practices for SOC alert management.

Answer

Increase the severity of the BIOC rule to prioritize it.

Answer

Create a new BIOC rule with a narrower scope.

Answer

Disable the BIOC rule and rely on other detections.

Question 17

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) for all administrator accounts. Option A is correct because enforcing Multi-Factor Authentication (MFA) for all administrator accounts adds a critical second authentication factor beyond passwords, mitigating credential theft, brute-force, and phishing attacks against Panorama's administrative logins. Option E is correct because restricting administrative access to dedicated out-of-band management networks or specific trusted IP addresses limits the attack surface by ensuring only authorized source networks can reach the management interface, blocking lateral movement and unauthorized external access. Options B, C, and D are incorrect: disabling HTTPS redirection would weaken security by allowing cleartext HTTP management sessions instead of forcing TLS-encrypted access; sharing a single superuser account destroys accountability and non-repudiation since actions cannot be attributed to individual analysts; and allowing unauthenticated HTTP management access from any internal IP exposes the management plane to eavesdropping, tampering, and unauthorized configuration changes.

Answer

Disable HTTPS redirection on the management interface

Answer

Share a single superuser account among all shift analysts to streamline shift handovers

Answer

Allow unauthenticated HTTP management access from any internal IP address

Question 18

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Accepted Answer

Persistence. Scheduled tasks and Windows Management Instrumentation (WMI) are both mechanisms that allow adversaries to maintain a foothold on a system across reboots. In MITRE ATT&CK, the Persistence tactic (TA0003) encompasses techniques like Scheduled Task/Job (T1053) and Windows Management Instrumentation Event Subscription (T1546.003), which are used to ensure continued access. These techniques are not about immediate damage, data gathering, or initial discovery, but about keeping access over time.

Answer

Impact

Answer

Collection

Answer

Reconnaissance

Question 19

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

Accepted Answer

WildFire Portal or firewall WildFire submission logs searched by file hash (SHA-256). The WildFire Portal and firewall WildFire submission logs both allow searching by file hash (SHA-256), which is the fastest way to check whether a specific sample has been analyzed across the enterprise. Searching by hash directly queries historical WildFire analysis results, matching the analyst's need.

Answer

Application Command Center (ACC) network activity tab

Answer

GlobalProtect client log exporter utility

Answer

Zone Protection event log viewer

Question 20

A SOC analyst receives an alert from Cortex XDR indicating that a user's endpoint has communicated with a known command-and-control (C2) server. The analyst verifies the alert and confirms the communication. According to the incident response process, which step should the analyst take first?

Accepted Answer

Isolate the endpoint from the network.. The correct answer is to isolate the endpoint from the network. This is the first containment step to stop communication with the C2 server and prevent further damage. Other actions like scanning or evidence collection should follow after isolation.

Answer

Collect forensic evidence from the endpoint.

Answer

Run a full antivirus scan on the endpoint.

Answer

Notify the user and ask them to disconnect from the network.