Cybersecurity-Practitioner Practice Test 3 — 30 Questions

Question 1

A Cortex XDR administrator is reviewing endpoint protection profiles and notices that a group of endpoints has the Exploit protection module enabled but the Malware protection module disabled. The administrator wants to understand the security implication of this configuration. Which statement best describes the effect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The endpoints are protected against memory corruption attacks but not against known malicious files or behavior-based malware execution.. Exploit protection and Malware protection cover different threat classes. With Exploit protection enabled and Malware protection disabled, the endpoints resist memory corruption attacks but lack the file and behavior-based malware detection that Malware protection provides, leaving a meaningful gap that the administrator should address.

Answer

The endpoints are protected against malware but not against exploitation of vulnerable applications.

Answer

The endpoints cannot receive policy updates until Malware protection is re-enabled.

Answer

The endpoints are fully protected because Exploit protection includes signature-based malware detection.

Question 2

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Option A is correct because Zero Trust requires an 'assume breach' mindset: minimizing blast radius through microsegmentation and inspecting all traffic (including east-west) prevents lateral movement after a compromise. Option B is correct because 'verify explicitly' means every access request must be authenticated and authorized using all available signals—identity, location, device health, and other telemetry—rather than relying on a single credential check. Option C is correct because least privilege access enforces just-enough, just-in-time permissions via risk-based adaptive policies, limiting user and device reach to only what is needed. Option D is incorrect because implicitly trusting the internal network after VPN authentication is exactly the perimeter-based trust model Zero Trust rejects. Option E is incorrect because bypassing inspection for internal-to-internal traffic violates the assume-breach principle and would allow undetected lateral movement.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance

Question 3

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

Accepted Answer

Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.. Prisma Cloud CSPM (Cloud Security Posture Management) is the module that continuously evaluates cloud resource configurations against policies, and misconfigured IAM roles appear as Alerts there. Administrators can filter alerts by the AWS IAM service, use RQL to query the specific permissive policy, and apply built-in auto-remediation to fix the role. This is the correct workflow for viewing and remediating a cloud infrastructure misconfiguration.

Answer

Navigate to Panorama > Cloud Services > Native Security to update IAM roles.

Answer

Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.

Answer

Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.

Question 4

A newly hired administrator needs to confirm that a Windows endpoint's Cortex XDR agent is healthy and communicating with the management server. The administrator opens the endpoint's local agent console. Which status indicator should the administrator expect to see when the agent is fully operational and connected?

Accepted Answer

A green status showing the agent is connected and all protection modules are enabled.. When a Cortex XDR agent is fully operational, the local console shows a connected status with protection modules enabled, commonly represented in green. This indicates the agent is enrolled, communicating with the management server, and enforcing policy, which is the confirmation the administrator needs for a healthy endpoint.

Answer

A red status indicating the agent cannot reach the management server and is buffering events locally.

Answer

An amber status showing the agent is connected but one or more protection modules are disabled.

Answer

A gray status indicating the agent is in a pending registration state awaiting approval.

Question 5

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

Accepted Answer

Application whitelisting. Application whitelisting and endpoint detection and response (EDR) are both technical controls that directly mitigate malware execution. Whitelisting prevents unauthorized code from running, while EDR monitors and blocks malicious processes in real time. Together, they provide preventive and detective layers that are essential in a defense-in-depth strategy for endpoints.

Answer

Full disk encryption

Answer

Host-based firewall

Answer

Security awareness training

Question 6

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. The Antivirus Profile (A) is correct because it scans the allowed web traffic for malware, viruses, and exploit signatures, which directly addresses the requirement to inspect HTTP/HTTPS content for malicious payloads. The URL Filtering Profile (E) is correct because it inspects the requested URLs and categorizes them, allowing the firewall to block or alert on malicious, phishing, or otherwise risky web destinations. Together, these two profiles provide the layered content inspection needed for comprehensive outbound web protection. The QoS Profile (B) only manages bandwidth prioritization and does not inspect traffic for threats. The Zone Protection Profile (C) defends against flood and reconnaissance attacks at the ingress zone level, not against malicious URLs or malware in web sessions. The Network Access Profile (D) is not a valid security profile for content inspection and does not provide URL or malware filtering.

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 7

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

Accepted Answer

The external MFA server or Identity Provider integrated via RADIUS or SAML. The secondary MFA token (such as a push notification) is validated by the external MFA server or Identity Provider integrated via RADIUS or SAML. Prisma Access delegates the MFA challenge and validation to the configured authentication service, not to the firewall data plane or Panorama local database.

Answer

The Palo Alto Networks Next-Generation Firewall data plane

Answer

The Cortex XSOAR incident playbook engine

Answer

The local administrator database on Panorama

Question 8

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

Configured directly in the Agent Settings profile within the Cortex XDR console.. The proxy configuration for Cortex XDR agents is defined in the Agent Settings profile within the Cortex XDR console. This profile is pushed to agents, allowing them to use the specified proxy for communication.

Answer

Configured via the Windows Registry under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\Proxy.

Answer

Configured through the local Windows Internet Options control panel.

Answer

Managed automatically via DNS SRV records without console configuration.

Question 9

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Accepted Answer

Command and Control. The Command and Control (C2) phase of the Lockheed Martin cyber kill chain occurs when a compromised endpoint communicates with attacker-controlled infrastructure to receive instructions or exfiltrate data. Outbound connections to a known C2 IP address are the textbook indicator of this phase, as the attacker has already delivered and exploited the payload and is now maintaining remote control of the victim.

Answer

Reconnaissance

Answer

Exploitation

Answer

Delivery

Question 10

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

Accepted Answer

Anti-Spyware profile with DNS Signature enforcement. To prevent internal hosts from resolving malicious domains, the firewall must inspect DNS queries. The Anti-Spyware profile includes DNS Signatures that can detect and block DNS queries to known malicious domains. When attached to a Security rule, it enforces DNS sinkholing or blocking based on Palo Alto Networks threat intelligence. URL Filtering, Data Filtering, and Vulnerability Protection profiles do not provide DNS-level blocking for malicious domains.

Answer

URL Filtering profile with custom block lists

Answer

Data Filtering profile with pre-defined patterns

Answer

Vulnerability Protection profile with severity filters

Question 11

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) is the feature that classifies, prioritizes, and schedules traffic to ensure critical server traffic is treated preferentially over guest internet traffic during congestion. QoS policies on Palo Alto Networks firewalls use QoS profiles and QoS policy rules to assign traffic to classes and apply bandwidth guarantees, limits, and priority (real-time, high, medium, low).

Answer

User-ID

Answer

GlobalProtect

Answer

WildFire

Question 12

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

Accepted Answer

Embedded machine learning classifiers executed directly on the endpoint.. Cortex XDR's Local Analysis engine uses embedded machine learning classifiers that run directly on the endpoint, enabling detection of malicious behavior such as Living off the Land techniques without needing cloud connectivity. These local models analyze process behavior, command-line arguments, and other telemetry in real time, which is essential for offline or air-gapped environments.

Answer

Periodic scheduled scans against the Palo Alto Networks threat intelligence cloud.

Answer

Real-time signature matching against a local antivirus definition database.

Answer

Continuous DNS tunneling queries sent to WildFire.

Question 13

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Creating a Profile Exception in the Malware Profile using the SHA-256 hash of the executable is the most granular method to whitelist the application. This approach ensures that only the specific, verified version of the file is allowed, maintaining a strong security posture by not broadly excluding paths or disabling protections. It leverages Cortex XDR's ability to allow known good files based on their unique cryptographic hash.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 14

A SOC analyst is reviewing a Cortex XDR incident that includes multiple alerts across several endpoints. The analyst wants to identify the common root cause and prioritize remediation. Which Cortex XDR feature should the analyst use to visualize the relationships between alerts and affected hosts?

Accepted Answer

The incident view, which aggregates related alerts and shows the causality chain across endpoints.. The incident view is the correct feature because it aggregates related alerts into a single incident and provides a cross-endpoint causality chain, enabling the analyst to see the common root cause and prioritize remediation. Other features like the alert timeline or endpoint list do not correlate alerts across hosts.

Answer

The endpoint list, which shows all endpoints with their current risk scores and alert counts.

Answer

The threat intelligence module, which provides reputation data for indicators observed in the alerts.

Answer

The alert timeline, which displays all alerts in chronological order without grouping.

Question 15

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. The management plane handles control and administrative functions, so option A is correct because excessive XML API calls or frequent script-based configuration pushes consume management-plane CPU for parsing, validation, and commit processing. Option C is correct because logging queries, traffic log exports, and Panorama log forwarding are management-plane tasks that can heavily load the CPU when volumes are high. Option D is correct because External Dynamic List downloads are retrieved and processed by the management plane, and large or frequent EDL refreshes can saturate its retrieval threads. Option B is incorrect because next-hop packet re-synthesis and Layer 3 forwarding table issues occur on the data plane, not the management plane. Option E is incorrect because GlobalProtect Gateway SSL VPN data tunnel encryption is handled by data-plane processing, not the management plane.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 16

A Cortex XDR administrator needs to prevent a specific known-malicious executable from running on all Windows endpoints in the environment, regardless of file name changes. Which Cortex XDR capability should be configured to block the file based on its hash?

Accepted Answer

Malware profile with a hash-based blocklist entry. Configuring a malware profile with a hash-based blocklist entry is the correct approach because Cortex XDR can match files by their SHA-256 hash, which remains constant even when the file name changes. Exploit protection, behavioral threat protection, and path-based restriction policies do not provide hash-based blocking, so they cannot reliably stop a renamed malicious executable.

Answer

Behavioral threat protection policy with a process exception

Answer

Exploit protection module with a custom signature

Answer

Restriction policy with a path-based allow list

Question 17

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Accepted Answer

Vishing. The scenario involves a telephone-based deception in which an attacker impersonates IT support to obtain a one-time passcode. Voice phishing, or vishing, is the correct classification because the manipulation occurs through a live phone call. Recognizing the delivery channel is essential, since email phishing, SMS phishing, and physical intrusion techniques each have distinct indicators that do not match this situation.

Answer

Smishing

Answer

Watering hole attack

Answer

Tailgating

Question 18

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

Accepted Answer

The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.. The EDL is configured as type 'IP', meaning it expects a list of IPv4 addresses. If the file contains domain names instead, the firewall cannot parse them as IP addresses, resulting in 'parsing error' entries and the EDL failing to populate correctly. Consequently, security rules referencing the EDL do not match any IPs and fail to block traffic.

Answer

External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.

Answer

The firewall management plane does not have an outbound route to the internet to download the file.

Answer

The EDL update schedule is set to 'daily' instead of 'real-time'.

Question 19

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of port or protocol, allowing internal segmentation firewalls to enforce granular, application-aware policies between tiers in the same zone. This lets the firewall permit, for example, only database traffic from the app tier to the DB tier while blocking everything else, achieving microsegmentation.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 20

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

Accepted Answer

Execution. Under MITRE ATT&CK, the Execution tactic (TA0002) covers techniques that result in adversary-controlled code running on a local or remote system, including Command and Scripting Interpreter (T1059) for PowerShell and Signed Binary Proxy Execution / System Binary Proxy Execution (T1218) for Certutil. Using living-off-the-land binaries to download and run payloads is a classic Execution-tactic behavior.

Answer

Resource Development

Answer

Exfiltration

Answer

Reconnaissance