Cybersecurity-Practitioner Practice Questions 2 — 50 Questions

Question 1

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication Profile under Device > Authentication referencing the RADIUS server profile.. Option E is correct because the firewall must first define a RADIUS Server Profile under Device > Server Profiles > RADIUS, which specifies the RADIUS server's IP address, shared secret, port (default 1812 for authentication), and timeout/retry settings so the firewall can communicate with the external RADIUS server. Option D is correct because an Authentication Profile under Device > Authentication must be created to reference that RADIUS server profile, defining the authentication method and allowed user/group lists, and this profile is then applied to the management interface or administrative accounts to enforce RADIUS-based admin login. Option A is incorrect because an External Dynamic List is used to import IP addresses, URLs, or domains for policy enforcement, not to point to a RADIUS authentication database. Option B is incorrect because a WildFire Analysis Profile submits files to the WildFire cloud for malware analysis and has nothing to do with user authentication. Option C is incorrect because an SSL Decryption Profile is used to decrypt and inspect SSL/TLS traffic, not to authenticate administrative access on the management interface.

Answer

External Dynamic List (EDL) pointing to the RADIUS authentication database.

Answer

WildFire Analysis Profile set to authenticate users.

Answer

SSL Decryption Profile attached to the management interface.

Question 2

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. The question describes two distinct adversary behaviors: 'leveraged valid accounts to maintain persistence' and 'modifying group memberships to escalate privileges.' In MITRE ATT&CK, Valid Accounts (T1078) is explicitly categorized under both Initial Access and Persistence, while Account Manipulation (T1098) — which includes modifying group memberships — is categorized under Persistence and Privilege Escalation. Therefore, the two tactics that best describe these observed phases are Persistence and Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 3

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the best fit for zero trust because it makes access decisions based on a combination of attributes, including user identity, device health, and environmental context. This dynamic, policy-driven approach supports continuous verification and least privilege, which are core to zero trust.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 4

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore network connectivity to an isolated endpoint in Cortex XDR, the administrator goes to Endpoint Management, selects the endpoint, clicks Action, and chooses Remove Isolation. This action lifts the isolation policy and allows the endpoint to communicate on the network again. It is the standard, documented workflow after remediation is verified.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 5

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. The AWS Gateway Load Balancer (GWLB) quick start template for Palo Alto VM-Series is purpose-built to deploy the firewall in a transparent bump-in-the-wire architecture. GWLB uses GENEVE encapsulation (UDP port 6081) to forward traffic to the firewall's data interfaces, and the VM-Series decapsulates, inspects, and re-encapsulates the packet back to GWLB — no destination NAT is required because the original packet headers are preserved. This is the standard, supported deployment method documented by both AWS and Palo Alto.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.

Question 6

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

Accepted Answer

Prisma Autonomous DEM (ADEM) workspace in the Prisma Access management portal.. Prisma Autonomous DEM (ADEM) is a digital experience monitoring solution integrated with Prisma Access that provides end-to-end visibility into user experience, including path performance, latency, packet loss, and application response times. It uses synthetic agents on endpoints to continuously test and measure network conditions between users and applications, making it the correct tool for analyzing SaaS application performance issues from a branch office. ADEM's workspace in the Prisma Access management portal offers dashboards and drill-downs specifically for these metrics.

Answer

Panorama Traffic Log CSV export analyzed via spreadsheet formulas.

Answer

AWS CloudWatch Network Monitor dashboard.

Answer

WildFire Sample Analysis execution timeline graph.

Question 7

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

Accepted Answer

The file was unknown to WildFire at execution time and was subsequently sent for analysis, resulting in a retroactive verdict.. The most likely explanation is that the file was unknown to WildFire at execution time, so the local agent allowed it to run while submitting it for cloud analysis; WildFire then returned a malicious verdict, enabling retroactive blocking. This is the standard WildFire workflow: unknown files are detonated in the cloud, and the verdict is applied after analysis completes.

Answer

WildFire only analyzes network traffic passing through a Palo Alto Networks Next-Generation Firewall.

Answer

Local analysis blocks all files by default without cloud consultation.

Answer

The Cortex XDR agent does not integrate with WildFire cloud intelligence.

Question 8

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Accepted Answer

Data Filtering profile. The Data Filtering profile is specifically designed to inspect traffic for sensitive data patterns such as credit card numbers, Social Security numbers, and custom regex patterns, and to block or alert on that data leaving the network. It is the only PAN-OS security profile purpose-built for DLP-style content inspection of outbound flows. Tuning it involves defining data patterns, file types, and the action (alert, block, or forward) for each direction.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 9

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control. The repeated contacts from an endpoint to a known C2 server indicate that the attacker has established a communication channel to control the compromised system. This is the Command and Control phase of the Cyber Kill Chain, which follows installation and precedes actions on objectives. The other phases occur earlier in the attack lifecycle and do not involve active C2 traffic.

Answer

Reconnaissance

Answer

Actions on Objectives

Answer

Weaponization

Question 10

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

Accepted Answer

Define a device control rule that blocks the USB mass storage device class. A device control rule that blocks the USB mass storage device class establishes the restriction, and an exception for approved encrypted drives by vendor and product ID permits only authorized devices. Exploit protection, report-only mode, and malware profile blocklists do not enforce device access control, so they cannot satisfy the requirement.

Answer

Set the agent to report-only mode for device control

Answer

Enable the exploit protection module for USB drivers

Answer

Add the USB mass storage class to the malware profile blocklist

Question 11

A Cortex XDR administrator is reviewing endpoint protection profiles and notices that a group of endpoints has the Exploit protection module enabled but the Malware protection module disabled. The administrator wants to understand the security implication of this configuration. Which statement best describes the effect?

Accepted Answer

The endpoints are protected against memory corruption attacks but not against known malicious files or behavior-based malware execution.. Exploit protection and Malware protection cover different threat classes. With Exploit protection enabled and Malware protection disabled, the endpoints resist memory corruption attacks but lack the file and behavior-based malware detection that Malware protection provides, leaving a meaningful gap that the administrator should address.

Answer

The endpoints are protected against malware but not against exploitation of vulnerable applications.

Answer

The endpoints cannot receive policy updates until Malware protection is re-enabled.

Answer

The endpoints are fully protected because Exploit protection includes signature-based malware detection.

Question 12

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Option A is correct because Zero Trust requires an 'assume breach' mindset: minimizing blast radius through microsegmentation and inspecting all traffic (including east-west) prevents lateral movement after a compromise. Option B is correct because 'verify explicitly' means every access request must be authenticated and authorized using all available signals—identity, location, device health, and other telemetry—rather than relying on a single credential check. Option C is correct because least privilege access enforces just-enough, just-in-time permissions via risk-based adaptive policies, limiting user and device reach to only what is needed. Option D is incorrect because implicitly trusting the internal network after VPN authentication is exactly the perimeter-based trust model Zero Trust rejects. Option E is incorrect because bypassing inspection for internal-to-internal traffic violates the assume-breach principle and would allow undetected lateral movement.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance

Question 13

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

Accepted Answer

Navigate to Prisma Cloud CSPM > Alerts, filter by AWS IAM service, and use RQL or built-in auto-remediation.. Prisma Cloud CSPM (Cloud Security Posture Management) is the module that continuously evaluates cloud resource configurations against policies, and misconfigured IAM roles appear as Alerts there. Administrators can filter alerts by the AWS IAM service, use RQL to query the specific permissive policy, and apply built-in auto-remediation to fix the role. This is the correct workflow for viewing and remediating a cloud infrastructure misconfiguration.

Answer

Navigate to Panorama > Cloud Services > Native Security to update IAM roles.

Answer

Navigate to Prisma Cloud Compute > Vulnerabilities > Functions to review IAM policy JSON files.

Answer

Navigate to Prisma Access > Traffic > Monitor to inspect IAM API call logs.

Question 14

A newly hired administrator needs to confirm that a Windows endpoint's Cortex XDR agent is healthy and communicating with the management server. The administrator opens the endpoint's local agent console. Which status indicator should the administrator expect to see when the agent is fully operational and connected?

Accepted Answer

A green status showing the agent is connected and all protection modules are enabled.. When a Cortex XDR agent is fully operational, the local console shows a connected status with protection modules enabled, commonly represented in green. This indicates the agent is enrolled, communicating with the management server, and enforcing policy, which is the confirmation the administrator needs for a healthy endpoint.

Answer

A red status indicating the agent cannot reach the management server and is buffering events locally.

Answer

An amber status showing the agent is connected but one or more protection modules are disabled.

Answer

A gray status indicating the agent is in a pending registration state awaiting approval.

Question 15

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

Accepted Answer

Application whitelisting. Application whitelisting and endpoint detection and response (EDR) are both technical controls that directly mitigate malware execution. Whitelisting prevents unauthorized code from running, while EDR monitors and blocks malicious processes in real time. Together, they provide preventive and detective layers that are essential in a defense-in-depth strategy for endpoints.

Answer

Full disk encryption

Answer

Host-based firewall

Answer

Security awareness training

Question 16

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. The Antivirus Profile (A) is correct because it scans the allowed web traffic for malware, viruses, and exploit signatures, which directly addresses the requirement to inspect HTTP/HTTPS content for malicious payloads. The URL Filtering Profile (E) is correct because it inspects the requested URLs and categorizes them, allowing the firewall to block or alert on malicious, phishing, or otherwise risky web destinations. Together, these two profiles provide the layered content inspection needed for comprehensive outbound web protection. The QoS Profile (B) only manages bandwidth prioritization and does not inspect traffic for threats. The Zone Protection Profile (C) defends against flood and reconnaissance attacks at the ingress zone level, not against malicious URLs or malware in web sessions. The Network Access Profile (D) is not a valid security profile for content inspection and does not provide URL or malware filtering.

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 17

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

Accepted Answer

The external MFA server or Identity Provider integrated via RADIUS or SAML. The secondary MFA token (such as a push notification) is validated by the external MFA server or Identity Provider integrated via RADIUS or SAML. Prisma Access delegates the MFA challenge and validation to the configured authentication service, not to the firewall data plane or Panorama local database.

Answer

The Palo Alto Networks Next-Generation Firewall data plane

Answer

The Cortex XSOAR incident playbook engine

Answer

The local administrator database on Panorama

Question 18

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

Configured directly in the Agent Settings profile within the Cortex XDR console.. The proxy configuration for Cortex XDR agents is defined in the Agent Settings profile within the Cortex XDR console. This profile is pushed to agents, allowing them to use the specified proxy for communication.

Answer

Configured via the Windows Registry under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\Proxy.

Answer

Configured through the local Windows Internet Options control panel.

Answer

Managed automatically via DNS SRV records without console configuration.

Question 19

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Accepted Answer

Command and Control. The Command and Control (C2) phase of the Lockheed Martin cyber kill chain occurs when a compromised endpoint communicates with attacker-controlled infrastructure to receive instructions or exfiltrate data. Outbound connections to a known C2 IP address are the textbook indicator of this phase, as the attacker has already delivered and exploited the payload and is now maintaining remote control of the victim.

Answer

Reconnaissance

Answer

Exploitation

Answer

Delivery

Question 20

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

Accepted Answer

Anti-Spyware profile with DNS Signature enforcement. To prevent internal hosts from resolving malicious domains, the firewall must inspect DNS queries. The Anti-Spyware profile includes DNS Signatures that can detect and block DNS queries to known malicious domains. When attached to a Security rule, it enforces DNS sinkholing or blocking based on Palo Alto Networks threat intelligence. URL Filtering, Data Filtering, and Vulnerability Protection profiles do not provide DNS-level blocking for malicious domains.

Answer

URL Filtering profile with custom block lists

Answer

Data Filtering profile with pre-defined patterns

Answer

Vulnerability Protection profile with severity filters