Cybersecurity-Practitioner Practice Questions 2 — 50 Questions

Question 1

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

URL Filtering profile configured with Credential Theft Prevention settings. URL Filtering profiles include Credential Theft Prevention features that inspect HTTP submissions against corporate credential settings.

Answer

Data Filtering profile configured for credit card pattern matching

Answer

Vulnerability Protection profile with HTTP header inspection

Answer

Anti-Spyware profile configured with DNS sinkholing

Question 2

An organization wants to inspect east-west traffic between different microservices running inside an Amazon Elastic Kubernetes Service (EKS) cluster using VM-Series firewalls. Which architectural pattern is recommended?

Accepted Answer

Route inter-subnet pod traffic through VM-Series firewall interfaces using AWS VPC route tables and secondary IP configurations.. East-west inspection in Kubernetes or public cloud environments is typically handled by container-native controls or by routing inter-subnet traffic through VM-Series firewalls acting as gateway routers using AWS Transit Gateway or custom routing tables.

Answer

Deploy Panorama as a sidecar container inside every Kubernetes pod namespace.

Answer

Attach the Prisma Access remote network VPN gateway directly to the Kubernetes cgroup filesystem.

Answer

Configure AWS Route 53 to proxy all TCP traffic between pods.

Question 3

An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?

Accepted Answer

Integrate the Prisma Cloud Compute CI/CD scanner plugin into the pipeline to block builds containing critical vulnerabilities.. Prisma Cloud Compute provides CI/CD scanner plugins (Jenkins, GitLab, GitHub Actions, etc.) that evaluate container images during the build phase and fail the build if vulnerabilities exceed a specified threshold.

Answer

Configure an AWS CloudWatch alarm to trigger a Lambda function that deletes the ECR registry repository.

Answer

Enable Prisma Access Threat Prevention on the CI/CD runner network interface.

Answer

Configure Prisma Cloud CSPM to automatically revoke AWS IAM credentials for the CI/CD builder.

Question 4

An administrator is configuring a secure IPsec VPN tunnel between an on-premises Palo Alto Networks firewall and a Prisma Access Remote Networks mobile gateway. During negotiation, Phase 2 fails. Where should the administrator check to view detailed IKE and IPsec negotiation error messages?

Accepted Answer

Run the CLI command `tail follow yes mp-log ikemgr.log` or check the System and GlobalProtect logs in Panorama/Firewall.. IPsec VPN troubleshooting on Palo Alto Networks firewalls is performed using the CLI command `tail follow yes mp-log ikemgr.log` or through the System > Logs > System/GlobalProtect or CLI operational commands.

Answer

Review the AWS VPC Flow Logs in the Amazon CloudWatch console.

Answer

Navigate to Prisma Cloud Compute > Monitor > Audit logs.

Answer

Open the WildFire submission report for the crypto module hash.

Question 5

Which TWO metrics or features are provided by Prisma Autonomous DEM (ADEM) to troubleshoot remote user application performance issues? (Choose two)

Accepted Answer

Synthetic test monitoring that periodically simulates user interactions and application access from remote locations.. ADEM provides synthetic testing (scripted user actions) and real-user monitoring (capturing device metrics, Wi-Fi, CPU, and network path latency).

Answer

Automated quarantine of infected container workloads in public cloud Kubernetes clusters.

Answer

Direct decryption and viewing of private banking user passwords traversing HTTPS sessions.

Answer

Automated firmware flashing for branch office switch hardware.

Question 6

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

Accepted Answer

Panorama Centralized Management. Panorama provides centralized management for both physical and virtual (VM-Series and CN-Series) firewalls across multi-cloud and on-prem environments.

Answer

AWS Systems Manager Parameter Store

Answer

Prisma Access Cloud Management Portal (CMP) for Remote Networks only.

Answer

Prisma Cloud Compute Console

Question 7

An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)

Accepted Answer

Advanced URL Filtering. Prisma Access natively integrates Advanced WildFire for malware analysis and Advanced URL Filtering / Advanced Threat Prevention for threat inspection.

Answer

Azure Sentinel Log Forwarder

Answer

AWS GuardDuty Threat Intelligence Exporter

Answer

Google Cloud Chronicle SIEM Connector

Question 8

Which TWO actions can an administrator perform within the Prisma Cloud Cloud Security Posture Management (CSPM) console to remediate misconfigured cloud resources? (Choose two)

Accepted Answer

Execute automated single-click or automated API-driven remediation scripts for supported resource misconfigurations.. Prisma Cloud CSPM allows administrators to view remediation CLI scripts, execute automated API remediation, or integrate with ticketing/SOAR tools.

Answer

Modify the PAN-OS dataplane packet buffer allocation settings on remote VM-Series firewalls.

Answer

Reboot physical branch routers connected to Prisma Access remote networks.

Answer

Directly patch the Linux kernel version running inside an AWS EC2 instance via SSH terminal emulation.

Question 9

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

Accepted Answer

Zone Protection profile configured with SYN Flood protection (SYN cookies or random drop). Zone Protection profiles include defenses against TCP SYN floods, port scans, and other layer 3/4 network attacks.

Answer

WildFire inline machine learning analysis engine

Answer

User-ID syslog mapping listener service

Answer

URL Filtering profile configured with credential theft prevention

Question 10

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID integrates the firewall with enterprise directory services to map IP addresses to usernames, enabling policy enforcement based on user and group identity.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud

Question 11

An organization's security policy requires that any detected malware file must be automatically blocked from entering the network during download. Which security profile and action combination ensures inline prevention against known malware?

Accepted Answer

Antivirus profile with action set to 'block' for all malware types and decoders. Antivirus profiles inspect file transfers and can be configured to block known malware signatures in real-time inline.

Answer

WildFire analysis profile with file forwarding set to 'async'

Answer

Data Filtering profile configured to drop executable file extensions

Answer

URL Filtering profile configured to block malicious download categories

Question 12

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Accepted Answer

WildFire cloud-based analysis and automated signature generation. WildFire provides cloud-based automated analysis of unknown files and generates global protections within minutes without waiting for manual signature releases.

Answer

Palo Alto Networks MineMeld open-source threat intelligence

Answer

Traps Advanced Endpoint Protection cloud service

Answer

AutoFocus Context-Aware Threat Intelligence service

Question 13

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of ports, allowing administrators to restrict traffic between internal tiers (e.g., web to database) down to the specific application command.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 14

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Accepted Answer

Panorama Administrative Roles and external authentication profiles (RADIUS/TACACS+/SAML). Administrators can be authenticated via external directory services (TACACS+, RADIUS, SAML) and assigned specific Administrative Roles for RBAC.

Answer

WildFire API token generation and management

Answer

User-ID clientless mapping via Windows User-ID Agent

Answer

GlobalProtect Portal client configuration profiles

Question 15

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Accepted Answer

GlobalProtect Host Information Profiles (HIP) combined with Security policy zone and posture criteria. GlobalProtect HIP (Host Information Profile) checks endpoint security posture (OS version, disk encryption, patch level) and feeds into security policies to restrict access.

Answer

WildFire automated sandbox analysis combined with Data Filtering profiles

Answer

User-ID agent IP-to-user mapping combined with NAT translation tables

Answer

App-ID application signatures combined with URL Filtering categories

Question 16

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Zero Trust principles include verifying explicitly, using least privilege access, and assuming breach while inspecting all traffic.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance

Question 17

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Accepted Answer

HA Active/Active mode with session synchronization enabled. HA Active/Active mode allows both firewalls to process traffic simultaneously, requiring session synchronization and floating IP addresses.

Answer

Cluster mode with dynamic routing ECMP multipath load balancing

Answer

Virtual Router redundancy protocol (VRRP) standalone failover groups

Answer

HA Active/Passive mode with preemption enabled

Question 18

An organization is implementing compliance controls to ensure that employees do not upload proprietary source code to unauthorized cloud storage providers. Which security profile feature should be utilized to control and log specific file transfers within recognized cloud applications?

Accepted Answer

File Blocking profile configured to block specific application file types. File Blocking profiles can be configured to block or log the upload or download of specific file types (such as source code archives or executables) within applications.

Answer

Data Filtering profile configured with URL category exceptions

Answer

WildFire analysis profile configured for static code review

Answer

URL Filtering profile configured with Custom URL categories

Question 19

An organization's security policy mandates that all software vulnerabilities with a CVSS score above 7.0 must be blocked at the network perimeter within 24 hours of disclosure. A new zero-day vulnerability is announced. While awaiting vendor patches, how can a Palo Alto Networks administrator immediately mitigate this threat using built-in platform features?

Accepted Answer

Apply a custom Vulnerability Protection signature or update the predefined threat signature action to 'block' for the specific CVE. Administrators can update Vulnerability Protection profiles or create custom vulnerability signatures to block exploit attempts targeting the newly disclosed flaw before a vendor patch is available.

Answer

Configure a custom URL Filtering category to block the vendor advisory website

Answer

Deploy an Application Override policy to drop all traffic using the affected application port

Answer

Enable strict WildFire forwarding for all outbound DNS requests originating from the server subnet

Question 20

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). URL filtering profile categories can be assigned actions such as block, allow, alert, continue, or override.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)