Cybersecurity-Practitioner Practice Test 6 — 10 Questions

Question 1

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication Profile under Device > Authentication referencing the RADIUS server profile.. Option E is correct because the firewall must first define a RADIUS Server Profile under Device > Server Profiles > RADIUS, which specifies the RADIUS server's IP address, shared secret, port (default 1812 for authentication), and timeout/retry settings so the firewall can communicate with the external RADIUS server. Option D is correct because an Authentication Profile under Device > Authentication must be created to reference that RADIUS server profile, defining the authentication method and allowed user/group lists, and this profile is then applied to the management interface or administrative accounts to enforce RADIUS-based admin login. Option A is incorrect because an External Dynamic List is used to import IP addresses, URLs, or domains for policy enforcement, not to point to a RADIUS authentication database. Option B is incorrect because a WildFire Analysis Profile submits files to the WildFire cloud for malware analysis and has nothing to do with user authentication. Option C is incorrect because an SSL Decryption Profile is used to decrypt and inspect SSL/TLS traffic, not to authenticate administrative access on the management interface.

Answer

External Dynamic List (EDL) pointing to the RADIUS authentication database.

Answer

WildFire Analysis Profile set to authenticate users.

Answer

SSL Decryption Profile attached to the management interface.

Question 2

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. The question describes two distinct adversary behaviors: 'leveraged valid accounts to maintain persistence' and 'modifying group memberships to escalate privileges.' In MITRE ATT&CK, Valid Accounts (T1078) is explicitly categorized under both Initial Access and Persistence, while Account Manipulation (T1098) — which includes modifying group memberships — is categorized under Persistence and Privilege Escalation. Therefore, the two tactics that best describe these observed phases are Persistence and Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 3

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the best fit for zero trust because it makes access decisions based on a combination of attributes, including user identity, device health, and environmental context. This dynamic, policy-driven approach supports continuous verification and least privilege, which are core to zero trust.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 4

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore network connectivity to an isolated endpoint in Cortex XDR, the administrator goes to Endpoint Management, selects the endpoint, clicks Action, and chooses Remove Isolation. This action lifts the isolation policy and allows the endpoint to communicate on the network again. It is the standard, documented workflow after remediation is verified.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 5

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Accepted Answer

Deploy using the AWS GWLB quick start template with Geneve encapsulation configured on the VM-Series data interfaces.. The AWS Gateway Load Balancer (GWLB) quick start template for Palo Alto VM-Series is purpose-built to deploy the firewall in a transparent bump-in-the-wire architecture. GWLB uses GENEVE encapsulation (UDP port 6081) to forward traffic to the firewall's data interfaces, and the VM-Series decapsulates, inspects, and re-encapsulates the packet back to GWLB — no destination NAT is required because the original packet headers are preserved. This is the standard, supported deployment method documented by both AWS and Palo Alto.

Answer

Deploy a standard VPC peering connection and configure AWS Client VPN endpoints to steer traffic to the untrust interface.

Answer

Use AWS Lambda functions to dynamically update security group rules whenever a new workload instance is provisioned.

Answer

Configure an AWS Transit Gateway with route tables pointing to an Elastic Load Balancer in front of the VM-Series trust interface.

Question 6

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

Accepted Answer

Prisma Autonomous DEM (ADEM) workspace in the Prisma Access management portal.. Prisma Autonomous DEM (ADEM) is a digital experience monitoring solution integrated with Prisma Access that provides end-to-end visibility into user experience, including path performance, latency, packet loss, and application response times. It uses synthetic agents on endpoints to continuously test and measure network conditions between users and applications, making it the correct tool for analyzing SaaS application performance issues from a branch office. ADEM's workspace in the Prisma Access management portal offers dashboards and drill-downs specifically for these metrics.

Answer

Panorama Traffic Log CSV export analyzed via spreadsheet formulas.

Answer

AWS CloudWatch Network Monitor dashboard.

Answer

WildFire Sample Analysis execution timeline graph.

Question 7

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

Accepted Answer

The file was unknown to WildFire at execution time and was subsequently sent for analysis, resulting in a retroactive verdict.. The most likely explanation is that the file was unknown to WildFire at execution time, so the local agent allowed it to run while submitting it for cloud analysis; WildFire then returned a malicious verdict, enabling retroactive blocking. This is the standard WildFire workflow: unknown files are detonated in the cloud, and the verdict is applied after analysis completes.

Answer

WildFire only analyzes network traffic passing through a Palo Alto Networks Next-Generation Firewall.

Answer

Local analysis blocks all files by default without cloud consultation.

Answer

The Cortex XDR agent does not integrate with WildFire cloud intelligence.

Question 8

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Accepted Answer

Data Filtering profile. The Data Filtering profile is specifically designed to inspect traffic for sensitive data patterns such as credit card numbers, Social Security numbers, and custom regex patterns, and to block or alert on that data leaving the network. It is the only PAN-OS security profile purpose-built for DLP-style content inspection of outbound flows. Tuning it involves defining data patterns, file types, and the action (alert, block, or forward) for each direction.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 9

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control. The repeated contacts from an endpoint to a known C2 server indicate that the attacker has established a communication channel to control the compromised system. This is the Command and Control phase of the Cyber Kill Chain, which follows installation and precedes actions on objectives. The other phases occur earlier in the attack lifecycle and do not involve active C2 traffic.

Answer

Reconnaissance

Answer

Actions on Objectives

Answer

Weaponization

Question 10

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

Accepted Answer

Define a device control rule that blocks the USB mass storage device class. A device control rule that blocks the USB mass storage device class establishes the restriction, and an exception for approved encrypted drives by vendor and product ID permits only authorized devices. Exploit protection, report-only mode, and malware profile blocklists do not enforce device access control, so they cannot satisfy the requirement.

Answer

Set the agent to report-only mode for device control

Answer

Enable the exploit protection module for USB drivers

Answer

Add the USB mass storage class to the malware profile blocklist