Cybersecurity-Practitioner Practice Test 8 — 10 Questions

Question 1

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

Accepted Answer

Quality of Service (QoS). Quality of Service (QoS) is the feature that classifies, prioritizes, and schedules traffic to ensure critical server traffic is treated preferentially over guest internet traffic during congestion. QoS policies on Palo Alto Networks firewalls use QoS profiles and QoS policy rules to assign traffic to classes and apply bandwidth guarantees, limits, and priority (real-time, high, medium, low).

Answer

User-ID

Answer

GlobalProtect

Answer

WildFire

Question 2

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

Accepted Answer

Embedded machine learning classifiers executed directly on the endpoint.. Cortex XDR's Local Analysis engine uses embedded machine learning classifiers that run directly on the endpoint, enabling detection of malicious behavior such as Living off the Land techniques without needing cloud connectivity. These local models analyze process behavior, command-line arguments, and other telemetry in real time, which is essential for offline or air-gapped environments.

Answer

Periodic scheduled scans against the Palo Alto Networks threat intelligence cloud.

Answer

Real-time signature matching against a local antivirus definition database.

Answer

Continuous DNS tunneling queries sent to WildFire.

Question 3

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Creating a Profile Exception in the Malware Profile using the SHA-256 hash of the executable is the most granular method to whitelist the application. This approach ensures that only the specific, verified version of the file is allowed, maintaining a strong security posture by not broadly excluding paths or disabling protections. It leverages Cortex XDR's ability to allow known good files based on their unique cryptographic hash.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 4

A SOC analyst is reviewing a Cortex XDR incident that includes multiple alerts across several endpoints. The analyst wants to identify the common root cause and prioritize remediation. Which Cortex XDR feature should the analyst use to visualize the relationships between alerts and affected hosts?

Accepted Answer

The incident view, which aggregates related alerts and shows the causality chain across endpoints.. The incident view is the correct feature because it aggregates related alerts into a single incident and provides a cross-endpoint causality chain, enabling the analyst to see the common root cause and prioritize remediation. Other features like the alert timeline or endpoint list do not correlate alerts across hosts.

Answer

The endpoint list, which shows all endpoints with their current risk scores and alert counts.

Answer

The threat intelligence module, which provides reputation data for indicators observed in the alerts.

Answer

The alert timeline, which displays all alerts in chronological order without grouping.

Question 5

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. The management plane handles control and administrative functions, so option A is correct because excessive XML API calls or frequent script-based configuration pushes consume management-plane CPU for parsing, validation, and commit processing. Option C is correct because logging queries, traffic log exports, and Panorama log forwarding are management-plane tasks that can heavily load the CPU when volumes are high. Option D is correct because External Dynamic List downloads are retrieved and processed by the management plane, and large or frequent EDL refreshes can saturate its retrieval threads. Option B is incorrect because next-hop packet re-synthesis and Layer 3 forwarding table issues occur on the data plane, not the management plane. Option E is incorrect because GlobalProtect Gateway SSL VPN data tunnel encryption is handled by data-plane processing, not the management plane.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 6

A Cortex XDR administrator needs to prevent a specific known-malicious executable from running on all Windows endpoints in the environment, regardless of file name changes. Which Cortex XDR capability should be configured to block the file based on its hash?

Accepted Answer

Malware profile with a hash-based blocklist entry. Configuring a malware profile with a hash-based blocklist entry is the correct approach because Cortex XDR can match files by their SHA-256 hash, which remains constant even when the file name changes. Exploit protection, behavioral threat protection, and path-based restriction policies do not provide hash-based blocking, so they cannot reliably stop a renamed malicious executable.

Answer

Behavioral threat protection policy with a process exception

Answer

Exploit protection module with a custom signature

Answer

Restriction policy with a path-based allow list

Question 7

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Accepted Answer

Vishing. The scenario involves a telephone-based deception in which an attacker impersonates IT support to obtain a one-time passcode. Voice phishing, or vishing, is the correct classification because the manipulation occurs through a live phone call. Recognizing the delivery channel is essential, since email phishing, SMS phishing, and physical intrusion techniques each have distinct indicators that do not match this situation.

Answer

Smishing

Answer

Watering hole attack

Answer

Tailgating

Question 8

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

Accepted Answer

The EDL file contains domain names instead of IPv4 addresses while the EDL type is configured as IP.. The EDL is configured as type 'IP', meaning it expects a list of IPv4 addresses. If the file contains domain names instead, the firewall cannot parse them as IP addresses, resulting in 'parsing error' entries and the EDL failing to populate correctly. Consequently, security rules referencing the EDL do not match any IPs and fail to block traffic.

Answer

External dynamic lists require a valid Anti-Spyware profile attached to the security rule to parse correctly.

Answer

The firewall management plane does not have an outbound route to the internet to download the file.

Answer

The EDL update schedule is set to 'daily' instead of 'real-time'.

Question 9

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of port or protocol, allowing internal segmentation firewalls to enforce granular, application-aware policies between tiers in the same zone. This lets the firewall permit, for example, only database traffic from the app tier to the DB tier while blocking everything else, achieving microsegmentation.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 10

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

Accepted Answer

Execution. Under MITRE ATT&CK, the Execution tactic (TA0002) covers techniques that result in adversary-controlled code running on a local or remote system, including Command and Scripting Interpreter (T1059) for PowerShell and Signed Binary Proxy Execution / System Binary Proxy Execution (T1218) for Certutil. Using living-off-the-land binaries to download and run payloads is a classic Execution-tactic behavior.

Answer

Resource Development

Answer

Exfiltration

Answer

Reconnaissance