Cybersecurity-Practitioner Practice Test 8 — 10 Questions

Question 1

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. Zone protection or DoS Protection profiles with rate-limiting based on source IP and aggregate sessions protect against application-layer floods.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic

Question 2

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Accepted Answer

Command and Control. Command and control is the phase where an established malware or threat actor communicates with an external infrastructure to receive instructions or exfiltrate data, which matches outbound connections to a C2 IP.

Answer

Reconnaissance

Answer

Exploitation

Answer

Delivery

Question 3

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Accepted Answer

Security Profiles. Security profiles inspect data plane traffic for threats, malware, and policy violations and are collectively known as Security Profiles.

Answer

Zone Protection Profiles

Answer

Decryption Profiles

Answer

App-ID Custom Signature Objects

Question 4

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Accepted Answer

Create a Vulnerability Protection Exception for the specific threat ID, optionally restricting it to the source or destination IP. False positives in vulnerability protection can be resolved by creating a Vulnerability Protection Exception for the specific signature ID.

Answer

Disable the Vulnerability Protection profile globally across all security rules

Answer

Configure an Application Override policy for the custom API port

Answer

Delete the threat signature from the firewall's local database cache

Question 5

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Accepted Answer

GlobalProtect clientless VPN acting as a reverse proxy with SAML authentication. GlobalProtect service provider / SAML integration or Prisma Access proxy capabilities allow authentication enforcement before traffic reaches protected backend resources.

Answer

Zone Protection SYN proxy configuration

Answer

WildFire cloud analysis submission API

Answer

App-ID custom application signature generator

Question 6

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Accepted Answer

Administrator activity and authentication logs recording login timestamps and source IPs. Administrative accountability is maintained via Configuration Audit logs, Administrator Activity logs, and external authentication/RBAC.

Answer

Automated daily factory reset scripts executed on the management plane

Answer

Disabling all logging to prevent unauthorized access to log databases

Question 7

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Accepted Answer

Panorama Log Viewer / Firewall Traffic and Threat logs filtered by source IP address. Traffic logs combined with ACC (Application Command Center) or Panorama log queries allow detailed session-level forensic investigation per IP address.

Answer

Dynamic Address Group membership audit report

Answer

AutoFocus Campaign Tracker and malware family indicator list

Answer

GlobalProtect Clientless Portal connection history report

Question 8

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Accepted Answer

SQL Injection attacks. SQL injection and Cross-Site Scripting (XSS) are common application-layer web threats that can be detected by Vulnerability Protection signatures.

Answer

Fiber optic cable fiber cut

Answer

Physical server hardware power supply failure

Answer

Management plane cooling fan speed degradation

Question 9

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Accepted Answer

SSL Forward Proxy Decryption. SSL Forward Proxy decryption inspects outbound traffic to external servers by generating a forward proxy certificate on the firewall.

Answer

SSL Inbound Inspection Decryption

Answer

Kerberos Decryption Service integration

Answer

SSH Decryption Proxy mode

Question 10

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Accepted Answer

Antivirus profile. Antivirus and Vulnerability Protection profiles inspect content payloads for known malware and software exploit attempts, respectively.

Answer

Data Filtering profile

Answer

Zone Protection profile

Answer

URL Filtering profile