Cybersecurity-Practitioner Cloud Security Practice Test 2 — 15 Questions

Question 1

When setting up Prisma Access Mobile Users, what is the recommended client software installed on end-user laptops to establish secure connections to the cloud security processing nodes?

Accepted Answer

GlobalProtect app. GlobalProtect is the client software used to connect mobile users to Prisma Access.

Answer

Panorama Admin Agent

Answer

Prisma Cloud Defender Agent

Answer

Prisma Access CLI Client

Question 2

An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?

Accepted Answer

Real-time cloud-based machine learning analytics that analyze DNS query patterns and domain generation algorithms (DGAs).. DNS Security uses machine learning and predictive analytics in the cloud to identify malicious domains in real-time.

Answer

Enforcing DNSSEC validation on all outbound UDP port 53 traffic traversing the untrust interface.

Answer

Performing automated zone transfers (AXFR) with public root DNS servers every hour.

Answer

Local DNS response caching on the firewall hard drive to block blacklisted IP addresses.

Question 3

An organization wants to inspect east-west traffic between different microservices running inside an Amazon Elastic Kubernetes Service (EKS) cluster using VM-Series firewalls. Which architectural pattern is recommended?

Accepted Answer

Route inter-subnet pod traffic through VM-Series firewall interfaces using AWS VPC route tables and secondary IP configurations.. East-west inspection in Kubernetes or public cloud environments is typically handled by container-native controls or by routing inter-subnet traffic through VM-Series firewalls acting as gateway routers using AWS Transit Gateway or custom routing tables.

Answer

Deploy Panorama as a sidecar container inside every Kubernetes pod namespace.

Answer

Attach the Prisma Access remote network VPN gateway directly to the Kubernetes cgroup filesystem.

Answer

Configure AWS Route 53 to proxy all TCP traffic between pods.

Question 4

Which Prisma Cloud feature continuously scans cloud resource configurations to detect compliance violations against frameworks such as CIS Benchmarks, HIPAA, and PCI-DSS?

Accepted Answer

Prisma Cloud CSPM Compliance Dashboard. Prisma Cloud CSPM (Cloud Security Posture Management) performs continuous compliance and misconfiguration scanning.

Answer

WildFire Compliance Analyzer

Answer

Prisma Access Panorama Compliance Reporter

Answer

GlobalProtect Compliance Agent

Question 5

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

Accepted Answer

Inline Machine Learning analysis that evaluates web traffic and categorizes Newly Registered Domains (NRDs) in real-time.. Advanced URL Filtering uses inline machine learning to analyze web traffic and categorize newly registered domains (NRDs) instantly.

Answer

GlobalProtect endpoint registry checks for browser history.

Answer

Client-side proxy PAC file lookups against local browser blocklists.

Answer

Static URL database updates downloaded from Panorama once every 24 hours.

Question 6

An enterprise deploying VM-Series firewalls in Google Cloud Platform (GCP) requires centralized license management via Panorama. Which licensing mode should be configured so that firewalls automatically obtain their licenses from Panorama based on consumption or pre-purchased credits?

Accepted Answer

Configure VM-Series Bootstrap with a Panorama AuthKey and Plugin for VM-Series Auto-Registration and Software-based Licensing.. VM-Series firewalls support AuthCodes or VM-Series Bootstrap with Panorama using the CSS (Customer Support Portal) plugin and Smart Licensing / AuthCode provisioning. For cloud-native dynamic scaling, bootstrapping with Panorama auth keys and Auto-Registration is used.

Answer

Configure GCP Secret Manager to inject floating MAC addresses into the management interface.

Answer

Connect each VM-Series firewall directly to an on-premises hardware License Key Server (LKS) via a dedicated VPN.

Answer

Manually upload a permanent .lic license file via SSH to every autosscaled GCP instance upon boot.

Question 7

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

Accepted Answer

Automate the initial deployment configuration, licensing, software updates, and network settings without manual intervention.. Bootstrapping automates the initial configuration, licensing, and software versioning of a VM-Series firewall upon first boot.

Answer

Perform vulnerability scanning on the cloud provider's underlying hypervisor.

Answer

Encrypt all cloud storage volumes attached to the firewall instance before runtime.

Answer

Establish a secure SSH tunnel from the public cloud to the Palo Alto Networks TAC portal.

Question 8

An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?

Accepted Answer

Integrate the Prisma Cloud Compute CI/CD scanner plugin into the pipeline to block builds containing critical vulnerabilities.. Prisma Cloud Compute provides CI/CD scanner plugins (Jenkins, GitLab, GitHub Actions, etc.) that evaluate container images during the build phase and fail the build if vulnerabilities exceed a specified threshold.

Answer

Configure an AWS CloudWatch alarm to trigger a Lambda function that deletes the ECR registry repository.

Answer

Enable Prisma Access Threat Prevention on the CI/CD runner network interface.

Answer

Configure Prisma Cloud CSPM to automatically revoke AWS IAM credentials for the CI/CD builder.

Question 9

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

Accepted Answer

Prisma Autonomous DEM (ADEM) workspace in the Prisma Access management portal.. Autonomous DEM (ADEM) provides end-to-end digital experience monitoring from the endpoint or branch network to SaaS applications.

Answer

Panorama Traffic Log CSV export analyzed via spreadsheet formulas.

Answer

AWS CloudWatch Network Monitor dashboard.

Answer

WildFire Sample Analysis execution timeline graph.

Question 10

Which Palo Alto Networks product provides Cloud Infrastructure Entitlement Management (CIEM) to discover, analyze, and remediate excessive permissions and identities across multi-cloud environments?

Accepted Answer

Prisma Cloud IAM Security (CIEM). Prisma Cloud provides CIEM capabilities to manage identities and permissions across multi-cloud environments.

Answer

Prisma Access Identity Service

Answer

GlobalProtect Entitlement Manager

Answer

WildFire Entitlement Scanner

Question 11

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

Accepted Answer

Panorama Centralized Management. Panorama provides centralized management for both physical and virtual (VM-Series and CN-Series) firewalls across multi-cloud and on-prem environments.

Answer

AWS Systems Manager Parameter Store

Answer

Prisma Access Cloud Management Portal (CMP) for Remote Networks only.

Answer

Prisma Cloud Compute Console

Question 12

Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?

Accepted Answer

Resource Query Language (RQL). RQL (Resource Query Language) is the search and policy language used in Prisma Cloud.

Answer

GlobalProtect Log Language (GPLL)

Answer

Panorama Security Query Language (PSQL)

Answer

WildFire Query Syntax (WQS)

Question 13

An organization wants to secure a Kubernetes cluster using Prisma Cloud Compute. Which THREE capabilities can the Prisma Cloud Compute Defender provide for the cluster? (Choose three)

Accepted Answer

Runtime defense monitoring of container system calls to block unauthorized process execution and file modifications.. Prisma Cloud Compute Defender provides vulnerability scanning for images, runtime protection for containers, and compliance auditing for Kubernetes manifests and nodes.

Answer

BGP dynamic routing session establishment with external Azure ExpressRoute circuits.

Answer

Automatic remediation of AWS IAM user policy attachments via automated CLI execution.

Question 14

An administrator needs to configure Prisma Access to inspect traffic from remote workers using explicit proxy mode rather than the GlobalProtect tunnel. Which component or configuration is required for explicit proxy support in Prisma Access?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect portal agent configuration, specifying the Prisma Access proxy FQDN and port.. Prisma Access supports explicit proxy configurations, allowing mobile users to send HTTP/HTTPS requests to Prisma Access proxy nodes without establishing a full VPN tunnel.

Answer

Enable transparent proxy mode on the VM-Series trust interface using Generic Routing Encapsulation (GRE).

Answer

Configure AWS Route 53 resolver rules to forward proxy requests to WildFire.

Answer

Deploy an Apache Squid proxy server inside an AWS VPC and peer it with Panorama.

Question 15

An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)

Accepted Answer

Advanced URL Filtering. Prisma Access natively integrates Advanced WildFire for malware analysis and Advanced URL Filtering / Advanced Threat Prevention for threat inspection.

Answer

Azure Sentinel Log Forwarder

Answer

AWS GuardDuty Threat Intelligence Exporter

Answer

Google Cloud Chronicle SIEM Connector