Cybersecurity-Practitioner Cybersecurity Fundamentals — All Questions With Answers

Question 1easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is reviewing firewall logs and notices multiple outbound connection attempts from a client workstation to known command and control IP addresses. Which security profile component is primarily responsible for generating a threat log entry for this specific outbound traffic?

Question 2mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is implementing compliance controls to ensure that employees do not upload proprietary source code to unauthorized cloud storage providers. Which security profile feature should be utilized to control and log specific file transfers within recognized cloud applications?

Question 3easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) team wants to reduce alert fatigue by ensuring that low-severity threat events do not inundate their SIEM, while ensuring high-severity exploit attempts trigger immediate escalation. How should the administrator configure the security profiles to manage this?

Question 4hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization's security policy mandates that all software vulnerabilities with a CVSS score above 7.0 must be blocked at the network perimeter within 24 hours of disclosure. A new zero-day vulnerability is announced. While awaiting vendor patches, how can a Palo Alto Networks administrator immediately mitigate this threat using built-in platform features?

Question 5mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization's security policy requires that any detected malware file must be automatically blocked from entering the network during download. Which security profile and action combination ensures inline prevention against known malware?

Question 6easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator wants to ensure that administrators accessing the Palo Alto Networks firewall management plane do so securely using encrypted sessions and strong cryptographic keys. Which configuration area manages management plane access protocols and administrative ciphers?

Question 7hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Question 8easymulti select

Read the full Cybersecurity Fundamentals explanation →

An administrator is reviewing firewall high availability (HA) states and configuration parameters. Which TWO settings must be identical on both firewall peers in an HA pair to ensure successful synchronization and cluster formation? (Choose two)

Question 9easymultiple choice

Read the full VPN explanation →

A security administrator notices a surge in brute-force login attempts against the external VPN gateway. The firewall successfully logs and drops these malicious sessions using an Anti-Spyware profile. Which common cyber threat vector is the firewall primarily defending against?

Question 10easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security engineer is implementing the principle of least privilege for a group of developers who need temporary access to a production database. The developers should only be able to query data, not modify it, and their access should expire after 8 hours. Which access control model best fits this requirement?

Question 11mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a recent security incident and needs to determine the extent of the compromise. The analyst has identified a malicious file hash and wants to search historical network traffic logs to see if any internal hosts have communicated with external IPs associated with the hash. Which Palo Alto Networks feature should the analyst use?

Question 12mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a suspected compromised workstation. The analyst observes that the workstation is communicating with an external IP address on port 443, but the traffic is not TLS. The analyst also finds a scheduled task that runs a PowerShell script at startup. Which stage of the Cyber Kill Chain is most likely represented by these activities?

Question 13hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security team is implementing a defense-in-depth strategy to protect against ransomware. They want to focus on controls that can prevent the initial execution of ransomware on endpoints. Which two controls are most effective for this goal? (Choose two.)

Question 14mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

Question 15hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

Question 16easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Question 17hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Question 18mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Question 19mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Question 20easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Question 21mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A company's risk management framework requires multi-factor authentication (MFA) for all remote access connections. The organization utilizes GlobalProtect for remote workers. Where should the administrator configure the authentication profile to enforce MFA during the GlobalProtect connection phase?

Question 22hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

Question 23easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Question 24easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

Question 25mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Question 26mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Question 27hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Question 28easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

Question 29hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Question 30hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Question 31easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Question 32mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Question 33easymulti select

Read the full Cybersecurity Fundamentals explanation →

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Question 34mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

Question 35hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Question 36easymulti select

Read the full Cybersecurity Fundamentals explanation →

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

Question 37hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Question 38hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Question 39mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

Question 40easymulti select

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Question 41hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Question 42mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Question 43mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

Question 44mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

Question 45easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Question 46hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

Question 47hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

Question 48easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Question 49hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

Question 50mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

Question 51mediummulti select

Read the full Cybersecurity Fundamentals explanation →

An organization is reviewing its threat intelligence feeds and security posture to prepare for advanced persistent threat (APT) campaigns. Which TWO characteristics are typically associated with advanced persistent threats? (Choose two)

Question 52mediummulti select

Read the full Cybersecurity Fundamentals explanation →

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Question 53hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security operations team is implementing zero trust network access (ZTNA) principles across the enterprise. According to foundational Zero Trust architecture guidelines, which THREE tenets must be enforced? (Choose three)

Question 54mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) receives an alert that a user's workstation is communicating with a known command-and-control (C2) server. The analyst checks the firewall logs and sees that the traffic is allowed because it uses TCP port 443 and the destination IP is not on any blocklist. The analyst wants to quickly determine whether this is a false positive or a real compromise. Which of the following is the MOST appropriate next step to validate the alert?

Question 55hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

Question 56easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

Question 57easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

Question 58hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

Question 59mediummultiple choice

Read the full network assurance explanation →

A hospital's IT team is classifying the sensitivity of different data types to prioritize protection efforts. They label patient treatment records, real-time heart-rate monitor telemetry, and publicly published visitor parking maps. Which data classification scheme correctly reflects the risk-based handling these assets require?

Question 60hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

Question 61mediummultiple choice

Read the full DNS explanation →

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

Question 62easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A small accounting firm stores client tax returns on a file server. The partners ask which control most directly enforces the principle of least privilege for employees accessing those returns. Which control should be implemented?

Question 63mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

Question 64hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a next-generation firewall to inspect encrypted traffic. The organization uses a internal certificate authority (CA) to issue certificates for all internal servers. The administrator wants to ensure that the firewall can decrypt and inspect TLS traffic to these internal servers without generating certificate errors on client devices. What should the administrator do?

Question 65hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A financial services company is updating its incident response plan. The security manager wants to ensure the plan covers activities that occur during the containment, eradication, and recovery phases. Which two activities belong to those phases? (Choose two.)

Question 66hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The organization has a internal certificate authority (CA) and wants to ensure that users do not receive certificate warnings. Which action must the engineer take?

Question 67mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A retail company wants to reduce the risk that a terminated employee's account is still usable hours after departure. Which identity and access management practice best addresses this specific risk?

Question 68easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

Question 69mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a Palo Alto Networks firewall to block malicious downloads. They want to ensure that when a user attempts to download a file that is identified as malicious by WildFire, the download is blocked and the user is notified. Which two actions must the administrator take? (Choose two.)

Question 70hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A software company wants to verify that its internally developed payment module does not introduce exploitable weaknesses before release. The security team will perform a review that examines the compiled application's behavior while it runs, without access to the original source code. Which activity matches this requirement?

Question 71mediummultiple choice

Read the full DNS explanation →

A security operations center analyst is reviewing an alert about an internal workstation that resolved a domain name belonging to a known malware command-and-control (C2) server. The analyst wants to confirm whether the workstation actually established a connection to that C2 server, rather than just performing a DNS lookup. Which data source should the analyst correlate with the DNS logs to make this determination?

Question 72mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. They want to ensure that all traffic is logged at session start and session end for auditing purposes. Which setting should they configure in the security policy?

Question 73mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is implementing the principle of least privilege for a group of developers who need to deploy code to a production server. Currently, they have full administrative rights. The administrator wants to restrict their access to only what is necessary for deployment. Which of the following best describes the principle of least privilege?

Question 74easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Question 75hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a potential data breach and needs to determine the integrity of a critical file that may have been tampered with. The analyst has a known-good hash of the file from a trusted backup. Which of the following should the analyst do to verify the file's integrity?

Question 76hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security team is building a defense-in-depth strategy and wants to reduce the likelihood that a compromised user account can be used to move laterally across the environment. Which two controls most directly limit lateral movement using stolen credentials? (Choose two.)

Question 77mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security engineer is designing a defense-in-depth strategy for a new web application. The engineer wants to implement controls that map to the principle of least privilege and reduce the attack surface. Which two of the following controls best align with these goals? (Choose two.)

Question 78hardmultiple choice

Read the full DNS explanation →

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

Question 79hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A hospital must ensure that electronic protected health information remains available and unaltered even if a ransomware incident encrypts production servers. The security officer is selecting a recovery control that provides a guaranteed, isolated copy of data that cannot be modified by an attacker who has compromised the production domain. Which control best meets this requirement?

Question 80mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst notices that an internal web server is receiving a high volume of requests containing long strings of special characters in URL parameters, and the application log shows database error messages being returned to clients. The analyst suspects the application is vulnerable to an injection attack. Which practice most directly prevents this class of vulnerability in the application code?

Question 81mediummultiple choice

Read the full DNS explanation →

A security analyst is investigating a suspected data exfiltration incident. The analyst observes that outbound network traffic from a compromised host is encrypted and destined for an IP address that has no reverse DNS record and is not associated with any known business service. The traffic volume is steady but low, mimicking normal user browsing patterns. Which of the following BEST describes the technique being used by the attacker?

Question 82hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security engineer is configuring a firewall to protect an internal web server that hosts a public-facing application. The engineer wants to ensure that only HTTP and HTTPS traffic from the internet can reach the server, while all other traffic is blocked. The firewall is a stateful inspection firewall. Which of the following rules should be implemented to achieve this requirement?

Question 83easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is implementing a defense-in-depth strategy for the organization's endpoint devices. The administrator wants to ensure that even if malware bypasses the antivirus software, it cannot execute unauthorized code. Which of the following security controls BEST addresses this requirement?

Question 1easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is reviewing firewall logs and notices multiple outbound connection attempts from a client workstation to known command and control IP addresses. Which security profile component is primarily responsible for generating a threat log entry for this specific outbound traffic?

Question 2mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is implementing compliance controls to ensure that employees do not upload proprietary source code to unauthorized cloud storage providers. Which security profile feature should be utilized to control and log specific file transfers within recognized cloud applications?

Question 3easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) team wants to reduce alert fatigue by ensuring that low-severity threat events do not inundate their SIEM, while ensuring high-severity exploit attempts trigger immediate escalation. How should the administrator configure the security profiles to manage this?

Question 4hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization's security policy mandates that all software vulnerabilities with a CVSS score above 7.0 must be blocked at the network perimeter within 24 hours of disclosure. A new zero-day vulnerability is announced. While awaiting vendor patches, how can a Palo Alto Networks administrator immediately mitigate this threat using built-in platform features?

Question 5mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization's security policy requires that any detected malware file must be automatically blocked from entering the network during download. Which security profile and action combination ensures inline prevention against known malware?

Question 6easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator wants to ensure that administrators accessing the Palo Alto Networks firewall management plane do so securely using encrypted sessions and strong cryptographic keys. Which configuration area manages management plane access protocols and administrative ciphers?

Question 7hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Question 8easymulti select

Read the full Cybersecurity Fundamentals explanation →

An administrator is reviewing firewall high availability (HA) states and configuration parameters. Which TWO settings must be identical on both firewall peers in an HA pair to ensure successful synchronization and cluster formation? (Choose two)

Question 9easymultiple choice

Read the full VPN explanation →

A security administrator notices a surge in brute-force login attempts against the external VPN gateway. The firewall successfully logs and drops these malicious sessions using an Anti-Spyware profile. Which common cyber threat vector is the firewall primarily defending against?

Question 10easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security engineer is implementing the principle of least privilege for a group of developers who need temporary access to a production database. The developers should only be able to query data, not modify it, and their access should expire after 8 hours. Which access control model best fits this requirement?

Question 11mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a recent security incident and needs to determine the extent of the compromise. The analyst has identified a malicious file hash and wants to search historical network traffic logs to see if any internal hosts have communicated with external IPs associated with the hash. Which Palo Alto Networks feature should the analyst use?

Question 12mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a suspected compromised workstation. The analyst observes that the workstation is communicating with an external IP address on port 443, but the traffic is not TLS. The analyst also finds a scheduled task that runs a PowerShell script at startup. Which stage of the Cyber Kill Chain is most likely represented by these activities?

Question 13hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security team is implementing a defense-in-depth strategy to protect against ransomware. They want to focus on controls that can prevent the initial execution of ransomware on endpoints. Which two controls are most effective for this goal? (Choose two.)

Question 14mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

Question 15hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

Question 16easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Question 17hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Question 18mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Question 19mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Question 20easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Question 21mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A company's risk management framework requires multi-factor authentication (MFA) for all remote access connections. The organization utilizes GlobalProtect for remote workers. Where should the administrator configure the authentication profile to enforce MFA during the GlobalProtect connection phase?

Question 22hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

Question 23easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Question 24easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

Question 25mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Question 26mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Question 27hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Question 28easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

Question 29hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Question 30hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Question 31easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Question 32mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Question 33easymulti select

Read the full Cybersecurity Fundamentals explanation →

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Question 34mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

Question 35hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Question 36easymulti select

Read the full Cybersecurity Fundamentals explanation →

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

Question 37hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Question 38hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Question 39mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

Question 40easymulti select

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Question 41hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Question 42mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Question 43mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

Question 44mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

Question 45easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Question 46hardmulti select

Read the full Cybersecurity Fundamentals explanation →

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

Question 47hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

Question 48easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Question 49hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

Question 50mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

Question 51mediummulti select

Read the full Cybersecurity Fundamentals explanation →

An organization is reviewing its threat intelligence feeds and security posture to prepare for advanced persistent threat (APT) campaigns. Which TWO characteristics are typically associated with advanced persistent threats? (Choose two)

Question 52mediummulti select

Read the full Cybersecurity Fundamentals explanation →

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Question 53hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security operations team is implementing zero trust network access (ZTNA) principles across the enterprise. According to foundational Zero Trust architecture guidelines, which THREE tenets must be enforced? (Choose three)

Question 54mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) receives an alert that a user's workstation is communicating with a known command-and-control (C2) server. The analyst checks the firewall logs and sees that the traffic is allowed because it uses TCP port 443 and the destination IP is not on any blocklist. The analyst wants to quickly determine whether this is a false positive or a real compromise. Which of the following is the MOST appropriate next step to validate the alert?

Question 55hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

Question 56easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

Question 57easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

Question 58hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

Question 59mediummultiple choice

Read the full network assurance explanation →

A hospital's IT team is classifying the sensitivity of different data types to prioritize protection efforts. They label patient treatment records, real-time heart-rate monitor telemetry, and publicly published visitor parking maps. Which data classification scheme correctly reflects the risk-based handling these assets require?

Question 60hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

Question 61mediummultiple choice

Read the full DNS explanation →

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

Question 62easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A small accounting firm stores client tax returns on a file server. The partners ask which control most directly enforces the principle of least privilege for employees accessing those returns. Which control should be implemented?

Question 63mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

Question 64hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a next-generation firewall to inspect encrypted traffic. The organization uses a internal certificate authority (CA) to issue certificates for all internal servers. The administrator wants to ensure that the firewall can decrypt and inspect TLS traffic to these internal servers without generating certificate errors on client devices. What should the administrator do?

Question 65hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A financial services company is updating its incident response plan. The security manager wants to ensure the plan covers activities that occur during the containment, eradication, and recovery phases. Which two activities belong to those phases? (Choose two.)

Question 66hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The organization has a internal certificate authority (CA) and wants to ensure that users do not receive certificate warnings. Which action must the engineer take?

Question 67mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A retail company wants to reduce the risk that a terminated employee's account is still usable hours after departure. Which identity and access management practice best addresses this specific risk?

Question 68easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

Question 69mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a Palo Alto Networks firewall to block malicious downloads. They want to ensure that when a user attempts to download a file that is identified as malicious by WildFire, the download is blocked and the user is notified. Which two actions must the administrator take? (Choose two.)

Question 70hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A software company wants to verify that its internally developed payment module does not introduce exploitable weaknesses before release. The security team will perform a review that examines the compiled application's behavior while it runs, without access to the original source code. Which activity matches this requirement?

Question 71mediummultiple choice

Read the full DNS explanation →

A security operations center analyst is reviewing an alert about an internal workstation that resolved a domain name belonging to a known malware command-and-control (C2) server. The analyst wants to confirm whether the workstation actually established a connection to that C2 server, rather than just performing a DNS lookup. Which data source should the analyst correlate with the DNS logs to make this determination?

Question 72mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. They want to ensure that all traffic is logged at session start and session end for auditing purposes. Which setting should they configure in the security policy?

Question 73mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is implementing the principle of least privilege for a group of developers who need to deploy code to a production server. Currently, they have full administrative rights. The administrator wants to restrict their access to only what is necessary for deployment. Which of the following best describes the principle of least privilege?

Question 74easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Question 75hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst is investigating a potential data breach and needs to determine the integrity of a critical file that may have been tampered with. The analyst has a known-good hash of the file from a trusted backup. Which of the following should the analyst do to verify the file's integrity?

Question 76hardmulti select

Read the full Cybersecurity Fundamentals explanation →

A security team is building a defense-in-depth strategy and wants to reduce the likelihood that a compromised user account can be used to move laterally across the environment. Which two controls most directly limit lateral movement using stolen credentials? (Choose two.)

Question 77mediummulti select

Read the full Cybersecurity Fundamentals explanation →

A security engineer is designing a defense-in-depth strategy for a new web application. The engineer wants to implement controls that map to the principle of least privilege and reduce the attack surface. Which two of the following controls best align with these goals? (Choose two.)

Question 78hardmultiple choice

Read the full DNS explanation →

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

Question 79hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A hospital must ensure that electronic protected health information remains available and unaltered even if a ransomware incident encrypts production servers. The security officer is selecting a recovery control that provides a guaranteed, isolated copy of data that cannot be modified by an attacker who has compromised the production domain. Which control best meets this requirement?

Question 80mediummultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security analyst notices that an internal web server is receiving a high volume of requests containing long strings of special characters in URL parameters, and the application log shows database error messages being returned to clients. The analyst suspects the application is vulnerable to an injection attack. Which practice most directly prevents this class of vulnerability in the application code?

Question 81mediummultiple choice

Read the full DNS explanation →

A security analyst is investigating a suspected data exfiltration incident. The analyst observes that outbound network traffic from a compromised host is encrypted and destined for an IP address that has no reverse DNS record and is not associated with any known business service. The traffic volume is steady but low, mimicking normal user browsing patterns. Which of the following BEST describes the technique being used by the attacker?

Question 82hardmultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security engineer is configuring a firewall to protect an internal web server that hosts a public-facing application. The engineer wants to ensure that only HTTP and HTTPS traffic from the internet can reach the server, while all other traffic is blocked. The firewall is a stateful inspection firewall. Which of the following rules should be implemented to achieve this requirement?

Question 83easymultiple choice

Read the full Cybersecurity Fundamentals explanation →

A security administrator is implementing a defense-in-depth strategy for the organization's endpoint devices. The administrator wants to ensure that even if malware bypasses the antivirus software, it cannot execute unauthorized code. Which of the following security controls BEST addresses this requirement?