Cybersecurity-Practitioner Cybersecurity Fundamentals Practice Test 2 — 15 Questions

Question 1

An organization's security policy mandates that all software vulnerabilities with a CVSS score above 7.0 must be blocked at the network perimeter within 24 hours of disclosure. A new zero-day vulnerability is announced. While awaiting vendor patches, how can a Palo Alto Networks administrator immediately mitigate this threat using built-in platform features?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a custom Vulnerability Protection signature or update the predefined threat signature action to 'block' for the specific CVE. Administrators can update Vulnerability Protection profiles or create custom vulnerability signatures to block exploit attempts targeting the newly disclosed flaw before a vendor patch is available.

Answer

Configure a custom URL Filtering category to block the vendor advisory website

Answer

Deploy an Application Override policy to drop all traffic using the affected application port

Answer

Enable strict WildFire forwarding for all outbound DNS requests originating from the server subnet

Question 2

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

Accepted Answer

It allows unauthorized applications to traverse standard ports like 80 and 443, expanding the attack surface. Allowing 'any' application permits unknown or unwanted applications to traverse ports like 80 and 443, bypassing traditional port-based security controls.

Answer

It prevents the firewall from performing Layer 3 IP address routing

Answer

It disables the generation of threat logs for all established sessions

Answer

It automatically enables SSL decryption on all matching traffic flows

Question 3

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Accepted Answer

Create a Vulnerability Protection Exception for the specific threat ID, optionally restricting it to the source or destination IP. False positives in vulnerability protection can be resolved by creating a Vulnerability Protection Exception for the specific signature ID.

Answer

Disable the Vulnerability Protection profile globally across all security rules

Answer

Configure an Application Override policy for the custom API port

Answer

Delete the threat signature from the firewall's local database cache

Question 4

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Accepted Answer

URL Filtering profile configured with Credential Theft Prevention settings. URL Filtering profiles include Credential Theft Prevention features that inspect HTTP submissions against corporate credential settings.

Answer

Data Filtering profile configured for credit card pattern matching

Answer

Vulnerability Protection profile with HTTP header inspection

Answer

Anti-Spyware profile configured with DNS sinkholing

Question 5

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. Zone protection or DoS Protection profiles with rate-limiting based on source IP and aggregate sessions protect against application-layer floods.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic

Question 6

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

Accepted Answer

WildFire Portal or firewall WildFire submission logs searched by file hash (SHA-256). The WildFire portal or Panorama/Firewall WildFire submission logs allow searching by file hash.

Answer

Application Command Center (ACC) network activity tab

Answer

GlobalProtect client log exporter utility

Answer

Zone Protection event log viewer

Question 7

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Accepted Answer

GlobalProtect Host Information Profiles (HIP) combined with Security policy zone and posture criteria. GlobalProtect HIP (Host Information Profile) checks endpoint security posture (OS version, disk encryption, patch level) and feeds into security policies to restrict access.

Answer

WildFire automated sandbox analysis combined with Data Filtering profiles

Answer

User-ID agent IP-to-user mapping combined with NAT translation tables

Answer

App-ID application signatures combined with URL Filtering categories

Question 8

An organization's security policy requires that any detected malware file must be automatically blocked from entering the network during download. Which security profile and action combination ensures inline prevention against known malware?

Accepted Answer

Antivirus profile with action set to 'block' for all malware types and decoders. Antivirus profiles inspect file transfers and can be configured to block known malware signatures in real-time inline.

Answer

WildFire analysis profile with file forwarding set to 'async'

Answer

Data Filtering profile configured to drop executable file extensions

Answer

URL Filtering profile configured to block malicious download categories

Question 9

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Accepted Answer

Panorama Log Viewer / Firewall Traffic and Threat logs filtered by source IP address. Traffic logs combined with ACC (Application Command Center) or Panorama log queries allow detailed session-level forensic investigation per IP address.

Answer

Dynamic Address Group membership audit report

Answer

AutoFocus Campaign Tracker and malware family indicator list

Answer

GlobalProtect Clientless Portal connection history report

Question 10

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Accepted Answer

Security Profiles. Security profiles inspect data plane traffic for threats, malware, and policy violations and are collectively known as Security Profiles.

Answer

Zone Protection Profiles

Answer

Decryption Profiles

Answer

App-ID Custom Signature Objects

Question 11

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Accepted Answer

HA Active/Active mode with session synchronization enabled. HA Active/Active mode allows both firewalls to process traffic simultaneously, requiring session synchronization and floating IP addresses.

Answer

Cluster mode with dynamic routing ECMP multipath load balancing

Answer

Virtual Router redundancy protocol (VRRP) standalone failover groups

Answer

HA Active/Passive mode with preemption enabled

Question 12

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Accepted Answer

SSL Forward Proxy Decryption. SSL Forward Proxy decryption inspects outbound traffic to external servers by generating a forward proxy certificate on the firewall.

Answer

SSL Inbound Inspection Decryption

Answer

Kerberos Decryption Service integration

Answer

SSH Decryption Proxy mode

Question 13

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Accepted Answer

Antivirus profile. Antivirus and Vulnerability Protection profiles inspect content payloads for known malware and software exploit attempts, respectively.

Answer

Data Filtering profile

Answer

Zone Protection profile

Answer

URL Filtering profile

Question 14

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

Accepted Answer

Using Captive Portal authentication to prompt unmapped users for credentials. User-ID can map IP addresses to usernames using integration with Active Directory security event logs (Windows User-ID Agent / WMI) and captive portal authentication.

Answer

Configuring App-ID custom signature regex patterns

Answer

Configuring static IPv4-to-IPv6 NAT translation tables

Answer

Enabling GlobalProtect clientless portal DNS proxy forwarding

Question 15

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Zero Trust principles include verifying explicitly, using least privilege access, and assuming breach while inspecting all traffic.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance