Cybersecurity-Practitioner Cybersecurity Fundamentals Practice Test 2 — 15 Questions

Question 1

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AutoFocus threat intelligence service. AutoFocus is Palo Alto Networks' threat intelligence service that aggregates WildFire, Unit 42, and third-party intel, letting analysts research TTPs, threat actors, and campaigns by industry sector. It provides contextual threat hunting through tags, actors, campaigns, and malware families, and correlates them with the organization's own telemetry. This is the correct tool for understanding sector-specific threat exposure and TTPs.

Answer

Panorama Log Collector forwarding engine

Answer

Application Command Center (ACC) dashboard

Answer

GlobalProtect Host Information Profile (HIP) engine

Question 2

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Accepted Answer

WildFire cloud-based analysis and automated signature generation. WildFire is Palo Alto Networks' cloud-based malware analysis service that automatically analyzes suspicious files in a sandboxed environment. When a novel malware sample is identified, WildFire generates a new signature and pushes it to all subscribed Next-Generation Firewalls globally within minutes, enabling automatic blocking without manual intervention. This directly addresses the requirement for rapid, automated, global protection against new threats.

Answer

Palo Alto Networks MineMeld open-source threat intelligence

Answer

Traps Advanced Endpoint Protection cloud service

Answer

AutoFocus Context-Aware Threat Intelligence service

Question 3

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID is the Palo Alto Networks feature that maps IP addresses to user identities, enabling security policies based on user or group rather than IP alone. Integrating a User-ID agent (or Panorama User-ID mapping) with the firewall populates the user-to-IP mapping table, which policy rules can then reference to enforce least-privilege access in a Zero Trust model.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud

Question 4

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of port or protocol, allowing internal segmentation firewalls to enforce granular, application-aware policies between tiers in the same zone. This lets the firewall permit, for example, only database traffic from the app tier to the DB tier while blocking everything else, achieving microsegmentation.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 5

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Accepted Answer

Panorama Administrative Roles and external authentication profiles (RADIUS/TACACS+/SAML). Panorama Administrative Roles allow granular role-based access control for administrators, and external authentication profiles (RADIUS, TACACS+, SAML) enable integration with enterprise identity providers. Together, they support individual administrator accounts with specific permissions, addressing the auditor's recommendation.

Answer

WildFire API token generation and management

Answer

User-ID clientless mapping via Windows User-ID Agent

Answer

GlobalProtect Portal client configuration profiles

Question 6

A company's risk management framework requires multi-factor authentication (MFA) for all remote access connections. The organization utilizes GlobalProtect for remote workers. Where should the administrator configure the authentication profile to enforce MFA during the GlobalProtect connection phase?

Accepted Answer

Within the GlobalProtect Portal and Gateway configurations referencing an Authentication Profile tied to an MFA provider. In Palo Alto Networks GlobalProtect, MFA is enforced by attaching an Authentication Profile (which references an MFA provider such as RADIUS, SAML, or LDAP with OTP) to the GlobalProtect Portal and/or Gateway configuration. The portal authenticates users to download the client and configuration; the gateway authenticates the tunnel. Configuring the profile in both places ensures MFA is required at connection time.

Answer

Via the Decryption policy rule pointing to an external LDAP server

Answer

Through the App-ID custom signature editor

Answer

Inside the Zone Protection profile attached to the external untrusted zone interface

Question 7

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

Accepted Answer

Zone Protection profile configured with SYN Flood protection (SYN cookies or random drop). A Zone Protection profile applied to the ingress zone is the Palo Alto Networks feature specifically designed to defend against volumetric attacks like SYN floods and reconnaissance scans. Within the profile, SYN Flood protection uses SYN cookies or random drop to absorb and mitigate half-open connection exhaustion at the ingress interface before the traffic reaches the target hosts.

Answer

WildFire inline machine learning analysis engine

Answer

User-ID syslog mapping listener service

Answer

URL Filtering profile configured with credential theft prevention

Question 8

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

Accepted Answer

Data Filtering profile. The Data Filtering profile is specifically designed to inspect traffic for sensitive data patterns such as credit card numbers, Social Security numbers, and custom regex patterns, and to block or alert on that data leaving the network. It is the only PAN-OS security profile purpose-built for DLP-style content inspection of outbound flows. Tuning it involves defining data patterns, file types, and the action (alert, block, or forward) for each direction.

Answer

Vulnerability Protection profile

Answer

URL Filtering profile

Answer

Anti-Spyware profile

Question 9

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

Accepted Answer

It allows unauthorized applications to traverse standard ports like 80 and 443, expanding the attack surface. Allowing 'any' in the application field means the Security rule permits all applications, including those that may be unauthorized or malicious, to traverse the firewall on standard ports like 80 and 443. This expands the attack surface because attackers can use any application, including peer-to-peer, remote access, or custom malware, to communicate. Best practice is to allow only specific applications that are required for business, following the principle of least privilege.

Answer

It prevents the firewall from performing Layer 3 IP address routing

Answer

It disables the generation of threat logs for all established sessions

Answer

It automatically enables SSL decryption on all matching traffic flows

Question 10

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

Accepted Answer

Create a Vulnerability Protection Exception for the specific threat ID, optionally restricting it to the source or destination IP. A Vulnerability Protection Exception allows the administrator to suppress a specific threat ID while leaving the rest of the profile active, and it can be scoped to a source, destination, or both to minimize the blast radius. This is the safe, surgical way to resolve a false positive without weakening overall threat coverage.

Answer

Disable the Vulnerability Protection profile globally across all security rules

Answer

Configure an Application Override policy for the custom API port

Answer

Delete the threat signature from the firewall's local database cache

Question 11

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

Accepted Answer

URL Filtering profile configured with Credential Theft Prevention settings. URL Filtering profiles include Credential Theft Prevention features that inspect HTTP submissions against corporate credential settings.

Answer

Data Filtering profile configured for credit card pattern matching

Answer

Vulnerability Protection profile with HTTP header inspection

Answer

Anti-Spyware profile configured with DNS sinkholing

Question 12

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. A DoS Protection profile with classified and aggregate rate limiting rules is specifically designed to mitigate volumetric and application-layer floods, including HTTP GET floods, by rate-limiting based on source, destination, or application criteria while allowing legitimate traffic. This is the correct platform capability to tune for this attack.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic

Question 13

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

Accepted Answer

WildFire Portal or firewall WildFire submission logs searched by file hash (SHA-256). The WildFire Portal and firewall WildFire submission logs both allow searching by file hash (SHA-256), which is the fastest way to check whether a specific sample has been analyzed across the enterprise. Searching by hash directly queries historical WildFire analysis results, matching the analyst's need.

Answer

Application Command Center (ACC) network activity tab

Answer

GlobalProtect client log exporter utility

Answer

Zone Protection event log viewer

Question 14

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

Accepted Answer

GlobalProtect Host Information Profiles (HIP) combined with Security policy zone and posture criteria. GlobalProtect Host Information Profiles (HIP) collect endpoint posture data (OS patch level, antivirus, disk encryption, etc.) from managed and unmanaged devices, and Security policy can then match on HIP profiles alongside zone and user criteria. This lets the firewall deny BYOD devices lacking required posture even after successful authentication, which is exactly the Zero Trust 'never trust, always verify' enforcement the auditor is asking about.

Answer

WildFire automated sandbox analysis combined with Data Filtering profiles

Answer

User-ID agent IP-to-user mapping combined with NAT translation tables

Answer

App-ID application signatures combined with URL Filtering categories

Question 15

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

Accepted Answer

Panorama Log Viewer / Firewall Traffic and Threat logs filtered by source IP address. Panorama Log Viewer, combined with firewall Traffic and Threat logs filtered by source IP address, provides the consolidated session explorer view needed to trace all connections from a specific host over time. It aggregates traffic, threat, URL, and data logs across managed firewalls, enabling forensic reconstruction of the host's network activity.

Answer

Dynamic Address Group membership audit report

Answer

AutoFocus Campaign Tracker and malware family indicator list

Answer

GlobalProtect Clientless Portal connection history report