Cybersecurity-Practitioner Cybersecurity Fundamentals Practice Test 3 — 15 Questions

Question 1

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

Accepted Answer

The application risk level (ranging from 1 to 5). App-ID identifies the specific application name and the underlying transport protocol/port characteristics, along with risk ratings.

Answer

The exact BIOS version of the client workstation

Answer

The ambient room temperature of the firewall chassis hardware

Answer

The physical MAC address of the destination server

Question 2

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Accepted Answer

Administrator activity and authentication logs recording login timestamps and source IPs. Administrative accountability is maintained via Configuration Audit logs, Administrator Activity logs, and external authentication/RBAC.

Answer

Automated daily factory reset scripts executed on the management plane

Answer

Disabling all logging to prevent unauthorized access to log databases

Question 3

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Accepted Answer

GlobalProtect clientless VPN acting as a reverse proxy with SAML authentication. GlobalProtect service provider / SAML integration or Prisma Access proxy capabilities allow authentication enforcement before traffic reaches protected backend resources.

Answer

Zone Protection SYN proxy configuration

Answer

WildFire cloud analysis submission API

Answer

App-ID custom application signature generator

Question 4

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

Accepted Answer

Forward the unknown file to the WildFire cloud for sandboxing analysis. WildFire analysis profiles support actions such as forward, block, and dynamic analysis settings for unknown file types.

Answer

Automatically downgrade user access privileges upon file detection

Answer

Reboot the firewall data plane CPU cores to clear memory caches

Question 5

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Accepted Answer

SQL Injection attacks. SQL injection and Cross-Site Scripting (XSS) are common application-layer web threats that can be detected by Vulnerability Protection signatures.

Answer

Fiber optic cable fiber cut

Answer

Physical server hardware power supply failure

Answer

Management plane cooling fan speed degradation

Question 6

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Accepted Answer

Actions on Objectives (exfiltrating data or lateral movement across internal zones). The Cyber Kill Chain phases involving active network traffic where firewalls play a role include Delivery, Command and Control, and Actions on Objectives (Exfiltration).

Answer

Reconnaissance (researching target organization via public social media without direct network interaction)

Answer

Weaponization (coupling an exploit with a backdoor in the attacker's offline lab environment)

Question 7

An administrator is reviewing firewall high availability (HA) states and configuration parameters. Which TWO settings must be identical on both firewall peers in an HA pair to ensure successful synchronization and cluster formation? (Choose two)

Accepted Answer

PAN-OS software version. HA peers must share identical hardware models, software versions, and license configurations to function properly.

Answer

Management IP addresses of the individual firewall control planes

Answer

Hostname configured in the device management settings

Answer

DNS server IP addresses configured in device setup

Question 8

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). URL filtering profile categories can be assigned actions such as block, allow, alert, continue, or override.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)

Question 9

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

Accepted Answer

Configure permitted IP address lists on the management interface to allow access only from secure jump hosts. Management plane security best practices include restricting management access via dedicated management interfaces, using IP whitelisting (permitted IP lists), and enforcing strong authentication.

Answer

Disable administrative password complexity requirements to simplify login

Answer

Configure the management interface with a public IP address accessible from the entire internet

Question 10

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

Accepted Answer

Implement App-ID policies to permit only explicitly required business applications and inspect all allowed traffic using WildFire and Anti-Spyware profiles.. Least privilege mandates restricting access and capabilities to only what is strictly necessary for operational needs, which includes blocking unexpected outbound ports and protocols.

Answer

Disable decryption entirely to prevent performance degradation and rely solely on source IP zoning.

Answer

Allow all outbound traffic on standard ports such as 80 and 443 to ensure uninterrupted business application functionality.

Answer

Create a single any-to-any allow rule for the internal development subnet to speed up troubleshooting.

Question 11

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Accepted Answer

Command and Control. Command and control is the phase where an established malware or threat actor communicates with an external infrastructure to receive instructions or exfiltrate data, which matches outbound connections to a C2 IP.

Answer

Reconnaissance

Answer

Exploitation

Answer

Delivery

Question 12

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

Accepted Answer

Data exfiltration of sensitive source code or credit cards over encrypted HTTPS sessions goes undetected by Data Filtering profiles. Without SSL decryption, the firewall cannot inspect payloads, leading to hidden malware, undetected data exfiltration, and blind spots in threat signatures.

Answer

App-ID fails entirely to identify any encrypted applications

Answer

The firewall is unable to forward Layer 3 IP packets across static routes

Question 13

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

Accepted Answer

Threat likelihood and impact magnitude. NIST SP 800-30 defines risk as a function of the likelihood of a given threat source exercising a particular potential vulnerability and the resulting impact of that adverse event.

Answer

Network bandwidth consumption and CPU utilization overhead

Answer

Patch availability time and vendor support lifecycle status

Answer

Asset replacement cost and regulatory fine amounts

Question 14

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Accepted Answer

Dynamic behavioral analysis. WildFire uses dynamic analysis (behavioral analysis) in a sandbox environment to observe how unknown files behave when executed, identifying malicious actions like registry tampering and process injection.

Answer

URL category filtering

Answer

DNS sinkholing

Answer

Static signature matching

Question 15

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

Accepted Answer

Use of valid accounts for initial access or lateral movement. After obtaining valid user credentials through phishing, the adversary enters the credential access phase and typically moves to lateral movement or initial access using those compromised credentials.

Answer

Exploitation of client-side software vulnerabilities

Answer

Passive network sniffing to harvest additional certificates

Answer

Immediate domain controller encryption via ransomware