Cybersecurity-Practitioner Cybersecurity Fundamentals Practice Test 3 — 15 Questions

Question 1

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Profiles. Security Profiles are the collective set of configurable inspection modules — Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis — that are attached to a Security policy rule to enforce content inspection on allowed traffic. They define what the firewall scans for and what action to take (alert, block, reset) once a session matches the rule.

Answer

Zone Protection Profiles

Answer

Decryption Profiles

Answer

App-ID Custom Signature Objects

Question 2

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Accepted Answer

HA Active/Active mode with session synchronization enabled. HA Active/Active mode allows both firewalls in the pair to process traffic simultaneously while synchronizing session tables in real time, providing both load sharing and failover. This matches the requirement that both firewalls actively process traffic with real-time session sync.

Answer

Cluster mode with dynamic routing ECMP multipath load balancing

Answer

Virtual Router redundancy protocol (VRRP) standalone failover groups

Answer

HA Active/Passive mode with preemption enabled

Question 3

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

Accepted Answer

Antivirus profile. The Antivirus profile (A) is correct because it scans traffic content for known malware signatures, including viruses, worms, and spyware, and applies actions such as alert, block, or reset for infected files. The Vulnerability Protection profile (D) is correct because it inspects content payloads for software exploit attempts, such as buffer overflows and code-execution attacks, using signatures that detect and block known exploits. Together, these two profile types are the content-inspection profiles specifically designed to detect malware and exploit attempts in allowed traffic. Data Filtering (B) is for controlling sensitive data patterns like credit card numbers, not malware. Zone Protection (C) is a network-layer profile for flood and reconnaissance protection, not payload content inspection. URL Filtering (E) categorizes and controls web destinations but does not inspect payloads for malware or exploits.

Answer

Data Filtering profile

Answer

Zone Protection profile

Answer

URL Filtering profile

Question 4

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

Accepted Answer

Using Captive Portal authentication to prompt unmapped users for credentials. Option C is correct because Captive Portal is a native User-ID method that intercepts HTTP/HTTPS traffic from unmapped source IPs and presents a web login page, allowing the firewall to authenticate the user and create an IP-to-username mapping in its User-ID table. Option D is correct because the Windows-based User-ID Agent can monitor Active Directory domain controllers' security event logs (e.g., 4624 logon events) and send user-to-IP mappings to the firewall, which is the standard enterprise method for identity-based policy enforcement. Option A is incorrect because App-ID custom signatures match application traffic patterns, not user identities, and do not produce IP-to-username mappings. Option B is incorrect because static IPv4-to-IPv6 NAT translation tables translate addresses between protocol versions and have nothing to do with identity mapping. Option E is incorrect because GlobalProtect clientless portal DNS proxy forwarding handles name resolution for clientless VPN access, not User-ID IP-to-username mapping.

Answer

Configuring App-ID custom signature regex patterns

Answer

Configuring static IPv4-to-IPv6 NAT translation tables

Answer

Enabling GlobalProtect clientless portal DNS proxy forwarding

Question 5

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Option A is correct because Zero Trust requires an 'assume breach' mindset: minimizing blast radius through microsegmentation and inspecting all traffic (including east-west) prevents lateral movement after a compromise. Option B is correct because 'verify explicitly' means every access request must be authenticated and authorized using all available signals—identity, location, device health, and other telemetry—rather than relying on a single credential check. Option C is correct because least privilege access enforces just-enough, just-in-time permissions via risk-based adaptive policies, limiting user and device reach to only what is needed. Option D is incorrect because implicitly trusting the internal network after VPN authentication is exactly the perimeter-based trust model Zero Trust rejects. Option E is incorrect because bypassing inspection for internal-to-internal traffic violates the assume-breach principle and would allow undetected lateral movement.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance

Question 6

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

Accepted Answer

The application risk level (ranging from 1 to 5). Option A is correct because the App-ID engine assigns each identified application a risk level on a scale of 1 to 5, which helps security teams assess how dangerous the detected traffic is. Option E is correct because App-ID identifies and reports the specific application name, such as 'ssl', 'zoom-video', or 'ms-office-365', rather than relying only on port or protocol. These two data points—application identity and risk—are core outputs of App-ID for every recognized session. Option B is incorrect because BIOS versions of client workstations are not part of firewall App-ID session data. Option C is incorrect because chassis ambient temperature is hardware telemetry, not application identification. Option D is incorrect because App-ID does not provide the destination server's physical MAC address as a session identification attribute.

Answer

The exact BIOS version of the client workstation

Answer

The ambient room temperature of the firewall chassis hardware

Answer

The physical MAC address of the destination server

Question 7

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

Accepted Answer

Administrator activity and authentication logs recording login timestamps and source IPs. Option C is correct because administrator activity and authentication logs capture login timestamps and source IP addresses, providing the audit trail of who accessed the management plane and when, which is essential for administrative accountability under risk management frameworks. Option D is correct because Role-Based Access Control (RBAC) enforces least privilege by restricting each administrator to only the roles and tasks required, directly satisfying change-control and segregation-of-duties requirements. Option E is correct because Configuration Audit logs record every administrative commit, the specific configuration changes made, and the user responsible, delivering the traceability auditors require for change control. Option A does not belong because automated daily factory resets would wipe configuration and audit evidence, destroying accountability rather than supporting it. Option B does not belong because disabling all logging eliminates the audit trail entirely, which directly violates compliance and accountability requirements.

Answer

Automated daily factory reset scripts executed on the management plane

Answer

Disabling all logging to prevent unauthorized access to log databases

Question 8

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

Accepted Answer

GlobalProtect clientless VPN acting as a reverse proxy with SAML authentication. GlobalProtect clientless VPN acts as a reverse proxy that sits in front of legacy web applications, presenting them through a browser-based portal with SAML authentication. Because the proxy terminates the user session and re-initiates it to the backend, the legacy application never needs to support federation protocols — it only sees the proxy's connection.

Answer

Zone Protection SYN proxy configuration

Answer

WildFire cloud analysis submission API

Answer

App-ID custom application signature generator

Question 9

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

Accepted Answer

Forward the unknown file to the WildFire cloud for sandboxing analysis. Option B is correct because a WildFire analysis profile's core function is to submit unknown files (those not matched by existing signatures) to the WildFire cloud sandbox, where they are executed and observed for malicious behavior. Option D is correct because the profile can be configured to hold or block the file transfer while inline analysis (including inline machine learning and WildFire verdict lookups) completes, preventing the user from receiving a potentially malicious file before a verdict is reached. Option E is correct because the profile can generate alert logs (and other log types) when an unknown file type or unknown file is detected, giving the administrator visibility into potentially suspicious activity. Option A is not part of a WildFire analysis profile, since downgrading user access privileges is a function of authentication or User-ID/security policy, not file analysis. Option C is not a WildFire profile action; rebooting data plane CPU cores is not a supported or sensible response to file inspection and would disrupt traffic processing.

Answer

Automatically downgrade user access privileges upon file detection

Answer

Reboot the firewall data plane CPU cores to clear memory caches

Question 10

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

Accepted Answer

SQL Injection attacks. SQL Injection (D) is a classic application-layer injection attack in which attacker-supplied input is interpreted as SQL code by the backend database, and NGFW security profiles such as vulnerability protection can detect and block the malicious payloads. Cross-Site Scripting (E) is likewise a web application-layer attack where script is injected into pages viewed by other users, and it can be mitigated by NGFW URL filtering, antivirus, and vulnerability/application security profiles inspecting HTTP traffic. The remaining options are not web-based injection or application-layer attacks: a fiber optic cable cut (A) is a physical layer availability incident, a server power supply failure (B) is a hardware fault, and cooling fan speed degradation in the management plane (C) is an environmental/hardware monitoring issue, none of which are mitigated by NGFW security profiles.

Answer

Fiber optic cable fiber cut

Answer

Physical server hardware power supply failure

Answer

Management plane cooling fan speed degradation

Question 11

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

Accepted Answer

Actions on Objectives (exfiltrating data or lateral movement across internal zones). The three correct phases are those where attacker traffic actually crosses into or out of the enterprise network and can be inspected by a Palo Alto Networks firewall. Delivery (B) is correct because the malicious payload (email attachment, web download, or exploit kit) is transmitted to the internal target, so the firewall's URL filtering, file blocking, and vulnerability protection can detect or block it. Command and Control (C) is correct because compromised hosts initiate outbound sessions to external C2 servers, which the firewall can identify via App-ID, DNS sinkholing, and threat prevention signatures. Actions on Objectives (A) is correct because the attacker's post-exploitation activity, such as lateral movement across internal zones or data exfiltration, generates east-west and outbound traffic that the firewall can detect and disrupt through zone-based policies and data filtering. Reconnaissance (D) is not correct because it typically occurs outside the target's network via public sources, so the firewall has no traffic to inspect. Weaponization (E) is not correct because it happens in the attacker's own offline environment before any interaction with the target enterprise network.

Answer

Reconnaissance (researching target organization via public social media without direct network interaction)

Answer

Weaponization (coupling an exploit with a backdoor in the attacker's offline lab environment)

Question 12

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). In a URL Filtering profile, each URL category can be assigned one of several actions, and the three valid actions here are Continue, Block, and Alert. Option A, Continue, is correct because it allows the user to proceed only after being shown a warning/response page that requires acknowledgment, which is a standard URL Filtering action for cautioning users about risky categories. Option B, Block, is correct because it terminates the session and presents a response page, which is the primary enforcement action for malicious or disallowed URL categories. Option D, Alert, is correct because it permits the traffic while generating a URL log entry, enabling monitoring without blocking. Option C, Quarantine, is not a URL Filtering profile action; client isolation into an isolated VLAN is a function of host information/profile or quarantine features, not URL category actions. Option E, Encrypt, is not a URL Filtering action; SSL forward proxy decryption is configured in decryption policy/profiles, not as a per-URL-category action in a URL Filtering profile.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)

Question 13

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

Accepted Answer

Configure permitted IP address lists on the management interface to allow access only from secure jump hosts. Option C is correct because configuring permitted IP address lists (an allowlist/ACL on the management interface) restricts administrative access to known secure jump hosts, blocking unauthorized source addresses from reaching the management plane. Option D is correct because dedicating a separate out-of-band management interface (MGT port) isolates administrative traffic from data-plane traffic, reducing exposure and preventing data-path compromise from reaching management functions. Option E is correct because enforcing multi-factor authentication for all administrative logins adds a strong second factor beyond passwords, mitigating credential theft and brute-force attacks against privileged accounts. Option A is incorrect because disabling password complexity weakens authentication and increases the risk of credential compromise. Option B is incorrect because exposing the management interface with a public IP reachable from the entire internet dramatically expands the attack surface and invites scanning, brute-force, and exploitation attempts.

Answer

Disable administrative password complexity requirements to simplify login

Answer

Configure the management interface with a public IP address accessible from the entire internet

Question 14

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

Accepted Answer

Implement App-ID policies to permit only explicitly required business applications and inspect all allowed traffic using WildFire and Anti-Spyware profiles.. To adhere to least privilege for outbound traffic, the administrator should implement App-ID policies that permit only explicitly required business applications and inspect all allowed traffic with WildFire and Anti-Spyware profiles. This enforces application-level allow-listing, blocks unknown or unauthorized egress, and applies threat inspection to catch exfiltration attempts. It is the only option that both restricts outbound traffic to what is needed and inspects it for malicious content.

Answer

Disable decryption entirely to prevent performance degradation and rely solely on source IP zoning.

Answer

Allow all outbound traffic on standard ports such as 80 and 443 to ensure uninterrupted business application functionality.

Answer

Create a single any-to-any allow rule for the internal development subnet to speed up troubleshooting.

Question 15

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

Accepted Answer

Command and Control. The Command and Control (C2) phase of the Lockheed Martin cyber kill chain occurs when a compromised endpoint communicates with attacker-controlled infrastructure to receive instructions or exfiltrate data. Outbound connections to a known C2 IP address are the textbook indicator of this phase, as the attacker has already delivered and exploited the payload and is now maintaining remote control of the victim.

Answer

Reconnaissance

Answer

Exploitation

Answer

Delivery