Cybersecurity-Practitioner Cybersecurity Fundamentals Practice Test 4 — 15 Questions

Question 1

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data exfiltration of sensitive source code or credit cards over encrypted HTTPS sessions goes undetected by Data Filtering profiles. When SSL/TLS traffic is not decrypted, the firewall cannot inspect the plaintext payload, so option A is correct: sensitive data such as source code or credit card numbers can be exfiltrated inside HTTPS sessions without Data Filtering profiles detecting it. Option B is correct because command-and-control callbacks tunneled over HTTPS appear as ordinary web traffic, allowing them to evade Anti-Spyware signatures that would otherwise match the malicious payload. Option D is correct because malware and trojans encapsulated in HTTPS streams are never exposed to Antivirus or WildFire analysis, so those threats pass uninspected. Option C is not correct because App-ID can still identify encrypted applications using TLS metadata such as SNI, certificates, and JA3 fingerprints, even without decryption. Option E is not correct because SSL/TLS decryption is unrelated to Layer 3 forwarding; the firewall still routes IP packets across static routes regardless of decryption policy.

Answer

App-ID fails entirely to identify any encrypted applications

Answer

The firewall is unable to forward Layer 3 IP packets across static routes

Question 2

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

Accepted Answer

Threat likelihood and impact magnitude. NIST SP 800-30 defines risk as a function of the likelihood of a threat exploiting a vulnerability and the magnitude of the impact if it occurs. Therefore, the team must evaluate threat likelihood and impact magnitude to determine the overall risk level. This combination drives prioritization of mitigation efforts for the critical database vulnerability.

Answer

Network bandwidth consumption and CPU utilization overhead

Answer

Patch availability time and vendor support lifecycle status

Answer

Asset replacement cost and regulatory fine amounts

Question 3

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

Accepted Answer

Dynamic behavioral analysis. WildFire executes unknown files in a sandboxed virtual environment and observes runtime behaviors such as registry modification and process injection, which is dynamic behavioral analysis. It does not rely solely on static signatures; it watches what the malware actually does when run. This matches the scenario where the executable exhibited malicious behavior during analysis.

Answer

URL category filtering

Answer

DNS sinkholing

Answer

Static signature matching

Question 4

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

Accepted Answer

Use of valid accounts for initial access or lateral movement. After credentials are captured via a phishing page, the attacker uses those valid accounts to log in, which corresponds to the 'Use of Valid Accounts' technique for initial access or lateral movement in the attack lifecycle. This phase immediately follows credential capture because the stolen credentials are now leveraged to access systems. It is a direct continuation of the credential-harvesting step.

Answer

Exploitation of client-side software vulnerabilities

Answer

Passive network sniffing to harvest additional certificates

Answer

Immediate domain controller encryption via ransomware

Question 5

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

Accepted Answer

Implementing perimeter firewalls with threat prevention, internal segmentation firewalls, endpoint protection via Cortex XDR, and multi-factor authentication for user access.. Defense-in-depth means layering multiple independent controls so that no single failure compromises the environment. Option D combines perimeter firewalls, internal segmentation, endpoint protection (Cortex XDR), and MFA — four distinct layers covering network, endpoint, and identity domains, which is the textbook implementation of the principle.

Answer

Using automated patch management software as the sole security control for all internal servers.

Answer

Relying entirely on cloud-delivered security services without deploying physical or virtual firewalls on-premises.

Answer

Deploying a single, highly powerful firewall at the perimeter with all security profiles enabled and no internal segmentation.

Question 6

An organization is reviewing its threat intelligence feeds and security posture to prepare for advanced persistent threat (APT) campaigns. Which TWO characteristics are typically associated with advanced persistent threats? (Choose two)

Accepted Answer

Prolonged, stealthy presence within the compromised network over an extended period. Option D is correct because APTs are defined by their ability to maintain a long-term, low-profile foothold inside a victim network, often persisting for months or years while evading detection through techniques like living-off-the-land binaries and slow, periodic beaconing. Option E is correct because APTs are goal-driven campaigns, typically sponsored by nation-states or organized groups, that target specific high-value assets such as intellectual property, trade secrets, or strategic intelligence rather than opportunistic victims. Options A, B, and C are not characteristic of APTs: aggressive scanning and high visibility (A) contradict the stealth requirement, exclusive use of unencrypted HTTP for C2 (B) is atypical since APTs commonly use encrypted channels, domain fronting, or custom protocols to hide traffic, and automated indiscriminate ransomware against consumers (C) describes commodity cybercrime, not a targeted persistent threat.

Answer

High visibility and aggressive network scanning to maximize immediate impact

Answer

Exclusive reliance on unencrypted HTTP protocols for command and control

Answer

Automated, indiscriminate ransomware distribution targeting consumer endpoints

Question 7

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Accepted Answer

Actions on Objectives. The Lockheed Martin cyber kill chain defines seven sequential phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B, Actions on Objectives, is correct because it is the final phase where the attacker accomplishes their goal, such as encrypting files in a ransomware attack. Option C, Weaponization, is correct because it is the phase where the attacker pairs an exploit with a payload (e.g., a malicious macro or exploit kit) to create the deliverable malware. Option E, Delivery, is correct because it is the phase where the weaponized payload is transmitted to the target, such as via phishing email, USB drive, or web download. Option A, Mitigation, is not part of the kill chain; it is a defensive countermeasure category, not an attacker phase. Option D, Continuous Patching, is not part of the kill chain either; it is a vulnerability management practice, not an attack phase.

Answer

Mitigation

Answer

Continuous Patching

Question 8

A security operations team is implementing zero trust network access (ZTNA) principles across the enterprise. According to foundational Zero Trust architecture guidelines, which THREE tenets must be enforced? (Choose three)

Accepted Answer

Verify explicitly by authenticating and authorizing based on all available data points. Option A is correct because the foundational Zero Trust principle of 'verify explicitly' requires every access request to be authenticated and authorized using all available data points, such as user identity, device health, location, and behavioral signals, rather than relying on a single credential check. Option C is correct because 'assume breach' mandates continuous monitoring of all sessions, telemetry, and traffic to detect anomalous behavior and limit lateral movement, treating no session as inherently safe. Option D is correct because Zero Trust requires limiting user access through Just-In-Time and Just-Enough-Access (JIT/JEA) principles, granting only the minimum permissions needed for the minimum time required, often combined with adaptive, risk-based policies. Option B is incorrect because automatically trusting users and devices after a one-time perimeter authentication is the traditional castle-and-moat model that Zero Trust explicitly rejects. Option E is incorrect because granting broad internal network access to partners or contractors violates least-privilege and microsegmentation principles, regardless of operational convenience.

Answer

Trust users and devices automatically once they successfully authenticate at the network perimeter

Answer

Grant broad internal network access to trusted partners and contractors to streamline operations

Question 9

A security operations center (SOC) receives an alert that a user's workstation is communicating with a known command-and-control (C2) server. The analyst checks the firewall logs and sees that the traffic is allowed because it uses TCP port 443 and the destination IP is not on any blocklist. The analyst wants to quickly determine whether this is a false positive or a real compromise. Which of the following is the MOST appropriate next step to validate the alert?

Accepted Answer

Check the reputation of the destination IP address and domain using threat intelligence sources.. The correct answer is to check the reputation of the destination IP and domain using threat intelligence. This directly addresses whether the communication is likely malicious, given that the traffic was allowed. Threat intelligence provides context about the IP/domain, enabling the analyst to quickly classify the alert as true or false positive without disrupting operations.

Answer

Review the workstation's DNS query logs to see if the domain resolves to the same IP.

Answer

Immediately isolate the workstation from the network to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the workstation to check for malware.

Question 10

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the best fit for zero trust because it makes access decisions based on a combination of attributes, including user identity, device health, and environmental context. This dynamic, policy-driven approach supports continuous verification and least privilege, which are core to zero trust.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 11

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

Accepted Answer

Application-based security policies. Application-based security policies are the correct approach because they enable enforcement based on the actual application, not just port and protocol. This allows the firewall to identify and control applications regardless of the ports they use, which is essential for modern traffic that often evades port-based rules. Security profiles and application filters serve different purposes.

Answer

Application filters

Answer

Service objects

Answer

Security profiles

Question 12

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

Accepted Answer

Application-level encryption of ePHI using keys managed by the organization, independent of device encryption. Application-level encryption with organization-managed keys ensures ePHI remains unreadable if a device is lost or stolen, because decryption requires keys the organization controls. This approach works consistently across managed desktops and personal mobile devices and does not depend on native device encryption, satisfying the stated requirement. Remote wipe and DLP reduce risk but do not guarantee confidentiality of data at rest.

Answer

Data loss prevention (DLP) policies that block ePHI from being copied to removable media

Answer

Remote wipe capabilities that erase all data on lost or stolen devices

Answer

Full-disk encryption on all managed desktops and mobile devices

Question 13

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

Accepted Answer

Application whitelisting. Application whitelisting and endpoint detection and response (EDR) are both technical controls that directly mitigate malware execution. Whitelisting prevents unauthorized code from running, while EDR monitors and blocks malicious processes in real time. Together, they provide preventive and detective layers that are essential in a defense-in-depth strategy for endpoints.

Answer

Full disk encryption

Answer

Host-based firewall

Answer

Security awareness training

Question 14

A hospital's IT team is classifying the sensitivity of different data types to prioritize protection efforts. They label patient treatment records, real-time heart-rate monitor telemetry, and publicly published visitor parking maps. Which data classification scheme correctly reflects the risk-based handling these assets require?

Accepted Answer

Patient records and heart-rate telemetry are both Restricted, while visitor parking maps are Public.. Data classification must reflect the actual sensitivity and regulatory weight of each asset. Patient treatment records and live heart-rate telemetry are both high-impact clinical data requiring the strictest handling, while visitor parking maps are deliberately published and need no protection. This risk-based assignment ensures controls, retention, and access rules align with real impact.

Answer

Patient records are Internal, heart-rate telemetry is Restricted, and parking maps are Confidential.

Answer

Patient records are Public after patient consent, heart-rate telemetry is Internal, and parking maps are Restricted.

Answer

Patient records are Confidential, heart-rate telemetry is Public because it is only monitored internally, and parking maps are Internal.

Question 15

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

Accepted Answer

Implementing endpoint detection and response (EDR) with behavioral analytics and process lineage tracking. EDR with behavioral analytics and process lineage tracking detects malicious activity by monitoring how processes behave and relate to one another, which is effective against LOLBins and fileless attacks that leave no malicious files. Signature-based antivirus, network capture, and vulnerability scanning do not provide the endpoint behavioral visibility required to identify such intrusions.

Answer

Enabling full packet capture at the network perimeter to inspect all traffic for malicious payloads

Answer

Increasing the frequency of vulnerability scans to identify unpatched software that could be exploited

Answer

Deploying additional signature-based antivirus engines with broader malware definition sets