Cybersecurity-Practitioner Cybersecurity Fundamentals — Timed 20 Questions

Question 1

A security administrator is reviewing firewall logs and notices multiple outbound connection attempts from a client workstation to known command and control IP addresses. Which security profile component is primarily responsible for generating a threat log entry for this specific outbound traffic?

20 minute time limit — choose an answer to begin.

Accepted Answer

Anti-Spyware profile configured with DNS Signatures and Spyware signatures. Outbound connection attempts to known command and control (C2) IP addresses are typically detected by the Anti-Spyware profile, which includes Spyware signatures that identify C2 traffic. Additionally, DNS Signatures within the Anti-Spyware profile can detect DNS queries to malicious domains. When such traffic matches, the firewall generates a threat log. URL Filtering, Vulnerability Protection, and WildFire profiles are not primarily responsible for detecting C2 IP connections.

Answer

URL Filtering profile configured to block malicious categories

Answer

Vulnerability Protection profile configured to block buffer overflows

Answer

WildFire analysis profile configured for forward unkown file actions

Question 2

An organization is implementing compliance controls to ensure that employees do not upload proprietary source code to unauthorized cloud storage providers. Which security profile feature should be utilized to control and log specific file transfers within recognized cloud applications?

Accepted Answer

File Blocking profile configured to block specific application file types. A File Blocking profile is designed to inspect and control specific file types within recognized applications, including cloud storage apps, and can block or alert on uploads/downloads of files like source code archives. This directly addresses preventing proprietary source code uploads to unauthorized cloud storage while logging the transfer.

Answer

Data Filtering profile configured with URL category exceptions

Answer

WildFire analysis profile configured for static code review

Answer

URL Filtering profile configured with Custom URL categories

Question 3

A security operations center (SOC) team wants to reduce alert fatigue by ensuring that low-severity threat events do not inundate their SIEM, while ensuring high-severity exploit attempts trigger immediate escalation. How should the administrator configure the security profiles to manage this?

Accepted Answer

Adjust the action settings within Vulnerability Protection and Anti-Spyware profiles based on threat severity. Adjusting the action settings within Vulnerability Protection and Anti-Spyware profiles based on threat severity allows the administrator to define granular responses — for example, setting low-severity threats to 'alert' or 'allow' with logging, and high-severity exploit attempts to 'block' or 'reset-both' with immediate escalation. This directly reduces SIEM noise from low-severity events while ensuring critical threats trigger escalation. It is the only option that addresses both the alert-fatigue and escalation requirements through policy configuration.

Answer

Configure an Application Override policy to bypass threat inspection for all traffic

Answer

Disable all logging in the Security policy rules for internal zones

Answer

Lower the firewall management plane CPU threshold limits

Question 4

An organization's security policy mandates that all software vulnerabilities with a CVSS score above 7.0 must be blocked at the network perimeter within 24 hours of disclosure. A new zero-day vulnerability is announced. While awaiting vendor patches, how can a Palo Alto Networks administrator immediately mitigate this threat using built-in platform features?

Accepted Answer

Apply a custom Vulnerability Protection signature or update the predefined threat signature action to 'block' for the specific CVE. Palo Alto's Vulnerability Protection profile contains signatures keyed to specific CVEs, and administrators can create custom signatures or modify the action of a predefined signature to 'block' for the affected CVE. This provides immediate virtual patching at the perimeter while the vendor patch is pending, satisfying the 24-hour mitigation mandate.

Answer

Configure a custom URL Filtering category to block the vendor advisory website

Answer

Deploy an Application Override policy to drop all traffic using the affected application port

Answer

Enable strict WildFire forwarding for all outbound DNS requests originating from the server subnet

Question 5

An organization's security policy requires that any detected malware file must be automatically blocked from entering the network during download. Which security profile and action combination ensures inline prevention against known malware?

Accepted Answer

Antivirus profile with action set to 'block' for all malware types and decoders. The Antivirus profile with action set to 'block' for all malware types and decoders is correct because it provides inline prevention by inspecting files as they are downloaded and immediately blocking known malware before it enters the network. This profile uses signature-based detection to identify and stop malicious files in real-time. Other options either do not provide inline blocking (WildFire async), are not designed for malware prevention (Data Filtering), or only block based on URL categories (URL Filtering).

Answer

WildFire analysis profile with file forwarding set to 'async'

Answer

Data Filtering profile configured to drop executable file extensions

Answer

URL Filtering profile configured to block malicious download categories

Question 6

A security administrator wants to ensure that administrators accessing the Palo Alto Networks firewall management plane do so securely using encrypted sessions and strong cryptographic keys. Which configuration area manages management plane access protocols and administrative ciphers?

Accepted Answer

Device > Setup > Management and Device > Setup > Content-ID settings. Device > Setup > Management > Authentication Settings or Device > Setup > Services configures management services and cryptographic settings.

Answer

Objects > Security Profiles > Administrator Access list

Answer

Policies > Decryption rulebase configuration tab

Answer

Network > Interfaces > Loopback configuration menu

Question 7

An enterprise network runs custom internal applications that utilize non-standard encryption protocols. To maintain visibility without breaking application functionality, the security team needs to deploy decryption. Which type of decryption should be configured if the firewall does not possess the private keys of the internal servers, but internal clients trust the firewall's forward proxy certificate?

Accepted Answer

SSL Forward Proxy Decryption. SSL Forward Proxy decryption is used when the firewall acts as a man-in-the-middle between internal clients and external servers, presenting its own certificate to the client (which the client trusts via a deployed forward proxy CA) and establishing a separate TLS session to the server. Because the firewall does not need the internal servers' private keys — it only needs the client to trust its proxy certificate — this matches the scenario where internal clients trust the firewall's forward proxy certificate.

Answer

SSL Inbound Inspection Decryption

Answer

Kerberos Decryption Service integration

Answer

SSH Decryption Proxy mode

Question 8

An administrator is reviewing firewall high availability (HA) states and configuration parameters. Which TWO settings must be identical on both firewall peers in an HA pair to ensure successful synchronization and cluster formation? (Choose two)

Accepted Answer

PAN-OS software version. Option C is correct because both peers in an HA pair must run the same PAN-OS software version; mismatched versions prevent configuration synchronization and can block HA cluster formation, since the HA protocol and config formats must match. Option D is correct because HA peers must be the same hardware model (e.g., PA-3220 with PA-3220), as HA synchronization and state sharing require identical hardware capabilities and interface layouts. Option A is not required to match, since each firewall needs its own unique management IP address on its control plane. Option B is not required to match, because each peer can have a distinct hostname for identification. Option E is not required to match, as DNS server settings are local device configuration and do not need to be identical for HA synchronization.

Answer

Management IP addresses of the individual firewall control planes

Answer

Hostname configured in the device management settings

Answer

DNS server IP addresses configured in device setup

Question 9

A security administrator notices a surge in brute-force login attempts against the external VPN gateway. The firewall successfully logs and drops these malicious sessions using an Anti-Spyware profile. Which common cyber threat vector is the firewall primarily defending against?

Accepted Answer

Credential stuffing and brute-force attacks. Brute-force attacks involve repeatedly guessing authentication credentials, which falls under credential-based attacks and automated threat vectors.

Answer

Distributed Denial of Service (DDoS)

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 10

A security engineer is implementing the principle of least privilege for a group of developers who need temporary access to a production database. The developers should only be able to query data, not modify it, and their access should expire after 8 hours. Which access control model best fits this requirement?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is correct because it uses attributes like time, user role, and resource sensitivity to make dynamic access decisions. This enables granting read-only access to developers that automatically expires after 8 hours, satisfying least privilege and temporary access requirements without manual revocation. Other models lack inherent time-based constraints or fine-grained context.

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Question 11

A security analyst is investigating a recent security incident and needs to determine the extent of the compromise. The analyst has identified a malicious file hash and wants to search historical network traffic logs to see if any internal hosts have communicated with external IPs associated with the hash. Which Palo Alto Networks feature should the analyst use?

Accepted Answer

WildFire submission logs. WildFire submission logs are the appropriate feature because they record file submissions and include file hashes along with session details. This allows the analyst to correlate the malicious hash with internal hosts and external IPs. Other features like Traffic logs do not contain file hashes, and WildFire and Threat Vault are not log search tools.

Answer

Threat Vault

Answer

WildFire

Answer

Traffic logs

Question 12

A security analyst is investigating a suspected compromised workstation. The analyst observes that the workstation is communicating with an external IP address on port 443, but the traffic is not TLS. The analyst also finds a scheduled task that runs a PowerShell script at startup. Which stage of the Cyber Kill Chain is most likely represented by these activities?

Accepted Answer

Command and Control (C2). Command and Control (C2) is the most likely stage because the compromised workstation is communicating with an external IP on a common port using non-standard protocol, and a scheduled task ensures persistence. These are hallmarks of an attacker maintaining remote control over the victim. Other stages like Weaponization or Exploitation do not involve ongoing communication from the compromised host.

Answer

Weaponization

Answer

Exploitation

Answer

Actions on Objectives

Question 13

A security team is implementing a defense-in-depth strategy to protect against ransomware. They want to focus on controls that can prevent the initial execution of ransomware on endpoints. Which two controls are most effective for this goal? (Choose two.)

Accepted Answer

Application whitelisting. Application whitelisting and EDR with behavioral blocking are the most effective preventive controls for stopping initial ransomware execution. Application whitelisting ensures only approved software runs, while EDR with behavioral blocking detects and halts malicious actions in real time. Together, they provide strong prevention against both known and unknown ransomware, directly addressing the execution phase.

Answer

Network segmentation

Answer

Regular offline backups

Answer

User security awareness training

Question 14

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

Accepted Answer

Anti-Spyware profile with DNS Signature enforcement. To prevent internal hosts from resolving malicious domains, the firewall must inspect DNS queries. The Anti-Spyware profile includes DNS Signatures that can detect and block DNS queries to known malicious domains. When attached to a Security rule, it enforces DNS sinkholing or blocking based on Palo Alto Networks threat intelligence. URL Filtering, Data Filtering, and Vulnerability Protection profiles do not provide DNS-level blocking for malicious domains.

Answer

URL Filtering profile with custom block lists

Answer

Data Filtering profile with pre-defined patterns

Answer

Vulnerability Protection profile with severity filters

Question 15

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

Accepted Answer

SSL Decryption must be active, and the security rule must have a WildFire Analysis profile set to forward the specific file type to the WildFire cloud. For WildFire to analyze files downloaded over HTTPS, the firewall must first decrypt the traffic via an SSL Decryption policy. Then, the Security policy rule that permits the traffic must have a WildFire Analysis profile attached, and that profile must be configured to forward the specific file type (e.g., PE, PDF) to the WildFire cloud for analysis. Without both conditions, the file remains encrypted or is not forwarded, preventing WildFire from inspecting it.

Answer

The decryption policy must exempt WildFire inspection traffic to prevent performance degradation on the data plane

Answer

A custom URL Filtering profile must be applied to decrypt traffic matching the unknown-file category

Answer

The Security rule must utilize an application override to bypass App-ID processing for encrypted file transfers

Question 16

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Accepted Answer

AutoFocus threat intelligence service. AutoFocus is Palo Alto Networks' threat intelligence service that aggregates WildFire, Unit 42, and third-party intel, letting analysts research TTPs, threat actors, and campaigns by industry sector. It provides contextual threat hunting through tags, actors, campaigns, and malware families, and correlates them with the organization's own telemetry. This is the correct tool for understanding sector-specific threat exposure and TTPs.

Answer

Panorama Log Collector forwarding engine

Answer

Application Command Center (ACC) dashboard

Answer

GlobalProtect Host Information Profile (HIP) engine

Question 17

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

Accepted Answer

WildFire cloud-based analysis and automated signature generation. WildFire is Palo Alto Networks' cloud-based malware analysis service that automatically analyzes suspicious files in a sandboxed environment. When a novel malware sample is identified, WildFire generates a new signature and pushes it to all subscribed Next-Generation Firewalls globally within minutes, enabling automatic blocking without manual intervention. This directly addresses the requirement for rapid, automated, global protection against new threats.

Answer

Palo Alto Networks MineMeld open-source threat intelligence

Answer

Traps Advanced Endpoint Protection cloud service

Answer

AutoFocus Context-Aware Threat Intelligence service

Question 18

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

Accepted Answer

User-ID agent or Panorama User-ID mapping. User-ID is the Palo Alto Networks feature that maps IP addresses to user identities, enabling security policies based on user or group rather than IP alone. Integrating a User-ID agent (or Panorama User-ID mapping) with the firewall populates the user-to-IP mapping table, which policy rules can then reference to enforce least-privilege access in a Zero Trust model.

Answer

GlobalProtect with Clientless VPN

Answer

App-ID cloud-based application signatures

Answer

WildFire threat intelligence cloud

Question 19

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

Accepted Answer

App-ID based security policies. App-ID identifies applications regardless of port or protocol, allowing internal segmentation firewalls to enforce granular, application-aware policies between tiers in the same zone. This lets the firewall permit, for example, only database traffic from the app tier to the DB tier while blocking everything else, achieving microsegmentation.

Answer

NAT policy source translation mapping

Answer

Static routing table optimization

Answer

Zone Protection profiles against SYN floods

Question 20

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

Accepted Answer

Panorama Administrative Roles and external authentication profiles (RADIUS/TACACS+/SAML). Panorama Administrative Roles allow granular role-based access control for administrators, and external authentication profiles (RADIUS, TACACS+, SAML) enable integration with enterprise identity providers. Together, they support individual administrator accounts with specific permissions, addressing the auditor's recommendation.

Answer

WildFire API token generation and management

Answer

User-ID clientless mapping via Windows User-ID Agent

Answer

GlobalProtect Portal client configuration profiles