Cybersecurity-Practitioner Hard Questions — 25 Difficult Questions

Question 1

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Proxy server address and port.. To enable communication through a forward proxy, the agent configuration must include the proxy server address and port, as well as authentication credentials if the proxy requires them. These settings allow the agent to establish a connection and authenticate with the proxy, ensuring that telemetry and management traffic reach the Cortex XDR management server.

Answer

DNS server addresses for the proxy.

Answer

Broker VM address and port.

Answer

SSL/TLS certificate for the proxy.

Question 2

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

Accepted Answer

Causality View. Causality View is designed specifically for visualizing process ancestry and the details of each process, including command-line arguments. In a scenario where a suspicious process is spawned by an Office application, this view enables the analyst to quickly see whether the PowerShell command is obfuscated or contains malicious parameters, thereby accelerating triage.

Answer

Incident Timeline

Answer

Threat Intelligence

Answer

Alert Details

Question 3

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

Accepted Answer

The host is infected with malware that uses DGA to locate its command-and-control (C2) server.. The random-looking subdomains and regular intervals are classic signs of a domain generation algorithm (DGA) used by malware to find its command-and-control server. The host is likely infected and attempting to resolve domains until it reaches the attacker's active C2. This behavior is distinct from DNS amplification, domain fronting, or DNS tunneling, which have different traffic patterns.

Answer

The host is exfiltrating data via DNS tunneling to the domain.

Answer

The host is performing a DNS amplification attack against the domain.

Answer

The host is using a domain fronting technique to hide its traffic.

Question 4

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

Accepted Answer

DoS Protection profile with classified and aggregate rate limiting rules. A DoS Protection profile with classified and aggregate rate limiting rules is specifically designed to mitigate volumetric and application-layer floods, including HTTP GET floods, by rate-limiting based on source, destination, or application criteria while allowing legitimate traffic. This is the correct platform capability to tune for this attack.

Answer

GlobalProtect Host Information Profile (HIP) compliance check

Answer

WildFire analysis profile with machine learning heuristics enabled

Answer

Application Override policy to bypass deep packet inspection for HTTP traffic

Question 5

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Option A is correct because disabling cleartext administrative services such as HTTP and Telnet and using HTTPS and SSH instead ensures that management sessions are encrypted and resistant to credential sniffing. Option B is correct because attaching a Management Profile to the management interface lets you permit administrative access only from specific, trusted source IP addresses and restrict which services are enabled, shrinking the attack surface. Option D is correct because placing management on a dedicated out-of-band network physically or logically separated from data traffic prevents compromised data-plane hosts from reaching the firewall's management plane. Option C is not recommended because granting every administrator the superuser role violates least privilege and increases the impact of a compromised account. Option E is not recommended because SSHv1 and SSLv2 are deprecated, cryptographically weak protocols that expose management sessions to known attacks.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 6

A Cortex XDR administrator wants to reduce alert noise from a custom internal application that legitimately writes to the Windows registry Run key during installation. The administrator needs to suppress future alerts for this specific behavior on a defined group of developer endpoints without disabling the Behavioral Threat module globally. Which Cortex XDR capability should the administrator use?

Accepted Answer

Create an exception rule scoped to the developer endpoint group for the specific behavior and process. Exception rules provide granular, scoped suppression for specific behaviors, processes, and endpoint groups while leaving the broader Behavioral Threat module active. By targeting only the internal application on developer endpoints, the administrator eliminates the false-positive noise without weakening protection elsewhere. This is the recommended approach for balancing operational efficiency with security coverage.

Answer

Disable the Behavioral Threat module for the developer endpoint group

Answer

Lower the alert severity of the Run key behavior to Informational in the policy

Answer

Add the internal application's hash to the Allow List in the Malware profile

Question 7

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. In a SAML integration between Microsoft Entra ID and GlobalProtect, conditional access policies that evaluate device compliance (managed vs. unmanaged) are enforced by the identity provider (Microsoft Entra ID) during authentication and token issuance. Microsoft Entra ID evaluates the device state via Intune or hybrid Microsoft Entra ID join and either issues or denies the SAML assertion; the GlobalProtect gateway simply consumes the assertion and grants access based on the attributes returned.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 8

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

Accepted Answer

Custom command and control infrastructure and objectives focused on espionage. The [CORRECT] answer is D because APTs are defined by their tailored, persistent approach: they build or rent custom C2 infrastructure (e.g., Cobalt Strike, Sliver, or bespoke implants) and pursue long-term intelligence collection rather than immediate financial gain. This contrasts with opportunistic ransomware, which typically uses commodity tooling and prioritizes speed over stealth. The espionage objective explains the long dwell times, stealthy lateral movement, and custom tooling described in the scenario.

Answer

Rapid data encryption and extortion demands

Answer

Low dwell time and heavy reliance on automated scanners

Answer

Exclusive use of built-in Living off the Land binaries

Question 9

A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?

Accepted Answer

App-ID. App-ID identifies applications regardless of port, protocol, or encryption, using signatures and behavioral analysis. This allows the engineer to create policies based on applications rather than ports, ensuring accurate identification and control of applications using non-standard ports. Port-based rules, SSL decryption, and User-ID do not provide this capability on their own.

Answer

SSL decryption

Answer

Port-based rules

Answer

User-ID

Question 10

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Option A is correct because Zero Trust identity requires strong authentication such as MFA combined with continuous, risk-based adaptive validation, meaning access decisions are re-evaluated based on signals like user behavior, location, and device health rather than granted once at login. Option C is correct because Zero Trust enforces least-privilege access, granting only the minimum permissions needed and dynamically scoping them to user role, device posture, and contextual factors such as time and location. Option B is incorrect because permanent administrative access after a one-time compliance check violates Zero Trust's continuous verification and least-privilege principles. Option D is incorrect because implicitly trusting traffic from a corporate VPN contradicts the Zero Trust tenet of never trusting based on network location. Option E is incorrect because bypassing authentication for internal applications, even from managed assets, undermines the requirement to authenticate and authorize every access request.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 11

An enterprise deploying VM-Series firewalls in Google Cloud Platform (GCP) requires centralized license management via Panorama. Which licensing mode should be configured so that firewalls automatically obtain their licenses from Panorama based on consumption or pre-purchased credits?

Accepted Answer

Configure VM-Series Bootstrap with a Panorama AuthKey and Plugin for VM-Series Auto-Registration and Software-based Licensing.. For VM-Series firewalls in GCP requiring centralized licensing via Panorama, the correct mode is Bootstrap with a Panorama AuthKey and the VM-Series Auto-Registration plugin for software-based licensing. This allows firewalls to register with Panorama automatically and obtain licenses from a pool of consumption or pre-purchased credits, which is essential for autoscaling environments where instances are ephemeral.

Answer

Configure GCP Secret Manager to inject floating MAC addresses into the management interface.

Answer

Connect each VM-Series firewall directly to an on-premises hardware License Key Server (LKS) via a dedicated VPN.

Answer

Manually upload a permanent .lic license file via SSH to every autosscaled GCP instance upon boot.

Question 12

An enterprise is deploying CN-Series firewalls to secure traffic inside a Kubernetes cluster. Which THREE architectural elements are required for successful deployment and operation of CN-Series firewalls? (Choose two... wait, prompt asks for THREE: Choose three)

Accepted Answer

Panorama management server configured to manage container firewalls and push security policies.. CN-Series firewalls require the CN-Series management plane (Panorama), the CN-Series dataplane (Container Firewall pod), and Container Network Interface (CNI) integration or service mesh integration to steer traffic.

Answer

AWS Direct Connect dedicated fiber optic circuits connected directly to the Kubernetes kubelet process.

Answer

Dedicated physical rackmount chassis with hardware FPGA accelerator cards installed in the Kubernetes master node.

Question 13

An administrator is troubleshooting a policy issue where a Prisma Cloud RQL (Resource Query Language) query is not returning expected AWS EC2 instances. The query is: `config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances'`. What is the most likely reason the query fails to return resources?

Accepted Answer

The `api.name` syntax is incorrect for configuration queries; resource queries should use `resource.type = 'Ec2Instance'`.. RQL syntax for CSPM resource queries uses `config from cloud.resource where cloud.type = 'aws' and resource.type = 'Ec2Instance'`. Querying raw API names directly in resource queries is incorrect.

Answer

The query must include the AWS account ID prefix inside single quotes for every condition.

Answer

The query is missing the `event.name` parameter required for cloud storage inspection.

Answer

RQL queries can only be executed against Azure and GCP resources, not AWS.

Question 14

An organization requires that internal clients accessing external HTTPS websites undergo URL filtering and decryption, but users must be able to opt-out of decryption for sensitive categories like Finance and Healthcare. Which configuration option inside the Decryption rule best achieves this bypass requirement?

Accepted Answer

Configure a Decryption Profile with specific URL categories set to 'No Decrypt'.. Decryption profiles allow administrators to specify actions for different URL categories, including the ability to 'No Decrypt' specific sensitive categories.

Answer

Create a separate Security policy rule with an explicit deny action for those categories.

Answer

Disable SSL Forward Proxy globally on the firewall.

Answer

Use an Authentication Profile to prompt the user to accept a waiver before proceeding.

Question 15

An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?

Accepted Answer

Create an explicit Decryption rule at the top of the Decryption policy with action 'No Decrypt', specifying the custom port and destination server address.. A decryption exclusion list only covers pre-defined applications/URLs on standard ports; a pinned certificate on a non-standard port like TCP 8443 will not match those signatures, so it continues to be decrypted. The reliable fix is an explicit Decryption policy rule placed at the top with action 'No Decrypt', scoped to the destination server address and custom port 8443, so the firewall bypasses decryption for that specific flow before any other rule matches.

Answer

Add the medical portal's URL to the File Blocking Profile under Objects.

Answer

Enable strict SSL Decryption fallback on the Decryption Profile.

Answer

Disable App-ID inspection on port 8443 using an Application Override policy.

Question 16

An enterprise firewall is configured with multiple virtual systems (vsys). An administrator needs to configure inter-vsys routing to allow traffic to flow securely between Vsys1 and Vsys2 without traversing physical external interfaces. What is the correct method to achieve this in PAN-OS?

Accepted Answer

Configure an inter-vsys interface pair under Network > Interfaces > Inter-VSYS and assign them to respective virtual systems.. Inter-vsys routing is achieved by configuring virtual routers or using dedicated inter-vsys interfaces (virtual wire or inter-vsys links) or shared gateway routing depending on PAN-OS architecture. Specifically, PAN-OS allows inter-vsys communication using virtual router route leaking or dedicated inter-vsys interfaces.

Answer

Enable Multi-Virtual System Redundancy Protocol (MVSRP) on the system tab.

Answer

Create a Layer 2 VLAN subinterface with an 802.1Q tag shared between both virtual systems.

Answer

Configure a static route in Vsys1 pointing to the next-hop IP of Vsys2's management interface.

Question 17

A security engineer needs to investigate endpoint telemetry data for a suspicious fileless attack that executed PowerShell commands out of memory. Which Cortex XDR component provides deep forensic visibility into command-line arguments, registry modifications, and network connections without relying solely on traditional logs?

Accepted Answer

Cortex XDR Host Insights data collection and querying engine. Host Insights provides comprehensive endpoint telemetry and forensic data storage for deep hunting and investigation.

Answer

Cortex XDR Malware Prevention module

Answer

Local Analysis engine utilizing machine learning models

Answer

WildFire cloud-based static and dynamic analysis sandbox

Question 18

An administrator implements a decryption policy to block outbound traffic using obsolete TLS 1.0 protocols. When users attempt to access a legacy partner portal that only supports TLS 1.0, the connection fails with an decryption error. The administrator wants to gracefully alert users with a customizable response page instead of dropping the connection outright. Which setting must be enabled in the Decryption Profile?

Accepted Answer

Enable 'Block session with error' in the Decryption Profile options.. To show a response page when a decryption action blocks or fails due to unsupported versions, 'Block session with error' or the specific 'Strip SSL/TLS' / response page options must be enabled. Specifically, 'Block session with error' enables the generation of a response page.

Answer

Install a secondary Forward Untrusted Certificate.

Answer

Configure a URL Filtering profile with a custom blocking action.

Answer

Change the decryption action from 'Decrypt' to 'No Decrypt' automatically upon protocol failure.

Question 19

An administrator configures High Availability (HA) Active/Active mode on a pair of Palo Alto Networks firewalls. Which THREE operational considerations or configurations apply specifically to Active/Active deployments compared to Active/Passive? (Choose three)

Accepted Answer

Requires the configuration of floating IP addresses for interfaces to manage ARP and traffic distribution between peers.. Active/Active HA requires device-ID assignment (Device A vs Device B), floating IP addresses for session failover/redirection, and specific packet forwarding paths using HA3 connections.

Answer

Configuration commits must be performed exclusively on the passive peer.

Answer

Both firewalls must have identical serial numbers and hardware license keys.

Answer

Session synchronization occurs automatically via the HA3 data path link.

Question 20

An organization adopts a Zero Trust Architecture and decides to use Palo Alto Networks User-ID to enforce least-privilege application access policies. However, direct polling of domain controllers is restricted due to security hardening. Which alternative User-ID method allows the firewall to gather user mapping information securely without direct domain controller polling?

Accepted Answer

Configuring explicit Syslog parsing on the firewall to ingest login events sent from a SIEM. The User-ID XML API allows external security systems, identity brokers, or login scripts to push user-to-IP mappings securely to the firewall without direct DC polling.

Answer

Disabling User-ID and relying solely on source IP address subnets in security rules

Answer

Enabling SNMP v1 read-only polling of user session tables

Answer

Enforcing GlobalProtect captive portal without authentication cookies