Cybersecurity-Practitioner Multiple Select — 10 Questions

Question 1

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Group related security rules into logical rule categories for easier management and auditing.. Best practices for security rules include grouping related rules into rule categories, using descriptive names, avoiding overly broad 'any-any' rules where possible, and leveraging Security-ID/App-ID rather than port-based rules.

Answer

Disable logging on all security rules to conserve management plane CPU resources.

Answer

Always use the 'any' source zone to ensure all internal subnets are covered simultaneously.

Answer

Place broad, permissive rules at the top of the security policy base to speed up rule evaluation.

Question 2

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

Accepted Answer

Verify that the DNS Proxy object has valid primary and secondary external DNS server IP addresses configured.. When configuring DNS Proxy on a Palo Alto Networks firewall, the administrator must ensure primary/secondary DNS servers are configured, the interface is enabled for DNS proxy, and client requests are pointed to the correct proxy interface IP.

Answer

Ensure captive portal redirection is enabled on the loopback address.

Answer

Verify that BGP routing is enabled on all Layer 2 trust interfaces.

Answer

Check that the GlobalProtect portal certificate is installed in the trusted root store.

Question 3

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. High management plane CPU can be caused by heavy logging/reporting queries, large external dynamic list (EDL) downloads, excessive Panorama synchronization, or frequent XML API requests.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 4

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

Accepted Answer

ICMP and UDP flood protection setting packet rate thresholds.. Zone Protection Profiles protect against SYN floods, ICMP/UDP floods, IP spoofing, packet-based attacks (e.g., overlapping fragments, land attacks), and reconnaissance.

Answer

Advanced URL filtering categorization of malicious phishing links.

Answer

Automatic kernel-level malware sandboxing of unknown executable attachments.

Question 5

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. Comprehensive outbound web protection requires URL Filtering (to block malicious sites) and Anti-Spyware or Antivirus/Vulnerability protection (to block malware and exploits).

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 6

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Management plane security best practices include restricting access via IP, using dedicated management interfaces, and disabling unnecessary services.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 7

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

Accepted Answer

Remote Services (e.g., SMB/Windows Admin Shares, RDP). Remote Services (T1021) and Exploitation of Remote Services (T1210) are classic techniques used by adversaries to move laterally through an environment.

Answer

Phishing via Spearphishing Link

Answer

Automated Exfiltration Over C2 Channel

Answer

Steal Web Session Cookie

Question 8

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Zero Trust identity strategies mandate continuous, risk-based adaptive verification and the strict enforcement of least-privilege access rather than relying on perimeter location or static trust.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 9

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

Accepted Answer

User-ID Agent mapping and Windows Security Event Log polling. PAN-OS supports User-ID agent mapping, captive portal, Exchange monitoring, Syslog listening, and GlobalProtect as mapping sources.

Answer

ICMP Ping sweeps of internal subnet scopes

Answer

BGP routing table advertisements

Answer

Direct DNS Zone Transfer requests initiated by the firewall data plane

Question 10

A security operations team is reviewing MITRE ATT&CK Tactic classifications for an incident involving credential theft and subsequent unauthorized actions on a Palo Alto Networks protected network. Which THREE of the following Tactics fall under the 'Post-Compromise' or later stages of the attack lifecycle? (Choose three)

Accepted Answer

Exfiltration. In MITRE ATT&CK, tactics like Exfiltration, Lateral Movement, and Command and Control occur after initial access and execution.

Answer

Initial Access

Answer

Reconnaissance