Cybersecurity-Practitioner Multiple Select — 60 Questions

Question 1

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Proxy server address and port.. To enable communication through a forward proxy, the agent configuration must include the proxy server address and port, as well as authentication credentials if the proxy requires them. These settings allow the agent to establish a connection and authenticate with the proxy, ensuring that telemetry and management traffic reach the Cortex XDR management server.

Answer

DNS server addresses for the proxy.

Answer

Broker VM address and port.

Answer

SSL/TLS certificate for the proxy.

Question 2

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

Accepted Answer

Actions on Objectives. The Lockheed Martin cyber kill chain defines seven sequential phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B, Actions on Objectives, is correct because it is the final phase where the attacker accomplishes their goal, such as encrypting files in a ransomware attack. Option C, Weaponization, is correct because it is the phase where the attacker pairs an exploit with a payload (e.g., a malicious macro or exploit kit) to create the deliverable malware. Option E, Delivery, is correct because it is the phase where the weaponized payload is transmitted to the target, such as via phishing email, USB drive, or web download. Option A, Mitigation, is not part of the kill chain; it is a defensive countermeasure category, not an attacker phase. Option D, Continuous Patching, is not part of the kill chain either; it is a vulnerability management practice, not an attack phase.

Answer

Mitigation

Answer

Continuous Patching

Question 3

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

Accepted Answer

Continue (prompts the user with a warning page requiring acknowledgment before proceeding). In a URL Filtering profile, each URL category can be assigned one of several actions, and the three valid actions here are Continue, Block, and Alert. Option A, Continue, is correct because it allows the user to proceed only after being shown a warning/response page that requires acknowledgment, which is a standard URL Filtering action for cautioning users about risky categories. Option B, Block, is correct because it terminates the session and presents a response page, which is the primary enforcement action for malicious or disallowed URL categories. Option D, Alert, is correct because it permits the traffic while generating a URL log entry, enabling monitoring without blocking. Option C, Quarantine, is not a URL Filtering profile action; client isolation into an isolated VLAN is a function of host information/profile or quarantine features, not URL category actions. Option E, Encrypt, is not a URL Filtering action; SSL forward proxy decryption is configured in decryption policy/profiles, not as a per-URL-category action in a URL Filtering profile.

Answer

Quarantine (isolates the client workstation into an isolated VLAN)

Answer

Encrypt (automatically forces SSL forward proxy decryption for the URL)

Question 4

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

Accepted Answer

Disable administrative services like HTTP and Telnet, utilizing HTTPS and SSH instead.. Option A is correct because disabling cleartext administrative services such as HTTP and Telnet and using HTTPS and SSH instead ensures that management sessions are encrypted and resistant to credential sniffing. Option B is correct because attaching a Management Profile to the management interface lets you permit administrative access only from specific, trusted source IP addresses and restrict which services are enabled, shrinking the attack surface. Option D is correct because placing management on a dedicated out-of-band network physically or logically separated from data traffic prevents compromised data-plane hosts from reaching the firewall's management plane. Option C is not recommended because granting every administrator the superuser role violates least privilege and increases the impact of a compromised account. Option E is not recommended because SSHv1 and SSLv2 are deprecated, cryptographically weak protocols that expose management sessions to known attacks.

Answer

Assign all administrative users the 'superuser' role to simplify troubleshooting.

Answer

Enable SSHv1 and SSLv2 to ensure legacy administrative tool compatibility.

Question 5

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

Accepted Answer

Registry modification events.. Cortex XDR ingests endpoint telemetry from the Palo Alto Networks Cortex XDR agent, which includes process execution and termination telemetry (Option C) — the agent records process creation, command lines, parent-child relationships, and termination events to build the causality chain used in the Cortex XDR causality analysis engine. It also collects network connection and socket activity logs (Option D), capturing details such as source/destination IP addresses, ports, protocols, and the processes that opened sockets, which are essential for detecting command-and-control and lateral movement. Registry modification events (Option A) are likewise gathered, since the agent monitors Windows registry key/value changes (e.g., Run keys, services, and persistence locations) to surface malicious persistence and configuration tampering. Options B and E are not endpoint security telemetry: personal email bodies and browser photo uploads are user content that Cortex XDR does not ingest, and cafeteria menu preferences are entirely unrelated to endpoint visibility.

Answer

Personal user email message bodies and browser photo uploads.

Answer

Internal corporate cafeteria menu preferences.

Question 6

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Option A is correct because Zero Trust identity requires strong authentication such as MFA combined with continuous, risk-based adaptive validation, meaning access decisions are re-evaluated based on signals like user behavior, location, and device health rather than granted once at login. Option C is correct because Zero Trust enforces least-privilege access, granting only the minimum permissions needed and dynamically scoping them to user role, device posture, and contextual factors such as time and location. Option B is incorrect because permanent administrative access after a one-time compliance check violates Zero Trust's continuous verification and least-privilege principles. Option D is incorrect because implicitly trusting traffic from a corporate VPN contradicts the Zero Trust tenet of never trusting based on network location. Option E is incorrect because bypassing authentication for internal applications, even from managed assets, undermines the requirement to authenticate and authorize every access request.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 7

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

Accepted Answer

Utilization of stealthy techniques designed to evade standard security monitoring tools. Option B is correct because APT actors prioritize operational security, employing stealthy techniques such as living-off-the-land binaries (LOLBins), fileless malware, and encrypted C2 channels specifically to evade EDR, SIEM, and other standard monitoring tools. Option C is correct because APTs typically build or acquire bespoke command-and-control infrastructure (e.g., custom implants, domain fronting, or victim-specific redirectors) tailored to the target's environment, rather than using commodity tooling that defenders can easily signature. Option E is correct because the defining characteristic of an APT is the 'persistent' element: adversaries establish long-term footholds using mechanisms like scheduled tasks, WMI subscriptions, or registry Run keys, maintaining access for months or years to conduct espionage or lateral movement. Option A is incorrect because exclusive reliance on public pentest scripts describes commodity or script-kiddie activity, whereas APTs develop or purchase custom exploits and zero-days. Option D is incorrect because short dwell times and noisy, aggressive encryption describe ransomware or smash-and-grab operations, not the low-and-slow, stealthy, long-dwell behavior of APTs.

Answer

Exclusive reliance on publicly available penetration testing scripts

Answer

Short dwell times with aggressive, noisy data encryption

Question 8

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

Accepted Answer

Group related security rules into logical rule categories for easier management and auditing.. Option A is correct because grouping related security rules into logical categories (for example, by function, department, or traffic type) improves readability, simplifies auditing, and makes policy maintenance far more manageable as rulebases grow. Option D is correct because using specific Application definitions via App-ID instead of generic port/protocol rules provides granular, application-aware enforcement, reduces the attack surface, and aligns with Palo Alto Networks best practices for least-privilege policy design. Option B is wrong because disabling logging on all rules destroys the visibility and forensic data needed for threat detection, troubleshooting, and compliance, and logging does not meaningfully burden the management plane in that way. Option C is wrong because using 'any' source zone is overly permissive and violates least-privilege principles; specific source zones should be defined. Option E is wrong because broad, permissive rules at the top of the rulebase undermine security and, since PAN-OS evaluates rules top-down, they would shadow more specific rules rather than improve security posture.

Answer

Disable logging on all security rules to conserve management plane CPU resources.

Answer

Always use the 'any' source zone to ensure all internal subnets are covered simultaneously.

Answer

Place broad, permissive rules at the top of the security policy base to speed up rule evaluation.

Question 9

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

Accepted Answer

Initiate a remote PowerShell session or run triage scripts via Remote Response.. Option B is correct because Cortex XDR's Remote Response capability lets analysts open a live terminal (including a remote PowerShell session on Windows) and execute triage scripts or commands directly on the compromised endpoint from the management console. Option E is correct because the console provides a one-click Endpoint Isolation action that severs the host's network connectivity (except to the Cortex XDR management channel) to contain the threat and prevent lateral movement. Options A, C, and D are incorrect because reflashing BIOS firmware, upgrading physical RAM, and reinstalling the OS from a golden image are hardware/firmware or imaging operations that fall outside the Cortex XDR console's agent-based response actions and would require separate tools or physical/out-of-band access.

Answer

Reflash the physical BIOS firmware remotely to remove persistent bootkits.

Answer

Upgrade the physical RAM hardware configuration.

Answer

Reinstall the host operating system from a golden cloud image.

Question 10

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) for all administrator accounts. Option A is correct because enforcing Multi-Factor Authentication (MFA) for all administrator accounts adds a critical second authentication factor beyond passwords, mitigating credential theft, brute-force, and phishing attacks against Panorama's administrative logins. Option E is correct because restricting administrative access to dedicated out-of-band management networks or specific trusted IP addresses limits the attack surface by ensuring only authorized source networks can reach the management interface, blocking lateral movement and unauthorized external access. Options B, C, and D are incorrect: disabling HTTPS redirection would weaken security by allowing cleartext HTTP management sessions instead of forcing TLS-encrypted access; sharing a single superuser account destroys accountability and non-repudiation since actions cannot be attributed to individual analysts; and allowing unauthenticated HTTP management access from any internal IP exposes the management plane to eavesdropping, tampering, and unauthorized configuration changes.

Answer

Disable HTTPS redirection on the management interface

Answer

Share a single superuser account among all shift analysts to streamline shift handovers

Answer

Allow unauthenticated HTTP management access from any internal IP address

Question 11

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

Accepted Answer

Authentication Profile under Device > Authentication referencing the RADIUS server profile.. Option E is correct because the firewall must first define a RADIUS Server Profile under Device > Server Profiles > RADIUS, which specifies the RADIUS server's IP address, shared secret, port (default 1812 for authentication), and timeout/retry settings so the firewall can communicate with the external RADIUS server. Option D is correct because an Authentication Profile under Device > Authentication must be created to reference that RADIUS server profile, defining the authentication method and allowed user/group lists, and this profile is then applied to the management interface or administrative accounts to enforce RADIUS-based admin login. Option A is incorrect because an External Dynamic List is used to import IP addresses, URLs, or domains for policy enforcement, not to point to a RADIUS authentication database. Option B is incorrect because a WildFire Analysis Profile submits files to the WildFire cloud for malware analysis and has nothing to do with user authentication. Option C is incorrect because an SSL Decryption Profile is used to decrypt and inspect SSL/TLS traffic, not to authenticate administrative access on the management interface.

Answer

External Dynamic List (EDL) pointing to the RADIUS authentication database.

Answer

WildFire Analysis Profile set to authenticate users.

Answer

SSL Decryption Profile attached to the management interface.

Question 12

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

Accepted Answer

Define a device control rule that blocks the USB mass storage device class. A device control rule that blocks the USB mass storage device class establishes the restriction, and an exception for approved encrypted drives by vendor and product ID permits only authorized devices. Exploit protection, report-only mode, and malware profile blocklists do not enforce device access control, so they cannot satisfy the requirement.

Answer

Set the agent to report-only mode for device control

Answer

Enable the exploit protection module for USB drivers

Answer

Add the USB mass storage class to the malware profile blocklist

Question 13

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

Accepted Answer

Assume breach by minimizing blast radius and segmenting networks, and inspecting all traffic. Option A is correct because Zero Trust requires an 'assume breach' mindset: minimizing blast radius through microsegmentation and inspecting all traffic (including east-west) prevents lateral movement after a compromise. Option B is correct because 'verify explicitly' means every access request must be authenticated and authorized using all available signals—identity, location, device health, and other telemetry—rather than relying on a single credential check. Option C is correct because least privilege access enforces just-enough, just-in-time permissions via risk-based adaptive policies, limiting user and device reach to only what is needed. Option D is incorrect because implicitly trusting the internal network after VPN authentication is exactly the perimeter-based trust model Zero Trust rejects. Option E is incorrect because bypassing inspection for internal-to-internal traffic violates the assume-breach principle and would allow undetected lateral movement.

Answer

Trust the internal network perimeter implicitly once a user successfully authenticates via VPN

Answer

Bypass security inspection for internal-to-internal data center traffic to maximize network performance

Question 14

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

Accepted Answer

Application whitelisting. Application whitelisting and endpoint detection and response (EDR) are both technical controls that directly mitigate malware execution. Whitelisting prevents unauthorized code from running, while EDR monitors and blocks malicious processes in real time. Together, they provide preventive and detective layers that are essential in a defense-in-depth strategy for endpoints.

Answer

Full disk encryption

Answer

Host-based firewall

Answer

Security awareness training

Question 15

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Accepted Answer

Antivirus Profile. The Antivirus Profile (A) is correct because it scans the allowed web traffic for malware, viruses, and exploit signatures, which directly addresses the requirement to inspect HTTP/HTTPS content for malicious payloads. The URL Filtering Profile (E) is correct because it inspects the requested URLs and categorizes them, allowing the firewall to block or alert on malicious, phishing, or otherwise risky web destinations. Together, these two profiles provide the layered content inspection needed for comprehensive outbound web protection. The QoS Profile (B) only manages bandwidth prioritization and does not inspect traffic for threats. The Zone Protection Profile (C) defends against flood and reconnaissance attacks at the ingress zone level, not against malicious URLs or malware in web sessions. The Network Access Profile (D) is not a valid security profile for content inspection and does not provide URL or malware filtering.

Answer

Quality of Service (QoS) Profile

Answer

Zone Protection Profile

Answer

Network Access Profile

Question 16

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

Accepted Answer

Excessive XML API requests or frequent script-based configuration pushes.. The management plane handles control and administrative functions, so option A is correct because excessive XML API calls or frequent script-based configuration pushes consume management-plane CPU for parsing, validation, and commit processing. Option C is correct because logging queries, traffic log exports, and Panorama log forwarding are management-plane tasks that can heavily load the CPU when volumes are high. Option D is correct because External Dynamic List downloads are retrieved and processed by the management plane, and large or frequent EDL refreshes can saturate its retrieval threads. Option B is incorrect because next-hop packet re-synthesis and Layer 3 forwarding table issues occur on the data plane, not the management plane. Option E is incorrect because GlobalProtect Gateway SSL VPN data tunnel encryption is handled by data-plane processing, not the management plane.

Answer

An improperly sized Layer 3 forwarding table causing next-hop packet re-synthesis on the data plane.

Answer

GlobalProtect Gateway SSL VPN data tunnel encryption processing.

Question 17

An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)

Accepted Answer

Trusted Images. Admission Control and Trusted Images work together to enforce that only approved container images are deployed. Admission Control intercepts pod creation requests and applies policies, while Trusted Images defines which registries or images are considered trusted. This combination allows the organization to block unapproved images at deployment time. Image Scanning and Runtime Defense are detection and response tools, and Cloud Discovery provides visibility, but none of these enforce admission policies.

Answer

Runtime Defense

Answer

Image Scanning

Answer

Cloud Discovery

Question 18

A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM) with predefined and custom policies.. Prisma Cloud's CSPM capability continuously assesses cloud resource configurations against best practices, while compliance reporting maps those findings to standards like CIS and PCI DSS. Together, they provide the detection and reporting needed to maintain a secure posture across multi-cloud environments. Other capabilities like CWPP, CIEM, and CNS address different security domains.

Answer

Cloud Infrastructure Entitlement Management (CIEM) for analyzing identity permissions.

Answer

Cloud Network Security (CNS) for microsegmentation and firewall policy management.

Answer

Cloud Workload Protection Platform (CWPP) for runtime defense of virtual machines.

Question 19

A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)

Accepted Answer

Detection of misconfigured cloud resources, such as publicly accessible storage buckets.. Prisma Cloud CSPM is designed to continuously monitor cloud environments for misconfigurations and compliance violations. It detects issues like publicly accessible storage buckets and provides compliance reporting against standards such as CIS, GDPR, and HIPAA. It does not handle runtime protection, network traffic inspection, or automated remediation of IAM policies. Those are handled by other modules or require additional tools.

Answer

Automated remediation of identity and access management (IAM) policies across cloud accounts.

Answer

Runtime protection for serverless functions, including blocking malicious invocations.

Answer

Network traffic inspection and intrusion prevention for east-west traffic in Kubernetes clusters.

Question 20

A cloud security team is deploying Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and Google Cloud. The team wants to use the Cloud Security Posture Management (CSPM) capabilities and needs to understand which onboarding components are required to enable posture visibility across these providers. (Choose two.)

Accepted Answer

The cloud account or subscription registered in Prisma Cloud with the correct provider type. CSPM onboarding for multi-cloud environments requires a read-only credential with the right permissions in each provider plus registration of the account or subscription in Prisma Cloud with the correct provider type. Together these allow the platform to discover resources and evaluate configurations. Agent-based Defenders, inline proxies, and Prisma Access tunnels serve different purposes and do not enable posture visibility.

Answer

A Prisma Access remote network connection for each cloud region

Answer

A Prisma Cloud Compute Defender deployed on every virtual machine in each cloud account

Answer

An inline forward proxy in each virtual network to capture east-west traffic