Cybersecurity-Practitioner SOC Operations — 15 Questions

Question 1

An organization adopts a Zero Trust Architecture and decides to use Palo Alto Networks User-ID to enforce least-privilege application access policies. However, direct polling of domain controllers is restricted due to security hardening. Which alternative User-ID method allows the firewall to gather user mapping information securely without direct domain controller polling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring explicit Syslog parsing on the firewall to ingest login events sent from a SIEM. The User-ID XML API allows external security systems, identity brokers, or login scripts to push user-to-IP mappings securely to the firewall without direct DC polling.

Answer

Disabling User-ID and relying solely on source IP address subnets in security rules

Answer

Enabling SNMP v1 read-only polling of user session tables

Answer

Enforcing GlobalProtect captive portal without authentication cookies

Question 2

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping is classified under the Credential Access tactic (TA0006) as attackers attempt to acquire account names and passwords.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 3

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by their persistence, targeted focus, use of legitimate system tools (living off the land), and deliberate, stealthy manual intervention over automated destruction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals

Question 4

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. Azure AD / Entra ID conditional access policies evaluate device compliance and identity claims during the SAML authentication token issuance phase before GlobalProtect grants network access.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 5

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. Assigning a customized Role Profile with read-only permissions ensures the user has only the access required to perform their job and nothing more.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.

Question 6

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

Accepted Answer

Never trust, always verify through continuous context. Zero Trust mandates that access be granted based on continuous verification of context, identity, and posture, completely eliminating implicit trust zones.

Answer

Perimeter-based defense centralization

Answer

Implicit trust verification via subnet placement

Answer

Static role-based implicit authorization

Question 7

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

Accepted Answer

The external MFA server or Identity Provider integrated via RADIUS or SAML. The external multi-factor authentication server (such as RADIUS or SAML IdP) validates the secondary authentication token.

Answer

The Palo Alto Networks Next-Generation Firewall data plane

Answer

The Cortex XSOAR incident playbook engine

Answer

The local administrator database on Panorama

Question 8

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

Accepted Answer

Command and Control. Command and Control (TA0011) consists of techniques that adversaries use to communicate with systems under their control within a victim network.

Answer

Execution

Answer

Lateral Movement

Answer

Initial Access

Question 9

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

Accepted Answer

Privilege Escalation. Privilege Escalation (TA0004) consists of techniques that adversaries use to gain higher-level permissions on a system or network, such as modifying roles or permissions.

Answer

Initial Access

Answer

Exfiltration

Answer

Credential Access

Question 10

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Accepted Answer

Persistence. Persistence (TA0003) consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions.

Answer

Impact

Answer

Collection

Answer

Reconnaissance

Question 11

A security analyst is provisioning a new User-ID agent to map IP addresses to usernames in a Windows Active Directory domain. To adhere to least-privilege principles, what level of access should be granted to the service account used by the User-ID agent?

Accepted Answer

Read-only access to Active Directory security logs and event viewer access. The User-ID agent service account requires read-only permissions to query Active Directory security logs and the security event log, avoiding administrative privileges.

Answer

Local Administrator on all domain controllers

Answer

Domain Administrator privileges

Answer

Schema Administrator privileges

Question 12

An organization is deploying an explicit Zero Trust micro-segmentation strategy using Palo Alto Networks Next-Generation Firewalls. They want to ensure that if a workstation is compromised in the engineering VLAN, lateral movement to the financial VLAN is blocked, even if both belong to internal corporate subnets. Which firewall feature must be configured to achieve this?

Accepted Answer

Inter-zone Security Policy rules inspecting traffic between the engineering and finance zones. Internal segmentation firewall (ISFW) rules combined with App-ID and User-ID inspection are required to block unauthorized lateral traffic between internal VLANs.

Answer

GlobalProtect split-tunnel configuration for remote workers

Answer

NAT hairpinning configuration on the outside interface

Answer

Default inter-zone forwarding without explicit security profiles

Question 13

A SOC manager wants to restrict administrator access so that network engineers can modify firewall security policies, but cannot modify system-level settings or firewall high-availability (HA) parameters. Where should the manager configure this restriction in Panorama?

Accepted Answer

Panorama > Admin Roles. Admin Role Profiles in Panorama allow granular control over feature access, specifying exactly which tabs and actions an administrator can view or modify.

Answer

Objects > Custom Objects > URL Category

Answer

Network > Interfaces > VLAN

Answer

Device > Setup > Management

Question 14

An organization is deploying Zero Trust Network Access (ZTNA) via Prisma Access. The SOC notices that a user device with compromised posture (missing host integrity check) is successfully authenticated by the SAML IdP but is denied network access. Where is this runtime access enforcement happening?

Accepted Answer

At the Prisma Access cloud service node via GlobalProtect Gateway posture enforcement. Prisma Access evaluates the posture assessment and user context against the GlobalProtect Gateway agent settings and security rules to dynamically drop or restrict access at runtime.

Answer

Via the Panorama Syslog export settings to the SIEM

Answer

Within the Cortex XDR agent running on the endpoint

Answer

Inside the Active Directory Domain Controller Group Policy Objects

Question 15

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

Accepted Answer

Execution. Execution (TA0002) consists of techniques that result in running adversary-controlled code on a local system, such as leveraging scripting languages and utilities.

Answer

Resource Development

Answer

Exfiltration

Answer

Reconnaissance