A security analyst is provisioning a new User-ID agent to map IP addresses to usernames in a Windows Active Directory domain. To adhere to least-privilege principles, what level of access should be granted to the service account used by the User-ID agent?
A SOC manager wants to restrict administrator access so that network engineers can modify firewall security policies, but cannot modify system-level settings or firewall high-availability (HA) parameters. Where should the manager configure this restriction in Panorama?
An organization is deploying Zero Trust Network Access (ZTNA) via Prisma Access. The SOC notices that a user device with compromised posture (missing host integrity check) is successfully authenticated by the SAML IdP but is denied network access. Where is this runtime access enforcement happening?
An organization adopts a Zero Trust Architecture and decides to use Palo Alto Networks User-ID to enforce least-privilege application access policies. However, direct polling of domain controllers is restricted due to security hardening. Which alternative User-ID method allows the firewall to gather user mapping information securely without direct domain controller polling?
A security analyst needs to review authentication attempts made by administrators logging into a Palo Alto Networks firewall. Which log type in the Web Interface contains these administrative login records?
An organization implementing a Zero Trust Architecture wants to ensure that administrators accessing Panorama use hardware-backed cryptographic tokens (such as FIDO2 / WebAuthn keys) rather than software-based OTPs. Which authentication method integration should the administrator configure in Panorama?
A security operations team is reviewing MITRE ATT&CK Tactic classifications for an incident involving credential theft and subsequent unauthorized actions on a Palo Alto Networks protected network. Which THREE of the following Tactics fall under the 'Post-Compromise' or later stages of the attack lifecycle? (Choose three)
A SOC analyst is investigating a compromised Linux web server. The attacker uploaded a PHP web shell that executes a reverse shell to an external IP. The analyst wants to quickly identify all processes spawned by the web server process on the host using Cortex XDR. Which query should the analyst run in the Cortex XDR Query Builder?
A SOC analyst is investigating a Cortex XDR incident where an attacker used a living-off-the-land binary (LOLBin) to download and execute a malicious payload. The analyst observes that 'certutil.exe' was used with the '-urlcache' and '-split' parameters to download a file from a remote server. Which MITRE ATT&CK technique does this activity map to?
A SOC analyst is configuring Cortex XDR to collect and analyze endpoint telemetry for threat hunting. The analyst wants to ensure that process creation events include command-line arguments and user context. Which two data sources or configurations should the analyst verify? (Choose two.)
A SOC analyst is configuring a Cortex XDR alert exclusion to reduce false positives from a specific legitimate administrative tool that is frequently used in the environment. The analyst wants to ensure the exclusion is as targeted as possible. Which two criteria should the analyst use to narrowly scope the exclusion? (Choose two.)
A SOC analyst is correlating events in Cortex XDR to identify a potential data exfiltration attempt. The analyst observes a series of network connections from an internal server to an external IP address over port 443. To determine if this is malicious, the analyst needs to gather additional context. Which two data sources should the analyst prioritize to enrich the investigation? (Choose two.)
A SOC analyst is investigating a Cortex XDR incident where an attacker used PowerShell to download and execute a malicious script. The analyst wants to create a BIOC rule to detect similar future activity. Which TWO of the following fields should be used to detect the suspicious PowerShell download and execution behavior? (Choose two.)
A SOC analyst is configuring a Cortex XDR alert rule to detect suspicious PowerShell activity. The analyst wants to include conditions that are indicative of malicious PowerShell usage. Which two of the following conditions should be included? (Choose two.)
A SOC analyst receives a Cortex XDR alert indicating that a user's workstation attempted to resolve a domain associated with a known malware command-and-control (C2) server. The DNS query was allowed, but no connection was established. Which immediate action should the analyst take to contain the potential threat?
A SOC analyst is investigating a Cortex XDR incident where an attacker used a PowerShell script to download and execute a malicious DLL. The analyst notices that the DLL was loaded into a legitimate process, and the process made outbound connections to a remote server. Which of the following techniques is the attacker most likely using?
A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?
A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?
An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?
An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?
An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?
An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?
A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?
A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?
During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?
An organization is deploying an explicit Zero Trust micro-segmentation strategy using Palo Alto Networks Next-Generation Firewalls. They want to ensure that if a workstation is compromised in the engineering VLAN, lateral movement to the financial VLAN is blocked, even if both belong to internal corporate subnets. Which firewall feature must be configured to achieve this?
An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?
An administrator wants to configure authentication for firewall administrators using RADIUS. Where in the Panorama Web Interface should the administrator configure the RADIUS server profile?
During a threat hunting exercise on a Palo Alto Networks firewall, an analyst identifies an adversary scanning internal subnets to map out open ports and active hosts prior to launching an exploit. According to MITRE ATT&CK, which Tactic describes this phase?
An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?
An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?
An analyst investigating an APT campaign notes that the threat group modified Windows registry run keys to maintain persistence. In the context of MITRE ATT&CK, under which Tactic should this specific technique be documented?
A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?
An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?
A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?
An incident responder analyzing an APT intrusion discovers that the attacker compressed and encrypted sensitive files locally on a compromised server before staging them for exfiltration. Under the MITRE ATT&CK framework, which Tactic describes this staging behavior?
An enterprise is implementing a Zero Trust Architecture across its cloud and on-premises environments using Palo Alto Networks Prisma Access and Next-Generation Firewalls. Which THREE of the following principles are core tenets of a Zero Trust Architecture? (Choose three)
An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?
A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)
An incident response team is analyzing an Advanced Persistent Threat (APT) group that has successfully infiltrated a corporate network. Which THREE characteristics are typically associated with APT campaigns compared to opportunistic malware? (Choose three)
An administrator is configuring authentication profiles in PAN-OS to integrate an external identity provider. Which TWO of the following server types can be directly configured as authentication server profiles in a Palo Alto Networks firewall? (Choose two)
A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)
An organization is building a Zero Trust Architecture and deploying Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation. Which THREE design elements are essential for a successful Zero Trust segmentation deployment? (Choose three)
An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)
An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)
A security analyst is examining an advanced malware sample reported by Cortex XDR. The malware utilizes sophisticated evasion techniques. Which THREE of the following MITRE ATT&CK techniques are commonly associated with the Defense Evasion tactic? (Choose three)
A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?
An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?
During an incident investigation in Cortex XDR, an analyst identifies that an attacker utilized Windows Management Instrumentation (WMI) to execute commands remotely across multiple endpoints. According to the MITRE ATT&CK framework, under which tactic should this activity be categorized?
An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?
A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?
While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?
An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)
When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)
A security architect is designing a Zero Trust network segmentation model using Palo Alto Networks Next-Generation Firewalls. To prevent lateral movement of malware across internal VLANs, which operational rule must be strictly enforced?
A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)
A SOC analyst at a company using Cortex XDR notices that several endpoints triggered a behavioral threat alert indicating a process injected code into a remote process and then created a network connection to an unfamiliar external IP. The analyst wants to quickly determine whether this activity is related to a known adversary technique and gather context about the process lineage. Which Cortex XDR feature should the analyst use to view the causal chain and map the activity to MITRE ATT&CK techniques?
A SOC team is using Cortex XDR to investigate a series of alerts indicating suspicious PowerShell execution on multiple endpoints. The analyst wants to create a custom detection rule that triggers when PowerShell is launched with the -EncodedCommand parameter and the parent process is not a known administrative tool. The analyst also wants to exclude a specific service account that legitimately uses encoded commands for automation. Which approach should the analyst take in Cortex XDR to meet these requirements?
A SOC analyst is investigating a Cortex XDR alert indicating that a process attempted to write to a suspicious registry key on a Windows endpoint. The analyst wants to determine if the process is malicious by examining its behavior. Which Cortex XDR capability provides the most comprehensive view of process activity, including command-line arguments and parent-child relationships?
A SOC analyst is triaging a Cortex XDR incident where a suspicious process spawned from a Microsoft Word document. The process tree shows WINWORD.EXE launching powershell.exe with an encoded command. The analyst wants to quickly determine the parent-child relationship and command-line arguments across all endpoints in the incident. Which Cortex XDR feature should the analyst use?
A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?
A SOC analyst at a financial institution receives a high-severity alert from Cortex XDR indicating that a user's workstation executed a PowerShell script that downloaded and ran a file from a known malicious IP. The analyst wants to immediately contain the endpoint to prevent lateral movement, but must preserve forensic evidence. Which action should the analyst take first?
A SOC manager is reviewing alert triage metrics and notices a high number of false positives from a Cortex XDR BIOC rule. The manager wants to reduce noise without disabling the rule entirely. Which action should the SOC manager take?
A SOC analyst is triaging alerts in Cortex XDR and notices a high volume of false positives from a custom detection rule that triggers on legitimate administrative activity. The analyst wants to reduce noise without disabling the rule entirely. Which action should the analyst take?
A SOC analyst is reviewing a Palo Alto Networks firewall traffic log and notices a large number of outbound connections to various IP addresses on port 53. The connections are using UDP and the payload appears to contain encoded data. Which type of malicious activity is most likely occurring?
A SOC analyst is reviewing a Cortex XDR incident involving a suspicious executable that was flagged as malware. The analyst wants to determine the initial infection vector and whether the malware has spread to other endpoints. Which Cortex XDR feature should the analyst use to visualize the process execution chain and related network activity?
A SOC analyst is investigating a Cortex XDR incident where an attacker used a signed binary to proxy execution of malicious code. The analyst observes that the binary is a legitimate Windows utility often abused for defense evasion. Which MITRE ATT&CK technique is most likely associated with this behavior?
A SOC analyst is triaging a Cortex XDR alert for a Windows endpoint that shows a process named 'svchost.exe' making an outbound HTTPS connection to a known malicious IP address. The process path is C:\Users\Public\svchost.exe, and its parent process is 'explorer.exe'. Which of the following best describes the appropriate next step for the analyst?
A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script that downloads a file from a remote server. The analyst wants to determine if the file was executed and, if so, what child processes it spawned. Which Cortex XDR data source should the analyst query?
A SOC team is using Cortex XDR to investigate a security incident. The analyst notices that a critical alert was automatically resolved without any analyst action. The team wants to ensure that all high-severity alerts are reviewed by a human before closure. Which Cortex XDR configuration should the analyst modify to enforce this requirement?
A SOC analyst is investigating a Cortex XDR incident involving a Linux server. The analyst observes that a process named 'kworker' is making outbound DNS queries to a domain that is not in the approved list. The process is running from /tmp/kworker, and its parent process is 'bash'. Which of the following is the most likely explanation?
A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?
A SOC team is using Cortex XDR to monitor for credential dumping attempts. They want to create a BIOC (Behavioral Indicator of Compromise) rule that detects when a process attempts to access the memory of lsass.exe. Which field combination should they use in the BIOC rule to specifically detect this behavior?
A SOC analyst is reviewing a Cortex XDR alert for a Windows endpoint. The alert indicates that a process has created a scheduled task to run a PowerShell script that downloads a file from a remote server. The analyst wants to gather additional evidence to determine the scope of the compromise. Which TWO of the following actions should the analyst take? (Choose two.)
A SOC analyst is triaging a Cortex XDR alert where a process on a Windows endpoint executed 'vssadmin.exe delete shadows /all /quiet'. The parent process is 'cmd.exe', which was spawned by a Microsoft Word macro. Which Cortex XDR artifact should the analyst pivot to first to determine if this is part of a broader ransomware attack?
A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script execution on a critical server. The analyst wants to determine the script's origin and whether it was executed interactively or via a scheduled task. Which Cortex XDR feature provides the most direct evidence for this determination?
A SOC analyst receives a Cortex XDR alert indicating that a process attempted to write to a protected system directory. The analyst wants to quickly gather all related events, including file modifications, registry changes, and network connections, to understand the full scope. Which Cortex XDR feature should the analyst use?
A SOC analyst receives an alert from Cortex XDR indicating that a user's endpoint has communicated with a known command-and-control (C2) server. The analyst verifies the alert and confirms the communication. According to the incident response process, which step should the analyst take first?
A SOC analyst is investigating a Cortex XDR alert where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects credential theft but finds no evidence of malware on the user's endpoint. Which Cortex XDR capability should the analyst use to identify the source of the credential compromise?
A SOC analyst receives a Cortex XDR alert indicating that a process attempted to modify the registry key 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run' on a critical server. The analyst wants to quickly determine which process made the modification and its command line. Which Cortex XDR artifact should the analyst examine first?
A SOC analyst is reviewing a Cortex XDR incident involving a compromised endpoint. The analyst observes that the attacker used 'wmic.exe' to create a process on a remote system. Which of the following is the most appropriate immediate containment action?
During a Cortex XDR investigation, a SOC analyst notices that a process named 'svchost.exe' is making outbound connections to an IP address in a foreign country. The process path is 'C:\Windows\System32\svchost.exe', but the digital signature is invalid. Which Cortex XDR capability should the analyst use to determine if this is a masquerading attempt?
A SOC analyst is reviewing a Cortex XDR incident that includes multiple alerts across several endpoints. The analyst wants to identify the common root cause and prioritize remediation. Which Cortex XDR feature should the analyst use to visualize the relationships between alerts and affected hosts?
A SOC analyst is triaging a Cortex XDR alert showing a process named 'powershell.exe' that was launched by 'winword.exe' on a finance workstation. The command line includes '-EncodedCommand' with a long Base64 string. The analyst wants to quickly determine if this represents malicious activity or a legitimate macro. Which action should the analyst take first?