Cybersecurity-Practitioner SOC Operations Practice Test 2 — 15 Questions

Question 1

A SOC analyst is investigating a Cortex XDR incident where an attacker used a PowerShell script to download and execute a malicious DLL. The analyst notices that the DLL was loaded into a legitimate process, and the process made outbound connections to a remote server. Which of the following techniques is the attacker most likely using?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DLL injection. The correct answer is DLL injection. The attacker loaded a malicious DLL into a legitimate process, which then made outbound connections. This technique allows the attacker to hide malicious activity within a trusted process, making detection harder.

Answer

Process hollowing

Answer

Reflective DLL injection

Answer

Process Doppelgänging

Question 2

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping (e.g., via Mimikatz, ProcDump, or comsvcs.dll) is cataloged under the Credential Access tactic in MITRE ATT&CK (technique T1003.001, OS Credential Dumping: LSASS Memory). The tactic's definition is explicitly about stealing credentials such as account names and passwords to gain, escalate, or maintain access. Because the attacker's immediate objective is harvesting credential material from memory, Credential Access is the correct tactic.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 3

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by long-term, human-driven operations with a specific mission: they maintain persistence, use custom or tailored tooling, and exfiltrate data slowly to avoid detection. The combination of custom C2, low-and-slow exfiltration, and living-off-the-land binaries reflects a methodical, targeted adversary rather than automated commodity malware. This matches the defining traits of an APT: persistence, targeting, and human direction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals

Question 4

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. In a SAML integration between Microsoft Entra ID and GlobalProtect, conditional access policies that evaluate device compliance (managed vs. unmanaged) are enforced by the identity provider (Microsoft Entra ID) during authentication and token issuance. Microsoft Entra ID evaluates the device state via Intune or hybrid Microsoft Entra ID join and either issues or denies the SAML assertion; the GlobalProtect gateway simply consumes the assertion and grants access based on the attributes returned.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 5

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. The principle of least privilege requires granting only the minimum access needed to perform a role. Creating a custom Admin Role Profile with read-only permissions for configuration and logs, then assigning it to the junior analyst, enforces this precisely. This restricts the user to viewing without any ability to modify firewall settings or policies.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.

Question 6

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

Accepted Answer

Never trust, always verify through continuous context. Zero Trust's foundational principle is 'never trust, always verify' — every access request must be authenticated and authorized based on identity, device posture, and context, regardless of network location. The scenario explicitly describes granting access based on explicit verification of user identity, device health, and application context rather than subnet placement, which is the textbook definition of this principle.

Answer

Perimeter-based defense centralization

Answer

Implicit trust verification via subnet placement

Answer

Static role-based implicit authorization

Question 7

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

Accepted Answer

The external MFA server or Identity Provider integrated via RADIUS or SAML. The secondary MFA token (such as a push notification) is validated by the external MFA server or Identity Provider integrated via RADIUS or SAML. Prisma Access delegates the MFA challenge and validation to the configured authentication service, not to the firewall data plane or Panorama local database.

Answer

The Palo Alto Networks Next-Generation Firewall data plane

Answer

The Cortex XSOAR incident playbook engine

Answer

The local administrator database on Panorama

Question 8

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

Accepted Answer

Command and Control. Command and Control (TA0011) in MITRE ATT&CK covers techniques adversaries use to communicate with compromised systems, including encrypted tunnels and application-layer protocols used to relay commands. An outbound encrypted tunnel to an unknown external IP is the textbook signature of C2. The other tactics describe earlier or different phases of the attack lifecycle.

Answer

Execution

Answer

Lateral Movement

Answer

Initial Access

Question 9

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

Accepted Answer

Privilege Escalation. Privilege Escalation is the MITRE ATT&CK tactic that describes an adversary's actions to gain higher-level permissions or access within a system or network. Unauthorized modification of user permissions to establish higher-level access is a classic example of privilege escalation, as the attacker is elevating their privileges beyond what was originally granted.

Answer

Initial Access

Answer

Exfiltration

Answer

Credential Access

Question 10

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Accepted Answer

Persistence. Scheduled tasks and Windows Management Instrumentation (WMI) are both mechanisms that allow adversaries to maintain a foothold on a system across reboots. In MITRE ATT&CK, the Persistence tactic (TA0003) encompasses techniques like Scheduled Task/Job (T1053) and Windows Management Instrumentation Event Subscription (T1546.003), which are used to ensure continued access. These techniques are not about immediate damage, data gathering, or initial discovery, but about keeping access over time.

Answer

Impact

Answer

Collection

Answer

Reconnaissance

Question 11

An organization is deploying an explicit Zero Trust micro-segmentation strategy using Palo Alto Networks Next-Generation Firewalls. They want to ensure that if a workstation is compromised in the engineering VLAN, lateral movement to the financial VLAN is blocked, even if both belong to internal corporate subnets. Which firewall feature must be configured to achieve this?

Accepted Answer

Inter-zone Security Policy rules inspecting traffic between the engineering and finance zones. Palo Alto Networks NGFWs enforce segmentation through zone-based security policies. By placing the engineering and finance VLANs in separate security zones and writing explicit inter-zone Security Policy rules that deny or tightly restrict traffic between them, the firewall blocks lateral movement even though both are internal subnets. This is the core mechanism of Zero Trust micro-segmentation on the platform.

Answer

GlobalProtect split-tunnel configuration for remote workers

Answer

NAT hairpinning configuration on the outside interface

Answer

Default inter-zone forwarding without explicit security profiles

Question 12

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

Accepted Answer

Execution. Under MITRE ATT&CK, the Execution tactic (TA0002) covers techniques that result in adversary-controlled code running on a local or remote system, including Command and Scripting Interpreter (T1059) for PowerShell and Signed Binary Proxy Execution / System Binary Proxy Execution (T1218) for Certutil. Using living-off-the-land binaries to download and run payloads is a classic Execution-tactic behavior.

Answer

Resource Development

Answer

Exfiltration

Answer

Reconnaissance

Question 13

An administrator wants to configure authentication for firewall administrators using RADIUS. Where in the Panorama Web Interface should the administrator configure the RADIUS server profile?

Accepted Answer

Device > Server Profiles > RADIUS. In Panorama, server profiles for external authentication services such as RADIUS, LDAP, TACACS+, Kerberos, and SAML are configured under Device > Server Profiles. The RADIUS profile is created there and then referenced in authentication settings for firewall administrators or GlobalProtect.

Answer

Objects > Addresses

Answer

Policies > Security

Answer

Network > GlobalProtect > Portals

Question 14

During a threat hunting exercise on a Palo Alto Networks firewall, an analyst identifies an adversary scanning internal subnets to map out open ports and active hosts prior to launching an exploit. According to MITRE ATT&CK, which Tactic describes this phase?

Accepted Answer

Discovery. In MITRE ATT&CK, Discovery (TA0007) covers techniques adversaries use to gain knowledge about the system and internal network, including port scanning, host enumeration, and network mapping. Scanning internal subnets to identify open ports and active hosts before exploitation is the textbook definition of Discovery. This tactic precedes Lateral Movement and Execution, as the adversary gathers intelligence to plan the next phase.

Answer

Lateral Movement

Answer

Defense Evasion

Answer

Initial Access

Question 15

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

Accepted Answer

Execute an automated Cortex XSOAR playbook task invoking the PAN-OS XML API to terminate the active user session. To immediately terminate an active user session across all enforcement points in a Zero Trust architecture, the administrator should execute an automated Cortex XSOAR playbook task that invokes the PAN-OS XML API to terminate the session. This API call instructs the firewall (Prisma Access) to drop the session and invalidate the user's authentication, enforcing the Zero Trust decision in real time. Manual or delayed methods cannot achieve immediate termination.

Answer

Clear the Dynamic Address Group tags manually via a Syslog alert

Answer

Wait for the active DHCP lease to expire on the core switch

Answer

Restart the management server daemon on Panorama