Cybersecurity-Practitioner SOC Operations Practice Test 2 — 15 Questions

Question 1

An administrator wants to configure authentication for firewall administrators using RADIUS. Where in the Panorama Web Interface should the administrator configure the RADIUS server profile?

Accepted Answer

Device > Server Profiles > RADIUS. Server profiles such as RADIUS, TACACS+, LDAP, and SAML are configured under Device > Server Profiles (or Panorama > Server Profiles) in Palo Alto Networks products.

Answer

Objects > Addresses

Answer

Policies > Security

Answer

Network > GlobalProtect > Portals

Question 2

During a threat hunting exercise on a Palo Alto Networks firewall, an analyst identifies an adversary scanning internal subnets to map out open ports and active hosts prior to launching an exploit. According to MITRE ATT&CK, which Tactic describes this phase?

Accepted Answer

Discovery. Discovery (TA0007) consists of techniques an adversary may use to gain knowledge about the internal network, system settings, and connected infrastructure.

Answer

Lateral Movement

Answer

Defense Evasion

Answer

Initial Access

Question 3

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

Accepted Answer

Execute an automated Cortex XSOAR playbook task invoking the PAN-OS XML API to terminate the active user session. API-based session revocation or User-ID user logout commands can be invoked via Cortex XSOAR to immediately clear sessions on Prisma Access/firewalls.

Answer

Clear the Dynamic Address Group tags manually via a Syslog alert

Answer

Wait for the active DHCP lease to expire on the core switch

Answer

Restart the management server daemon on Panorama

Question 4

A security analyst needs to review authentication attempts made by administrators logging into a Palo Alto Networks firewall. Which log type in the Web Interface contains these administrative login records?

Accepted Answer

System Log. The System log records administrative logins, configuration changes, system events, and daemon statuses on Palo Alto Networks firewalls.

Answer

Traffic Log

Answer

Threat Log

Answer

GlobalProtect Log

Question 5

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

Accepted Answer

Device > Setup > Management > General Settings. Management idle timeout settings are configured under Device > Setup > Management in the General Settings section.

Answer

Policies > NAT

Answer

Network > Interfaces > Loopback

Answer

Objects > Tags

Question 6

An analyst investigating an APT campaign notes that the threat group modified Windows registry run keys to maintain persistence. In the context of MITRE ATT&CK, under which Tactic should this specific technique be documented?

Accepted Answer

Persistence. Persistence (TA0003) includes modifying registry run keys and startup folders to ensure code execution upon system reboot.

Answer

Impact

Answer

Execution

Answer

Credential Access

Question 7

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

Accepted Answer

GlobalProtect with Host Information Profile (HIP) checking and SAML authentication. Combining GlobalProtect with HIP (Host Information Profile) checks and SAML authentication enforces continuous dynamic evaluation of user identity and device health.

Answer

Unauthenticated captive portal with static MAC address whitelisting

Answer

Static IP reservation combined with pre-shared key IPsec tunnels

Answer

SNMP trap forwarding combined with local database authentication

Question 8

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?

Accepted Answer

Defense Evasion. Defense Evasion (TA0005) consists of techniques that adversaries use to avoid detection throughout their compromise, such as obfuscating or encoding data and scripts.

Answer

Initial Access

Answer

Exfiltration

Answer

Collection

Question 9

An organization implementing a Zero Trust Architecture wants to ensure that administrators accessing Panorama use hardware-backed cryptographic tokens (such as FIDO2 / WebAuthn keys) rather than software-based OTPs. Which authentication method integration should the administrator configure in Panorama?

Accepted Answer

SAML 2.0 authentication profile pointing to an IdP supporting FIDO2 / WebAuthn. SAML authentication allows integration with enterprise IdPs (like Azure AD or Okta) that support modern FIDO2 and hardware-backed MFA tokens.

Answer

TACACS+ single-connection mode with static PINs

Answer

Local database with plaintext password hashing

Answer

RADIUS PAP protocol without secondary token prompts

Question 10

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. Log forwarding profiles and external syslog server destinations are configured under Panorama > Server Profiles > Syslog.

Answer

Objects > Security Profiles > Antivirus

Answer

Device > High Availability

Answer

Network > GlobalProtect > Gateways

Question 11

An incident responder analyzing an APT intrusion discovers that the attacker compressed and encrypted sensitive files locally on a compromised server before staging them for exfiltration. Under the MITRE ATT&CK framework, which Tactic describes this staging behavior?

Accepted Answer

Collection. Collection (TA0009) consists of techniques adversaries use to gather and stage data, such as archiving and encrypting files prior to exfiltration.

Answer

Exfiltration

Answer

Persistence

Answer

Execution

Question 12

An enterprise is implementing a Zero Trust Architecture across its cloud and on-premises environments using Palo Alto Networks Prisma Access and Next-Generation Firewalls. Which THREE of the following principles are core tenets of a Zero Trust Architecture? (Choose three)

Accepted Answer

Assume breach and verify explicitly at every access request. Zero Trust tenets include continuous verification, least privilege access, assuming breach, and treating all networks as untrusted.

Answer

Rely primarily on perimeter firewalls to secure internal east-west traffic

Answer

Trust internal subnets implicitly once a user authenticates at the corporate perimeter

Question 13

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

Accepted Answer

Administrator role mapping via external LDAP/RADIUS group attributes. Admin role mapping via LDAP/RADIUS allows administrators to inherit their role profile dynamically based on their directory group memberships.

Answer

Disabling authentication and relying on physical console keylocks

Answer

Local administrator accounts with never-expiring passwords

Answer

Shared superuser account with multi-person shared keys

Question 14

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

Accepted Answer

Remote Services (e.g., SMB/Windows Admin Shares, RDP). Remote Services (T1021) and Exploitation of Remote Services (T1210) are classic techniques used by adversaries to move laterally through an environment.

Answer

Phishing via Spearphishing Link

Answer

Automated Exfiltration Over C2 Channel

Answer

Steal Web Session Cookie

Question 15

An incident response team is analyzing an Advanced Persistent Threat (APT) group that has successfully infiltrated a corporate network. Which THREE characteristics are typically associated with APT campaigns compared to opportunistic malware? (Choose three)

Accepted Answer

Highly targeted objectives directed at specific intellectual property or geopolitical intelligence. APT campaigns are distinguished by targeted motives, stealthy persistence, custom tooling, and multi-stage manual objectives.

Answer

Indiscriminate, mass distribution via automated spam campaigns aiming for immediate widespread ransom

Answer

Immediate self-destruction of the compromised infrastructure upon payload execution