Cybersecurity-Practitioner SOC Operations Practice Test 3 — 15 Questions

Question 1

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device > Setup > Management > General Settings. The idle timeout for firewall administrators logging into the Web Interface is configured under Device > Setup > Management > General Settings. Within this pane, the 'Idle Timeout' field (default 60 minutes) controls how long an inactive administrative session can remain open before the firewall forces re-authentication. Setting it to 15 minutes satisfies the requirement to auto-logout unattended consoles.

Answer

Policies > NAT

Answer

Network > Interfaces > Loopback

Answer

Objects > Tags

Question 2

An analyst investigating an APT campaign notes that the threat group modified Windows registry run keys to maintain persistence. In the context of MITRE ATT&CK, under which Tactic should this specific technique be documented?

Accepted Answer

Persistence. Modifying Windows registry run keys to maintain persistence is a technique categorized under the Persistence tactic in MITRE ATT&CK. Persistence tactics cover techniques adversaries use to keep access to systems across restarts, changed credentials, and other interruptions. Registry Run keys (T1547.001) are a classic persistence mechanism.

Answer

Impact

Answer

Execution

Answer

Credential Access

Question 3

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

Accepted Answer

GlobalProtect with Host Information Profile (HIP) checking and SAML authentication. GlobalProtect with HIP checking and SAML authentication provides both user identity (via SAML IdP) and device compliance posture (via HIP profiles) evaluated on every connection, which is the core of Zero Trust Network Access. Security policies can then enforce dynamic, identity- and posture-based rules per session. This combination directly satisfies the requirement for continuous authentication and authorization based on device compliance and user identity.

Answer

Unauthenticated captive portal with static MAC address whitelisting

Answer

Static IP reservation combined with pre-shared key IPsec tunnels

Answer

SNMP trap forwarding combined with local database authentication

Question 4

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?

Accepted Answer

Defense Evasion. Defense Evasion (TA0005) covers techniques adversaries use to avoid detection, and Base64 encoding of scripts is a classic obfuscation method (T1027, Obfuscated Files or Information) that hides malicious content from signature-based scanners. Encoding does not change the script's function — it only masks its appearance. This maps directly to the Defense Evasion tactic.

Answer

Initial Access

Answer

Exfiltration

Answer

Collection

Question 5

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

Accepted Answer

Panorama > Server Profiles > Syslog. In Panorama, external log forwarding destinations such as syslog servers are defined under Panorama > Server Profiles > Syslog. This profile specifies the syslog server IP, port, transport (UDP/TCP/SSL), and format, and is then referenced in a Log Forwarding profile applied to security policies. Configuring it here enables encrypted TLS syslog forwarding to an external SIEM.

Answer

Objects > Security Profiles > Antivirus

Answer

Device > High Availability

Answer

Network > GlobalProtect > Gateways

Question 6

An incident responder analyzing an APT intrusion discovers that the attacker compressed and encrypted sensitive files locally on a compromised server before staging them for exfiltration. Under the MITRE ATT&CK framework, which Tactic describes this staging behavior?

Accepted Answer

Collection. Under MITRE ATT&CK, Collection (TA0009) is the tactic where adversaries gather data of interest and stage it in a central location before exfiltration. Compressing and encrypting files locally on a compromised host is the classic 'Data Staged' (T1074) technique, which sits inside Collection. The staging step is preparatory — the actual transfer off-network is Exfiltration.

Answer

Exfiltration

Answer

Persistence

Answer

Execution

Question 7

An enterprise is implementing a Zero Trust Architecture across its cloud and on-premises environments using Palo Alto Networks Prisma Access and Next-Generation Firewalls. Which THREE of the following principles are core tenets of a Zero Trust Architecture? (Choose three)

Accepted Answer

Assume breach and verify explicitly at every access request. Option B is correct because Zero Trust's foundational tenet is 'never trust, always verify' — every access request must be authenticated and authorized explicitly based on identity, device, and context, regardless of network location, which is exactly what Prisma Access enforces via its identity-based policies. Option C is correct because continuous monitoring through telemetry and analytics (e.g., Prisma Access ADEM, Cortex Data Lake, and NGFW logging) is required to validate device posture and user behavior on an ongoing basis rather than at a single point in time. Option E is correct because least privilege with just-in-time and just-enough access is a core Zero Trust principle, implemented in Prisma Access through dynamic, granular security policies and time-bound access rather than standing entitlements. Option A is incorrect because relying on perimeter firewalls for east-west traffic reflects a traditional castle-and-moat model, whereas Zero Trust requires microsegmentation and inspection of lateral traffic regardless of perimeter. Option D is incorrect because implicit trust of internal subnets after perimeter authentication directly contradicts Zero Trust, which mandates explicit verification for every session even from inside the network.

Answer

Rely primarily on perimeter firewalls to secure internal east-west traffic

Answer

Trust internal subnets implicitly once a user authenticates at the corporate perimeter

Question 8

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

Accepted Answer

Administrator role mapping via external LDAP/RADIUS group attributes. PAN-OS supports administrator role mapping, where external LDAP or RADIUS group attributes are mapped to PAN-OS administrator roles. This allows dynamic group membership in LDAP to determine the least-privilege role for each admin, eliminating static local accounts and enforcing Zero Trust least privilege.

Answer

Disabling authentication and relying on physical console keylocks

Answer

Local administrator accounts with never-expiring passwords

Answer

Shared superuser account with multi-person shared keys

Question 9

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

Accepted Answer

Remote Services (e.g., SMB/Windows Admin Shares, RDP). Option A, Remote Services (e.g., SMB/Windows Admin Shares, RDP), is correct because MITRE ATT&CK places it under the Lateral Movement tactic (T1021), covering techniques like using SMB/Windows Admin Shares, RDP, SSH, and VNC to log into and control remote systems across a network. Option D, Exploitation of Remote Services, is also correct because it is explicitly categorized under Lateral Movement (T1210), describing adversaries exploiting vulnerabilities in remote services such as SMB, RDP, or MSRPC to pivot into other hosts. Option B, Phishing via Spearphishing Link, belongs to the Initial Access tactic (T1566.002), not Lateral Movement. Option C, Automated Exfiltration Over C2 Channel, is an Exfiltration technique (T1020/T1041), and Option E, Steal Web Session Cookie, is a Credential Access technique (T1539), so neither fits the Lateral Movement tactic.

Answer

Phishing via Spearphishing Link

Answer

Automated Exfiltration Over C2 Channel

Answer

Steal Web Session Cookie

Question 10

An incident response team is analyzing an Advanced Persistent Threat (APT) group that has successfully infiltrated a corporate network. Which THREE characteristics are typically associated with APT campaigns compared to opportunistic malware? (Choose three)

Accepted Answer

Highly targeted objectives directed at specific intellectual property or geopolitical intelligence. Option A is correct because APT campaigns are defined by highly targeted objectives, focusing on specific intellectual property, strategic data, or geopolitical intelligence rather than broad, opportunistic gain. Option D is correct because APTs prioritize operational stealth and long-term persistence, using techniques like credential theft, scheduled tasks, and covert command-and-control channels to remain undetected for months or years. Option E is correct because APT actors typically deploy custom malware, zero-day exploits, and living-off-the-land binaries (LOLBins) such as PowerShell or WMI to blend into the victim environment and evade signature-based detection. Option B does not belong because indiscriminate mass distribution via automated spam is characteristic of opportunistic malware like ransomware worms, not targeted APTs. Option C does not belong because APTs seek to maintain and expand access, not immediately self-destruct their infrastructure upon payload execution.

Answer

Indiscriminate, mass distribution via automated spam campaigns aiming for immediate widespread ransom

Answer

Immediate self-destruction of the compromised infrastructure upon payload execution

Question 11

An administrator is configuring authentication profiles in PAN-OS to integrate an external identity provider. Which TWO of the following server types can be directly configured as authentication server profiles in a Palo Alto Networks firewall? (Choose two)

Accepted Answer

LDAP. Option A (LDAP) is correct because PAN-OS authentication server profiles natively support LDAP as a server type, allowing the firewall to bind to a directory such as Active Directory or OpenLDAP for user and group lookups used in authentication and User-ID. Option C (RADIUS) is correct because PAN-OS also natively supports RADIUS authentication server profiles, enabling the firewall to send authentication requests to a RADIUS server for user verification and MFA integration. Option B (Syslog Forwarder Service) is incorrect because syslog forwarding is configured under Server Profiles > Syslog for log export, not as an authentication server type. Option D (DHCP Scope Manager) is incorrect because DHCP scopes are managed on a DHCP server, and PAN-OS interfaces can act as DHCP clients or servers but this is not an authentication profile type. Option E (SNMPv3 Trap Receiver) is incorrect because SNMP trap receivers are configured under Server Profiles > SNMP Trap for monitoring, not for authentication.

Answer

Syslog Forwarder Service

Answer

DHCP Scope Manager

Answer

SNMPv3 Trap Receiver

Question 12

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) for all administrator accounts. Option A is correct because enforcing Multi-Factor Authentication (MFA) for all administrator accounts adds a critical second authentication factor beyond passwords, mitigating credential theft, brute-force, and phishing attacks against Panorama's administrative logins. Option E is correct because restricting administrative access to dedicated out-of-band management networks or specific trusted IP addresses limits the attack surface by ensuring only authorized source networks can reach the management interface, blocking lateral movement and unauthorized external access. Options B, C, and D are incorrect: disabling HTTPS redirection would weaken security by allowing cleartext HTTP management sessions instead of forcing TLS-encrypted access; sharing a single superuser account destroys accountability and non-repudiation since actions cannot be attributed to individual analysts; and allowing unauthenticated HTTP management access from any internal IP exposes the management plane to eavesdropping, tampering, and unauthorized configuration changes.

Answer

Disable HTTPS redirection on the management interface

Answer

Share a single superuser account among all shift analysts to streamline shift handovers

Answer

Allow unauthenticated HTTP management access from any internal IP address

Question 13

An organization is building a Zero Trust Architecture and deploying Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation. Which THREE design elements are essential for a successful Zero Trust segmentation deployment? (Choose three)

Accepted Answer

Explicit security policy rules enforcing least privilege between internal security zones. Option A is correct because Zero Trust micro-segmentation requires explicit security policy rules that enforce least-privilege access between internal security zones, replacing implicit trust with deny-by-default, zone-to-zone controls. Option B is correct because integrating User-ID lets the firewall map IP addresses to users and groups, so identity-based policy can be enforced consistently regardless of where a user or device connects. Option D is correct because App-ID granular policies identify applications by their actual traffic characteristics and inspect payloads regardless of port or protocol, which is essential for preventing evasion and enforcing application-level least privilege. Option C is not correct because port-based allow rules are exactly the legacy, trust-based approach Zero Trust segmentation is meant to replace, since applications can tunnel over allowed ports. Option E is not correct because default allow policies across internal zones contradict Zero Trust's deny-by-default and least-privilege principles, even if they simplify operations.

Answer

Reliance on port-based port-allow rules for broad internal network blocks

Answer

Default allow policies across all internal zones to maximize operational efficiency

Question 14

An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)

Accepted Answer

Using a single un-audited shared administrator account for multiple SOC team members. Option B is correct because a single un-audited shared administrator account for multiple SOC team members violates least privilege: it prevents individual accountability and non-repudiation, forces all users to inherit the same (typically broad) privileges, and makes it impossible to scope rights to each person's actual duties. Option D is correct because assigning the built-in superuser role to a Tier-1 helpdesk analyst who only needs to view logs grants far more privilege than required—superuser has full read/write access across the entire Palo Alto Networks environment, whereas a read-only role limited to logs would satisfy the task. Option A does not violate least privilege; restricting admin access profiles to specific Device Groups matching an engineer's region is a proper scoping control. Option C is also compliant, since custom Admin Role Profiles limited to specific read-only tabs enforce least privilege. Option E is not a violation either; SAML authentication with dynamic role attribute mapping from an IdP supports least privilege by automatically assigning appropriately scoped roles based on identity attributes.

Answer

Restricting administrator access profiles to specific Device Groups matching the engineer's assigned region

Answer

Creating custom Admin Role Profiles that restrict users to specific read-only tabs

Answer

Enabling SAML authentication with dynamic role attribute mapping from an IdP

Question 15

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

Accepted Answer

User-ID Agent mapping and Windows Security Event Log polling. Option C is correct because PAN-OS supports the User-ID Agent, which can monitor Windows Security Event Logs (via WMI or the agent's server monitoring) to map users to IP addresses from logon events. Option E is correct because GlobalProtect logs supply user-to-IP mappings when clients connect, and captive portal authentication also generates User-ID mappings for users authenticating through the firewall. Option A is incorrect because ICMP ping sweeps only discover live hosts and cannot associate users with IP addresses. Option B is incorrect because BGP advertisements carry routing prefixes, not user identity mappings. Option D is incorrect because DNS zone transfers provide name resolution data, not User-ID mappings, and the firewall does not use them as a User-ID source.

Answer

ICMP Ping sweeps of internal subnet scopes

Answer

BGP routing table advertisements

Answer

Direct DNS Zone Transfer requests initiated by the firewall data plane