Cybersecurity-Practitioner SOC Operations Practice Test 3 — 15 Questions

Question 1

An administrator is configuring authentication profiles in PAN-OS to integrate an external identity provider. Which TWO of the following server types can be directly configured as authentication server profiles in a Palo Alto Networks firewall? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LDAP. PAN-OS supports multiple external authentication server profiles including LDAP, RADIUS, TACACS+, and SAML.

Answer

Syslog Forwarder Service

Answer

DHCP Scope Manager

Answer

SNMPv3 Trap Receiver

Question 2

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) for all administrator accounts. Best practices for administrative hardening include enforcing MFA and restricting management access to dedicated secure subnets or management interfaces.

Answer

Disable HTTPS redirection on the management interface

Answer

Share a single superuser account among all shift analysts to streamline shift handovers

Answer

Allow unauthenticated HTTP management access from any internal IP address

Question 3

A security operations team is reviewing MITRE ATT&CK Tactic classifications for an incident involving credential theft and subsequent unauthorized actions on a Palo Alto Networks protected network. Which THREE of the following Tactics fall under the 'Post-Compromise' or later stages of the attack lifecycle? (Choose three)

Accepted Answer

Exfiltration. In MITRE ATT&CK, tactics like Exfiltration, Lateral Movement, and Command and Control occur after initial access and execution.

Answer

Initial Access

Answer

Reconnaissance

Question 4

An organization is building a Zero Trust Architecture and deploying Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation. Which THREE design elements are essential for a successful Zero Trust segmentation deployment? (Choose three)

Accepted Answer

Explicit security policy rules enforcing least privilege between internal security zones. Zero Trust segmentation requires App-ID application inspection, User-ID identity awareness, and explicit inter-zone security policies.

Answer

Reliance on port-based port-allow rules for broad internal network blocks

Answer

Default allow policies across all internal zones to maximize operational efficiency

Question 5

An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)

Accepted Answer

Using a single un-audited shared administrator account for multiple SOC team members. Assigning superuser roles to standard analysts and sharing accounts violate the principle of least privilege.

Answer

Restricting administrator access profiles to specific Device Groups matching the engineer's assigned region

Answer

Creating custom Admin Role Profiles that restrict users to specific read-only tabs

Answer

Enabling SAML authentication with dynamic role attribute mapping from an IdP

Question 6

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

Accepted Answer

User-ID Agent mapping and Windows Security Event Log polling. PAN-OS supports User-ID agent mapping, captive portal, Exchange monitoring, Syslog listening, and GlobalProtect as mapping sources.

Answer

ICMP Ping sweeps of internal subnet scopes

Answer

BGP routing table advertisements

Answer

Direct DNS Zone Transfer requests initiated by the firewall data plane

Question 7

A security analyst is examining an advanced malware sample reported by Cortex XDR. The malware utilizes sophisticated evasion techniques. Which THREE of the following MITRE ATT&CK techniques are commonly associated with the Defense Evasion tactic? (Choose three)

Accepted Answer

Obfuscated Files or Information (e.g., encoded scripts or packed binaries). Obfuscated Files or Information, Masquerading, and Indicator Blocking are classic Defense Evasion techniques.

Answer

Remote System Discovery via network ping sweeps

Answer

Data Staged for Exfiltration

Question 8

A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?

Accepted Answer

Least-privilege principles. Least-privilege principles dictate that users and accounts are granted only the minimum necessary access required to complete their designated tasks.

Answer

Role-Based Access Control expansion

Answer

Zero Trust Architecture

Answer

Federated Identity Management

Question 9

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

Accepted Answer

Zero Trust Architecture. Zero Trust Architecture assumes breach and verifies each request explicitly, regardless of whether it originates inside or outside the traditional network perimeter.

Answer

Secure Access Service Edge (SASE) core routing

Answer

Defense-in-Depth

Answer

Network Access Control (NAC)

Question 10

During an incident investigation in Cortex XDR, an analyst identifies that an attacker utilized Windows Management Instrumentation (WMI) to execute commands remotely across multiple endpoints. According to the MITRE ATT&CK framework, under which tactic should this activity be categorized?

Accepted Answer

Execution. Windows Management Instrumentation is a legitimate administrative feature that adversaries abuse to execute code and move laterally, placing it under Execution or Lateral Movement depending on context, but specifically Execution when used to run scripts locally/remotely.

Answer

Discovery

Answer

Command and Control

Answer

Credential Access

Question 11

An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?

Accepted Answer

Authentication. Authentication is the process of verifying who a user is (e.g., via credentials in Okta), whereas authorization determines what they can access.

Answer

Authorization

Answer

Auditing

Answer

Accounting

Question 12

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

Accepted Answer

Custom command and control infrastructure and objectives focused on espionage. APTs are distinguished by their stealthy, long-term presence, customization to evade detection, and focus on espionage rather than rapid financial extortion.

Answer

Rapid data encryption and extortion demands

Answer

Low dwell time and heavy reliance on automated scanners

Answer

Exclusive use of built-in Living off the Land binaries

Question 13

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. Using valid accounts for persistence falls under the Persistence tactic, and modifying group memberships to gain higher access falls under Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 14

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Zero Trust identity strategies mandate continuous, risk-based adaptive verification and the strict enforcement of least-privilege access rather than relying on perimeter location or static trust.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 15

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

Accepted Answer

Brute Force. Credential Access techniques are used by adversaries to steal credentials such as account names and passwords, including OS Credential Dumping and Brute Force attacks.

Answer

Masquerading

Answer

Data Exfiltration Over C2 Channel

Answer

Automated Exfiltration