Cybersecurity-Practitioner SOC Operations — Timed 10 Questions

Question 1

An organization adopts a Zero Trust Architecture and decides to use Palo Alto Networks User-ID to enforce least-privilege application access policies. However, direct polling of domain controllers is restricted due to security hardening. Which alternative User-ID method allows the firewall to gather user mapping information securely without direct domain controller polling?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configuring explicit Syslog parsing on the firewall to ingest login events sent from a SIEM. The User-ID XML API allows external security systems, identity brokers, or login scripts to push user-to-IP mappings securely to the firewall without direct DC polling.

Answer

Disabling User-ID and relying solely on source IP address subnets in security rules

Answer

Enabling SNMP v1 read-only polling of user session tables

Answer

Enforcing GlobalProtect captive portal without authentication cookies

Question 2

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping is classified under the Credential Access tactic (TA0006) as attackers attempt to acquire account names and passwords.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 3

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by their persistence, targeted focus, use of legitimate system tools (living off the land), and deliberate, stealthy manual intervention over automated destruction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals

Question 4

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. Azure AD / Entra ID conditional access policies evaluate device compliance and identity claims during the SAML authentication token issuance phase before GlobalProtect grants network access.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 5

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. Assigning a customized Role Profile with read-only permissions ensures the user has only the access required to perform their job and nothing more.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.

Question 6

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

Accepted Answer

Never trust, always verify through continuous context. Zero Trust mandates that access be granted based on continuous verification of context, identity, and posture, completely eliminating implicit trust zones.

Answer

Perimeter-based defense centralization

Answer

Implicit trust verification via subnet placement

Answer

Static role-based implicit authorization

Question 7

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

Accepted Answer

The external MFA server or Identity Provider integrated via RADIUS or SAML. The external multi-factor authentication server (such as RADIUS or SAML IdP) validates the secondary authentication token.

Answer

The Palo Alto Networks Next-Generation Firewall data plane

Answer

The Cortex XSOAR incident playbook engine

Answer

The local administrator database on Panorama

Question 8

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

Accepted Answer

Command and Control. Command and Control (TA0011) consists of techniques that adversaries use to communicate with systems under their control within a victim network.

Answer

Execution

Answer

Lateral Movement

Answer

Initial Access

Question 9

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

Accepted Answer

Privilege Escalation. Privilege Escalation (TA0004) consists of techniques that adversaries use to gain higher-level permissions on a system or network, such as modifying roles or permissions.

Answer

Initial Access

Answer

Exfiltration

Answer

Credential Access

Question 10

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

Accepted Answer

Persistence. Persistence (TA0003) consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions.

Answer

Impact

Answer

Collection

Answer

Reconnaissance