Cybersecurity-Practitioner SOC Operations — Timed 20 Questions

Question 1

A security analyst is provisioning a new User-ID agent to map IP addresses to usernames in a Windows Active Directory domain. To adhere to least-privilege principles, what level of access should be granted to the service account used by the User-ID agent?

20 minute time limit — choose an answer to begin.

Accepted Answer

Read-only access to Active Directory security logs and event viewer access. The User-ID agent requires read-only access to Active Directory security logs and event viewer to map IP addresses to usernames. This adheres to least privilege by granting only the necessary permissions to perform its function, without excessive rights like Domain Admin.

Answer

Local Administrator on all domain controllers

Answer

Domain Administrator privileges

Answer

Schema Administrator privileges

Question 2

A SOC manager wants to restrict administrator access so that network engineers can modify firewall security policies, but cannot modify system-level settings or firewall high-availability (HA) parameters. Where should the manager configure this restriction in Panorama?

Accepted Answer

Panorama > Admin Roles. Panorama > Admin Roles allows the creation of custom roles with granular permissions, enabling restrictions such as allowing firewall policy modification but denying system-level or HA settings. This is the correct place to configure role-based access control.

Answer

Objects > Custom Objects > URL Category

Answer

Network > Interfaces > VLAN

Answer

Device > Setup > Management

Question 3

An organization is deploying Zero Trust Network Access (ZTNA) via Prisma Access. The SOC notices that a user device with compromised posture (missing host integrity check) is successfully authenticated by the SAML IdP but is denied network access. Where is this runtime access enforcement happening?

Accepted Answer

At the Prisma Access cloud service node via GlobalProtect Gateway posture enforcement. In a Prisma Access ZTNA deployment, the GlobalProtect Gateway running in the Prisma Access cloud service node is the enforcement point for security posture checks. Even though the SAML IdP authenticates the user's identity, the gateway evaluates the host posture (e.g., missing host integrity check) and denies network access if the posture fails. This separation of authentication (IdP) and authorization (gateway posture) is a core Zero Trust principle.

Answer

Via the Panorama Syslog export settings to the SIEM

Answer

Within the Cortex XDR agent running on the endpoint

Answer

Inside the Active Directory Domain Controller Group Policy Objects

Question 4

An organization adopts a Zero Trust Architecture and decides to use Palo Alto Networks User-ID to enforce least-privilege application access policies. However, direct polling of domain controllers is restricted due to security hardening. Which alternative User-ID method allows the firewall to gather user mapping information securely without direct domain controller polling?

Accepted Answer

Configuring explicit Syslog parsing on the firewall to ingest login events sent from a SIEM. The User-ID XML API allows external security systems, identity brokers, or login scripts to push user-to-IP mappings securely to the firewall without direct DC polling.

Answer

Disabling User-ID and relying solely on source IP address subnets in security rules

Answer

Enabling SNMP v1 read-only polling of user session tables

Answer

Enforcing GlobalProtect captive portal without authentication cookies

Question 5

A security analyst needs to review authentication attempts made by administrators logging into a Palo Alto Networks firewall. Which log type in the Web Interface contains these administrative login records?

Accepted Answer

System Log. Administrative login attempts on a Palo Alto Networks firewall are recorded in the System log, which captures management-plane events including admin authentication successes and failures, configuration commits, and system-level messages. The System log is accessible under Monitor > Logs > System in the Web Interface.

Answer

Traffic Log

Answer

Threat Log

Answer

GlobalProtect Log

Question 6

An organization implementing a Zero Trust Architecture wants to ensure that administrators accessing Panorama use hardware-backed cryptographic tokens (such as FIDO2 / WebAuthn keys) rather than software-based OTPs. Which authentication method integration should the administrator configure in Panorama?

Accepted Answer

SAML 2.0 authentication profile pointing to an IdP supporting FIDO2 / WebAuthn. SAML 2.0 authentication profiles in PAN-OS allow Panorama to delegate authentication to an external Identity Provider (IdP). When the IdP supports FIDO2/WebAuthn, administrators authenticate with hardware-backed cryptographic tokens, satisfying Zero Trust's requirement for phishing-resistant, possession-based credentials. This is the only option that integrates an external IdP capable of enforcing hardware token authentication.

Answer

TACACS+ single-connection mode with static PINs

Answer

Local database with plaintext password hashing

Answer

RADIUS PAP protocol without secondary token prompts

Question 7

A security operations team is reviewing MITRE ATT&CK Tactic classifications for an incident involving credential theft and subsequent unauthorized actions on a Palo Alto Networks protected network. Which THREE of the following Tactics fall under the 'Post-Compromise' or later stages of the attack lifecycle? (Choose three)

Accepted Answer

Exfiltration. Exfiltration (A) is correct because it represents the adversary stealing data out of the environment, which occurs only after the attacker has already gained a foothold and performed actions on objectives, placing it firmly in the post-compromise phase. Lateral Movement (C) is correct because it describes the attacker pivoting from an initially compromised host to other systems using techniques like pass-the-hash or RDP, which by definition happens after initial access has been achieved. Command and Control (D) is correct because it covers the establishment of communication channels (e.g., C2 over HTTP/HTTPS or DNS) between compromised hosts and attacker infrastructure, a step that presupposes an existing compromise. Initial Access (B) is not correct because it is the entry phase of the attack lifecycle, occurring before any compromise is established. Reconnaissance (E) is not correct because it is the pre-attack information-gathering phase that precedes Initial Access and involves no compromise of the target at all.

Answer

Initial Access

Answer

Reconnaissance

Question 8

A SOC analyst is investigating a compromised Linux web server. The attacker uploaded a PHP web shell that executes a reverse shell to an external IP. The analyst wants to quickly identify all processes spawned by the web server process on the host using Cortex XDR. Which query should the analyst run in the Cortex XDR Query Builder?

Accepted Answer

SELECT * FROM process WHERE causality_actor_process_image_name = 'httpd' OR actor_process_image_name = 'httpd' OR causality_actor_process_image_name IN (SELECT actor_process_image_name FROM process WHERE causality_actor_process_image_name = 'httpd'). The correct query retrieves processes directly spawned by the web server and those spawned by its immediate children. This recursive-like approach is necessary because a web shell often launches a shell interpreter, which then executes the reverse shell. Without including the second-level descendants, the analyst would miss critical evidence of post-exploitation activity.

Answer

SELECT * FROM process WHERE causality_actor_process_image_name = 'httpd'

Answer

SELECT * FROM process WHERE actor_process_image_name = 'httpd'

Answer

SELECT * FROM process WHERE causality_actor_process_image_name = 'httpd' OR actor_process_image_name = 'httpd'

Question 9

A SOC analyst is investigating a Cortex XDR incident where an attacker used a living-off-the-land binary (LOLBin) to download and execute a malicious payload. The analyst observes that 'certutil.exe' was used with the '-urlcache' and '-split' parameters to download a file from a remote server. Which MITRE ATT&CK technique does this activity map to?

Accepted Answer

T1218 - Signed Binary Proxy Execution. The correct mapping is T1218 - Signed Binary Proxy Execution, specifically the sub-technique T1218.003 for certutil. Attackers abuse certutil to download and sometimes execute files, leveraging its trusted status to evade detection. This aligns with the observed command-line parameters and the use of a LOLBin for malicious purposes.

Answer

T1059 - Command and Scripting Interpreter

Answer

T1105 - Ingress Tool Transfer

Answer

T1567 - Exfiltration Over Web Service

Question 10

A SOC analyst is configuring Cortex XDR to collect and analyze endpoint telemetry for threat hunting. The analyst wants to ensure that process creation events include command-line arguments and user context. Which two data sources or configurations should the analyst verify? (Choose two.)

Accepted Answer

Enable Process Execution History in the endpoint protection policy.. To ensure process creation events include command-line arguments and user context, the analyst must enable Process Execution History in the endpoint protection policy and ensure the Enhanced Process Telemetry module is active. These two configurations directly enrich process telemetry with the necessary details for threat hunting.

Answer

Set up network connection logging for all endpoints.

Answer

Configure the Cortex XDR agent to log all file system modifications.

Answer

Enable registry monitoring for critical system hives.

Question 11

A SOC analyst is configuring a Cortex XDR alert exclusion to reduce false positives from a specific legitimate administrative tool that is frequently used in the environment. The analyst wants to ensure the exclusion is as targeted as possible. Which two criteria should the analyst use to narrowly scope the exclusion? (Choose two.)

Accepted Answer

User account and endpoint group. Combining process name with command-line arguments and scoping to specific user accounts and endpoint groups creates a highly targeted exclusion. This ensures the legitimate tool is excluded only under expected conditions, reducing false positives without opening gaps for attackers to exploit the same process name or other users.

Answer

Alert severity level

Answer

File hash of the administrative tool

Answer

Time of day when the tool runs

Question 12

A SOC analyst is correlating events in Cortex XDR to identify a potential data exfiltration attempt. The analyst observes a series of network connections from an internal server to an external IP address over port 443. To determine if this is malicious, the analyst needs to gather additional context. Which two data sources should the analyst prioritize to enrich the investigation? (Choose two.)

Accepted Answer

DNS logs to resolve the external IP to a domain name. The analyst should prioritize DNS logs to resolve the external IP to a domain name and firewall traffic logs to examine the volume and frequency of data transfer. These two sources directly enrich the understanding of the network connections, helping to determine if the traffic is malicious exfiltration or benign activity.

Answer

Threat intelligence feeds to check the reputation of the external IP

Answer

User login logs to check for anomalous authentication events

Answer

Endpoint process execution logs to identify the process initiating the connection

Question 13

A SOC analyst is investigating a Cortex XDR incident where an attacker used PowerShell to download and execute a malicious script. The analyst wants to create a BIOC rule to detect similar future activity. Which TWO of the following fields should be used to detect the suspicious PowerShell download and execution behavior? (Choose two.)

Accepted Answer

action = 'process create' AND actor_process_image_name = 'powershell.exe' AND action_parameters CONTAINS 'DownloadString'. The most reliable indicators of suspicious PowerShell download and execution are process creation events where the command-line parameters contain known download cmdlets like Invoke-WebRequest or DownloadString. These cmdlets are frequently used in malicious scripts to fetch and execute payloads, and their presence in the actor process command line provides strong evidence of malicious intent.

Answer

action = 'file create' AND actor_process_image_name = 'powershell.exe' AND file_name CONTAINS '.ps1'

Answer

action = 'network connect' AND actor_process_image_name = 'powershell.exe' AND remote_ip IS NOT NULL

Answer

action = 'process create' AND actor_process_image_name = 'powershell.exe' AND action_parameters CONTAINS 'Start-BitsTransfer'

Question 14

A SOC analyst is configuring a Cortex XDR alert rule to detect suspicious PowerShell activity. The analyst wants to include conditions that are indicative of malicious PowerShell usage. Which two of the following conditions should be included? (Choose two.)

Accepted Answer

PowerShell process making a network connection to an external IP address.. The correct conditions are the use of the '-EncodedCommand' parameter and PowerShell making external network connections. These are strong indicators of malicious PowerShell activity, as they are commonly used for obfuscation and command-and-control. Including them in an alert rule enhances detection of advanced threats.

Answer

PowerShell process spawned by 'explorer.exe'.

Answer

PowerShell process running with a signed Microsoft certificate.

Answer

PowerShell process with a parent process of 'winword.exe'.

Question 15

A SOC analyst receives a Cortex XDR alert indicating that a user's workstation attempted to resolve a domain associated with a known malware command-and-control (C2) server. The DNS query was allowed, but no connection was established. Which immediate action should the analyst take to contain the potential threat?

Accepted Answer

Isolate the endpoint from the network using Cortex XDR response actions.. Isolating the endpoint is the correct immediate containment action because it stops any potential communication with the C2 server and prevents lateral movement, while allowing further investigation. Blocking the domain or scanning are useful but do not contain the endpoint itself, and forensic imaging should follow containment.

Answer

Block the domain at the firewall and continue monitoring the endpoint.

Answer

Run a full antivirus scan on the endpoint and wait for results.

Answer

Collect a forensic image of the endpoint for further analysis.

Question 16

A SOC analyst is investigating a Cortex XDR incident where an attacker used a PowerShell script to download and execute a malicious DLL. The analyst notices that the DLL was loaded into a legitimate process, and the process made outbound connections to a remote server. Which of the following techniques is the attacker most likely using?

Accepted Answer

DLL injection. The correct answer is DLL injection. The attacker loaded a malicious DLL into a legitimate process, which then made outbound connections. This technique allows the attacker to hide malicious activity within a trusted process, making detection harder.

Answer

Process hollowing

Answer

Reflective DLL injection

Answer

Process Doppelgänging

Question 17

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

Accepted Answer

Credential Access. LSASS memory dumping (e.g., via Mimikatz, ProcDump, or comsvcs.dll) is cataloged under the Credential Access tactic in MITRE ATT&CK (technique T1003.001, OS Credential Dumping: LSASS Memory). The tactic's definition is explicitly about stealing credentials such as account names and passwords to gain, escalate, or maintain access. Because the attacker's immediate objective is harvesting credential material from memory, Credential Access is the correct tactic.

Answer

Defense Evasion

Answer

Collection

Answer

Discovery

Question 18

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

Accepted Answer

Persistent, targeted, and methodical human-driven objective execution with customized tooling. APTs are distinguished by long-term, human-driven operations with a specific mission: they maintain persistence, use custom or tailored tooling, and exfiltrate data slowly to avoid detection. The combination of custom C2, low-and-slow exfiltration, and living-off-the-land binaries reflects a methodical, targeted adversary rather than automated commodity malware. This matches the defining traits of an APT: persistence, targeting, and human direction.

Answer

Rapid, automated encryption of all endpoints for immediate financial ransom

Answer

Mass distribution via untargeted spam campaigns with out-of-the-box exploit kits

Answer

Immediate self-replication across all reachable network segments without persistence goals

Question 19

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

Accepted Answer

On the identity provider (IdP) during the authentication and token issuance phase. In a SAML integration between Microsoft Entra ID and GlobalProtect, conditional access policies that evaluate device compliance (managed vs. unmanaged) are enforced by the identity provider (Microsoft Entra ID) during authentication and token issuance. Microsoft Entra ID evaluates the device state via Intune or hybrid Microsoft Entra ID join and either issues or denies the SAML assertion; the GlobalProtect gateway simply consumes the assertion and grants access based on the attributes returned.

Answer

Locally on the GlobalProtect gateway via local user database groups

Answer

Within the Panorama Log Forwarding profile settings

Answer

Inside the firewall security policy rule base post-authentication

Question 20

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

Accepted Answer

Create an Admin Role Profile with read-only access to configuration and logs, then assign it to the administrator.. The principle of least privilege requires granting only the minimum access needed to perform a role. Creating a custom Admin Role Profile with read-only permissions for configuration and logs, then assigning it to the junior analyst, enforces this precisely. This restricts the user to viewing without any ability to modify firewall settings or policies.

Answer

Assign the built-in superuser administrator role to the user account.

Answer

Grant dynamic device group ownership without specifying an admin role profile.

Answer

Configure password complexity requirements without modifying access profiles.