177 questions total · 3pages · All types, answers revealed
An administrator is configuring Zone Protection Profiles on a Palo Alto Networks firewall. Which THREE types of network-layer attacks can be mitigated using this profile? (Choose three)
SYN flood protection uses SYN cookies or RED to mitigate TCP SYN floods.
An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?
The Prisma Cloud Admission Controller intercepts Kubernetes API requests to validate pods against security policies prior to creation.
Why this answer
Prisma Cloud integrates with Kubernetes admission controllers to intercept requests to the API server and block non-compliant pod deployments before they run.
An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)
Inline ML stops zero-day threats instantly without waiting for sandbox detonation.
Why this answer
APT and zero-day protection relies on WildFire cloud sandbox analysis, DNS Security for malicious domain detection, and inline machine learning.
A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?
Identity Security and CDR analyze control plane audit logs to detect compromised credentials and abnormal API calls.
Why this answer
Prisma Cloud CDR (Cloud Detection and Response) or UEBA capabilities analyze cloud audit logs (like CloudTrail) to detect anomalous and malicious user behavior.
What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?
SIEM centralizes logging and correlation for threat detection.
Why this answer
SIEM systems aggregate, correlate, and analyze log data from multiple sources across the enterprise to detect security incidents and provide audit trails.
An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?
EDLs dynamically import threat indicators from external web sources into firewall policies.
Why this answer
External Dynamic Lists (EDLs) allow the firewall to automatically download IP addresses, URLs, or domains from a web server and use them in Security policies.
A tier-1 SOC analyst receives an alert for a blocked malware execution detected by WildFire on a firewall. What is the standard operational response procedure for this type of high-confidence prevention alert?
Since the threat was blocked, the primary goal is verification and scoping to ensure no lateral movement or prior exposure occurred.
Why this answer
When malware is proactively blocked by WildFire or Anti-Malware, the analyst verifies the prevention status and checks if any other hosts were exposed.
A SOC analyst is reviewing real-time firewall traffic in the Application Command Center (ACC). What is the primary purpose of the ACC in a Palo Alto Networks firewall?
ACC is designed for visual traffic analysis and threat identification.
Why this answer
The ACC provides a graphical summary of application, user, URL, and threat traffic passing through the firewall to help identify usage patterns and anomalies.
A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?
Prisma Cloud integrates securely with multi-account environments using an aggregator role connected to the centralized logging bucket.
Why this answer
For multi-account AWS environments, utilizing an AWS CloudTrail organizational trail deployed via a StackSets template allows Prisma Cloud to ingest logs efficiently through a designated monitoring account.
Which security concept describes the practice of hiding internal network topology and IP address schemes from external entities using Network Address Translation (NAT)?
NAT hides internal network layouts from external observers.
Why this answer
Network Address Translation (NAT) hides internal private IP addresses behind public IP addresses, providing a degree of topology obfuscation.
An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)
This command displays active IP-to-username mappings currently recognized by the firewall.
Why this answer
User-ID mappings can be checked via the CLI using 'show user ip-user-mapping all' or via the firewall's operational commands and User-ID agent status logs.
An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?
Static routes are managed directly inside the configuration of the specific Virtual Router.
Why this answer
Static routes are configured under Network > Virtual Routers, selecting the specific virtual router instance, and then adding a static route entry.
A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?
Authentication profiles handle credential validation for GlobalProtect users.
The Tag field specifies the 802.1Q VLAN ID for the Layer 2 interface.
Why this answer
When configuring a Layer 2 subinterface or interface in PAN-OS, the tag/VLAN ID is defined directly within the interface configuration settings.
An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?
Zone Protection Profiles defend against network-layer DoS attacks like SYN floods.
Why this answer
Zone Protection Profiles contain mechanisms such as SYN cookies to mitigate SYN flood DoS attacks at the zone boundary.
An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)
Serverless scanning identifies embedded secrets in function code.
Why this answer
Prisma Cloud protects serverless functions by scanning function code and packages for vulnerabilities, protecting against injection attacks, and monitoring runtime behavior.
An endpoint running macOS encounters a kernel extension loading blockage when installing the Cortex XDR agent. What action must the administrator take to resolve this?
macOS security controls require explicit authorization for system extensions and network filters.
Why this answer
Modern macOS versions require explicit user or MDM approval for system extensions and kernel extensions used by security software.
An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?
Agentless scanning inspects workloads via snapshots, reducing operational overhead and agent footprint.
Why this answer
Agentless scanning takes EBS snapshots of instances to analyze OS packages, vulnerabilities, and configurations without requiring software installation inside the running operating system.
An administrator wants to configure High Availability (HA) Active/Passive on two firewalls. Which THREE prerequisites must be verified before enabling HA? (Choose three)
Software versions must match between HA peers.
Why this answer
HA Active/Passive requires identical firewall models, matching PAN-OS software versions, and dedicated physical HA ports (HA1/HA2).
An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?
Authentication profiles validate credentials against external servers, and Admin Roles assign privileges.
A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?
Data Sources settings and dashboards display real-time ingestion status and volume per log source.
Why this answer
Cortex XSIAM provides dedicated data source monitoring and health dashboards to track ingestion rates, parsing errors, and collector status.
During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?
Endpoint isolation cuts off network communication except for communication with the Cortex XDR server.
Why this answer
Cortex XDR allows administrators and automated playbooks to isolate endpoints from the network using the 'Isolate Endpoint' action in the Action Center or incident response capabilities.
QoS is applied to egress interfaces to control outbound bandwidth shaping and prioritization.
An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?
URL Filtering profiles control web traffic categories using PAN-DB.
Why this answer
URL Filtering profiles utilize PAN-DB to categorize and control web browsing traffic.
During a routine audit, a SOC supervisor wants to ensure that all administrative logins to Panorama and managed firewalls are centrally tracked and securely archived. Which log type in the PAN-OS logging architecture records administrator login sessions and configuration changes?
Configuration logs track who made what change and when, while System logs track admin login sessions.
Why this answer
PAN-OS records administrative actions, logins, and configuration changes in the Configuration Log and System Log.
A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?
The WildFire portal provides direct hash lookup and comprehensive analysis reports.
Why this answer
The WildFire portal allows security professionals to manually search file hashes to view historical analysis reports and verdicts.
An administrator is analyzing firewall packet flow and session behavior. Which THREE criteria are evaluated by the Palo Alto Networks firewall to uniquely identify and create a session? (Choose three)
Destination IP is a fundamental component of the session 5-tuple.
Why this answer
Palo Alto Networks firewalls create sessions based on session 5-tuple parameters: Source IP, Destination IP, Source Port, Destination Port, and Protocol.
Which TWO protocols are commonly used for device management and administrative access on a Palo Alto Networks firewall management plane? (Choose two)
SSH is used for secure CLI management access.
Which TWO actions can a Security policy rule execute when traffic matches the rule criteria? (Choose two)
Deny blocks the traffic and can return a response or silently drop depending on configuration.
Why this answer
Standard security policy actions in PAN-OS include Allow, Deny, Drop, and Reset (Client/Server).
App-ID continuously inspects payloads and updates identification as more packet context is gathered.
An enterprise firewall is experiencing high session utilization due to a distributed denial-of-service (DDoS) SYN flood attack targeting a public web server. Which feature on the Palo Alto Networks firewall should an administrator configure to protect the server from resource exhaustion?
Correct. DoS Protection profiles and policies defend against volumetric and state exhaustion attacks like SYN floods.
An analyst notices that a specific URL is incorrectly categorized by the Palo Alto Networks URL Filtering database (BrightCloud/PAN-DB). What is the appropriate procedure to request a re-categorization of this URL?
Submitting to the PAN-DB URL review site allows security researchers to re-evaluate and update the category.
Why this answer
Palo Alto Networks provides a public URL categorization review portal where customers can submit incorrect URL classifications for rapid re-evaluation.
An administrator is designing a Zero Trust network architecture on a Palo Alto Networks firewall. Which TWO best practices should be implemented in the Security policy rulebase? (Choose two)
All allowed traffic must be inspected by security profiles under Zero Trust.
Why this answer
Zero Trust mandates explicit App-ID instead of port-based rules, least-privilege access, and continuous inspection using security profiles on all allowed traffic.
An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)
The next-hop specifies where the firewall should forward matching traffic.
Why this answer
A static route requires a destination subnet, a next-hop specification (IP address or interface), and a route name/destination identifier.
An administrator is setting up a Site-to-Site IPsec VPN tunnel on a Palo Alto Networks firewall. The VPN tunnel comes up, but traffic from the local subnet cannot reach the remote subnet. Upon checking the IPsec SA status, the phase 2 security associations are active. What is the most likely cause of the traffic failure?
If Proxy IDs (subnet selectors) do not match on both ends of an IKEv1 IPsec tunnel, traffic matching the local policy will be dropped by the crypto engine.
An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?
Missing OS dependencies will cause the MSI package installation to fail during deployment.
Why this answer
Cortex XDR agents require specific Windows OS patches (such as Universal C Runtime updates) and proper MSI execution privileges.
An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?
The Action Center records all remediation actions including quarantine history.
Why this answer
Quarantined items can be managed and reviewed directly from the Cortex XDR management console under Incident Response or Endpoint views.
A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?
DoS Protection profiles mitigate flood attacks by applying rate-limiting thresholds to sources.
Why this answer
Zone Protection profiles or DoS Protection profiles protect against volumetric attacks and flood conditions originating from single or multiple IP sources.
An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)
Data Filtering profiles inspect payloads for sensitive data patterns.
Why this answer
Data exfiltration is prevented using Data Filtering profiles, File Blocking profiles, and SSL Decryption to inspect encrypted egress traffic.
An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?
Prisma Cloud inspects IAM configuration and credential reports to identify security hygiene issues such as inactive keys.
Why this answer
Prisma Cloud evaluates AWS IAM credential report data and cloud audit logs to identify inactive or unused access keys.
An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?
Correct. Device > Admin Roles is the exact location to create and manage granular administrative permissions.
Why this answer
Custom Admin Roles are configured under Device > Admin Roles. This allows administrators to define granular read, write, or none permissions for specific tabs, menus, and tasks.
An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?
Data filtering profiles inspect payload content for sensitive data patterns like credit cards.
Why this answer
Data Filtering profiles allow administrators to scan traffic for patterns like credit card numbers and Social Security numbers using predefined or custom regular expressions.
An organization is deploying a zero-trust network architecture using Palo Alto Networks firewalls. The security team needs to ensure that internal user traffic destined for sensitive database servers is strictly inspected for application-layer threats. Which security mechanism must be enforced to achieve Layer 7 visibility and control?
Correct. App-ID uses deep packet inspection to identify applications reliably, allowing administrators to write granular Layer 7 security policies.
Why this answer
Port-based rules only look at layer 4 ports, whereas App-ID performs deep packet inspection to identify the exact application regardless of port, enabling effective Layer 7 security.
A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?
Integrations handle the communication and ingestion of external alerts into XSOAR.
Why this answer
Integrations in Cortex XSOAR connect to third-party tools like Prisma Cloud via API to fetch incidents, which then trigger automated incident types and playbooks.
An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?
Palo Alto Networks provides dedicated legacy agent builds for older supported operating systems.
Why this answer
Cortex XDR supports legacy operating systems with specific legacy agent versions that provide core prevention capabilities supported by those OS architectures.
A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?
FCS errors are generated when frames arrive corrupted at the physical layer, pointing to faulty cabling, connectors, or SFPs.
Why this answer
Incrementing FCS errors and CRC errors on an Ethernet interface typically indicate physical layer issues such as bad cabling, duplex mismatches (though both set to full), or physical media degradation.
Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)
macOS is fully supported with dedicated agent builds.
Why this answer
Cortex XDR supports major desktop and server operating systems including Windows and macOS.
An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?
This command correctly filters global counters to display only those related to packet drops.
Why this answer
The command 'show counter global filter packet-drop yes' allows administrators to view global packet drop counters in real time, which is essential for troubleshooting traffic drops on the firewall.
A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?
BIOCs focus on techniques and behaviors, making them effective against unknown or fileless threats.
Why this answer
BIOC alerts identify malicious sequences of events or techniques rather than relying solely on file signatures.
An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?
Unknown hashes trigger uploads for dynamic and static analysis in the WildFire cloud.
Why this answer
The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.
SSL Forward Proxy decrypts outbound traffic and requires the trust certificate to be installed on clients to prevent warnings.
A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?
The CSPM compliance module maps discovered cloud configurations to industry standards and regulatory frameworks.
Why this answer
Prisma Cloud CSPM includes pre-built compliance dashboards and reports mapping resource configurations to regulatory frameworks like HIPAA and PCI-DSS.
Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)
Enterprise management tools can push MSI installations to enrolled workstations.
Why this answer
Administrators can deploy the Cortex XDR agent via Active Directory GPO, third-party software deployment tools (SCCM/Intune), or manual installation scripts.
An organization is deploying a comprehensive threat prevention strategy using Palo Alto Networks Security Profiles. Which THREE security profile types are available out-of-the-box to inspect data plane traffic for specific threat vectors? (Choose three)
Correct. Anti-Spyware profiles detect and block malicious spyware behavior and C2 communications.
Why this answer
Palo Alto Networks Threat Prevention includes Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire Analysis security profiles.
A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?
The customer is responsible for the container images, application code, and libraries packaged inside the container.
Why this answer
When deploying containers, the base image and application dependencies are managed by the customer, whereas the underlying node OS and cluster control plane are managed by the cloud provider or shared.
A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?
Behavioral Threat Protection analyzes runtime activity to detect malicious techniques like process injection.
Why this answer
Local Analysis and Exploit/Behavioral Threat Protection guard against process injection and memory-based attacks.
An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)
Vulnerability testing identifies gaps before attackers exploit them.
Why this answer
Proactive risk management includes vulnerability assessments, threat modeling, and indicators of compromise (IOC) monitoring.
A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?
ECMP path selection in PAN-OS hashes session 5-tuple parameters to ensure packets belonging to the same session always traverse the same path while balancing sessions across links.
Why this answer
By default, PAN-OS uses a hash algorithm based on session characteristics (such as source IP, destination IP, source port, destination port, and protocol) to distribute ECMP traffic.
NAT Loopback is required when internal clients access internal servers via their external public NAT IP.
The 'ping host' command resolves the hostname via DNS and initiates ICMP echo requests.
Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)
Tier-1 analysts handle the high volume of incoming alerts to separate false positives from true threats.
Why this answer
Tier-1 analysts focus on initial alert triage, alert verification, running basic playbooks, and escalating verified threats to Tier-2.
An administrator configures Dynamic NAT on a Palo Alto Networks firewall using a pool of public IP addresses. After implementation, some internal clients intermittently fail to establish outbound connections. Upon reviewing traffic logs, the administrator notes that the NAT translation pool has exhausted all available ports for a specific source IP. Which feature should be enabled or adjusted to prevent this port exhaustion?
Expanding the NAT pool or utilizing DIPP block allocation ensures more ports are available or efficiently distributed.
Why this answer
Port exhaustion in dynamic IP and port NAT can be mitigated by adding more IP addresses to the NAT pool, enabling destination IP translation, or adjusting port allocation settings.
A network administrator notices that a critical internal host is continuously communicating with an external Command and Control (C2) server. To mitigate this risk instantly without disrupting all outbound traffic, where should the administrator check to verify if WildFire or Anti-Spyware signatures are actively blocking this specific traffic pattern?
Correct. Anti-Spyware profiles contain signatures and controls specifically designed to detect and block C2 traffic and infected host call-homes.
Why this answer
The Anti-Spyware profile detects and blocks C2 communications and DNS queries associated with malware. Checking the Security policy rule to ensure an Anti-Spyware profile is attached is essential.
An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?
Creating targeted exceptions resolves the false positive while keeping protections active for other threats.
Why this answer
Analysts should create granular exceptions based on file hashes or behavioral signatures rather than disabling security modules globally.
An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?
SSL interception without proper certificate trust causes TLS handshake termination.
Why this answer
TLS handshake failures usually stem from expired certificates, SSL inspection proxies intercepting traffic without proper root CA trust, or incorrect proxy settings.
A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)
Correct. Comprehensive inspection and logging provide necessary visibility for zero trust.
Why this answer
Zero Trust principles include continuous verification, least privilege access, inspecting and logging all traffic, and assuming breach.
An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?
The Incidents tab groups related alerts and maps them to the MITRE ATT and CK framework.
Why this answer
Cortex XDR provides an Incident view that aggregates related alerts into a single incident, mapped directly to the MITRE ATT and CK framework to help analysts understand the threat lifecycle.
During a phishing investigation, a SOC analyst receives an email sample containing malicious URLs. Which tool within Cortex XSOAR can be leveraged to automatically extract URLs, perform reputation checks, and block them on the firewall without manual intervention?
XSOAR playbooks automate the entire lifecycle of phishing triage, extraction, and mitigation.
Why this answer
Cortex XSOAR uses automated playbooks containing integration commands to parse artifacts, check threat intelligence, and take enforcement actions.
An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)
A Layer 3 interface requires at least one IP address to route traffic.
Why this answer
A Layer 3 interface requires an IP address and a Security Zone association to participate in routing and security inspection.
SSL/TLS Service Profiles define cipher suites and minimum TLS versions for management services.
An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?
Isolation exceptions allow targeted connectivity to specific IPs while keeping the rest of the network cut off.
Why this answer
Cortex XDR allows administrators to configure isolation exceptions that specify permitted IP addresses or ports for isolated endpoints.
An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?
The causality chain traces the exact lineage of events leading up to and following a suspicious process execution.
Why this answer
The Cortex XDR Causality Chain and BIOC (Behavioral Indicator of Compromise) timeline provide a graphical and chronological representation of process activity.
An administrator needs to monitor traffic and generate logs without blocking packets when evaluating a new application rule. Which TWO actions or logging configurations should be applied? (Choose two)
Allow permits the traffic to pass while logs are generated.
Why this answer
To monitor traffic without dropping it, the rule action must be set to 'Allow', and 'Log at Session End' should be enabled.
An incident responder is investigating a suspected lateral movement attack where an attacker utilized stolen Kerberos tickets (Pass-the-Ticket). Which log source in Cortex XSIAM or Windows event collection is essential for detecting abnormal Kerberos service ticket requests (Event ID 4769)?
Event ID 4769 tracks when a Kerberos service ticket is requested, crucial for detecting lateral movement anomalies.
Why this answer
Windows Security Event ID 4769 logs Kerberos service ticket requests, which is critical for detecting pass-the-ticket and kerberoasting attacks.
An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?
Incorrect peer IP addresses or configuration errors prevent the TCP connection from initiating, keeping BGP in the Idle state.
Why this answer
A BGP peer stuck in 'Idle' often indicates that the peer IP address is incorrect, the peering interface is down, or routing to the peer cannot be established.
Practice Cybersecurity-Apprentice by domain
Target a specific domain to shore up weak areas.