scenario questions

A junior security analyst at a healthcare company receives a call from an employee who says they received an email from the IT department asking them to click a link and reset their password. The email address looks slightly misspelled. The analyst wants to confirm whether this is a phishing attempt before the employee clicks anything. Which action should the analyst take FIRST?

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

A company is deploying a Network Intrusion Prevention System (NIPS) inline at the perimeter. The security team wants to minimize false positives while ensuring that malicious traffic is blocked. Which TWO actions should be taken during NIPS tuning? (Choose two.)

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

An organization wants to reduce the risk that a stolen laptop's disk contents can be read by a thief. The laptop contains only files on the local drive, and the user sometimes works offline. Which control best meets this requirement?

A security administrator is configuring a web application firewall (WAF) in front of a public-facing login portal. The administrator wants to protect against automated credential stuffing attacks that use large lists of username and password combinations. Which WAF feature is MOST appropriate to detect and block this behavior?

A security administrator is planning a network segmentation design and needs to understand how devices communicate at Layer 2. Which TWO statements accurately describe Ethernet MAC address behavior in a switched network? (Choose two.)

An administrator wants to view active sessions matching a specific source IP address (192.168.1.50) using the firewall CLI. Which command is correct?

A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)

A security administrator is configuring Prisma Cloud to monitor an Azure subscription. They need to ensure that Prisma Cloud can read all resources and their configurations but must not be able to modify or delete any resources. Which Azure built-in role should be assigned to the Prisma Cloud service principal?

A network security analyst is investigating a suspected ARP spoofing attack on the local network. The analyst needs to verify the ARP cache on a Windows workstation to identify any duplicate IP addresses mapped to different MAC addresses. Which TWO commands can be used to display the ARP cache on the workstation? (Choose two.)

A network administrator is configuring a Layer 3 interface on a Palo Alto Networks firewall to participate in a broadcast domain. The interface must obtain its IP address automatically from a DHCP server on the same subnet. Which interface configuration setting must be enabled to allow the firewall to act as a DHCP client?

A Tier-1 SOC analyst receives an alert from the endpoint agent indicating that a known malicious hash was blocked during execution. The analyst wants to confirm whether any other endpoints in the organization attempted to execute the same file and whether those attempts were blocked or allowed. Which data source should the analyst query to obtain this information?

Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

A security analyst is reviewing Prisma Cloud alerts and notices an alert for an Amazon S3 bucket that has been configured with a bucket policy allowing public read access. The analyst needs to quickly identify which AWS account the bucket belongs to and which user made the change. Which Prisma Cloud feature should the analyst use to obtain this information?

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance attacks. The administrator wants to detect and block port scans and host sweeps on the untrusted zone. Which TWO actions should be taken to achieve this? (Choose two.)

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

A security analyst is reviewing captured traffic and needs to identify which protocol resolves a known IPv4 address to its corresponding MAC address on the local segment. Which protocol performs this function?

A SOC analyst is reviewing the primary log categories generated by a Palo Alto Networks Next-Generation Firewall. Which TWO log types are natively available in PAN-OS for security monitoring and incident analysis? (Choose two)

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Under the shared responsibility model in cloud computing, the customer retains responsibility for securing specific layers regardless of whether the service is IaaS, PaaS, or SaaS. Which TWO items are always the customer's responsibility? (Choose two)

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

A security administrator is configuring Cortex XDR agent installation packages for a mixed environment of Windows and macOS endpoints. The administrator needs to ensure that the agent can communicate with the Cortex XDR cloud tenant and that endpoints are protected immediately after installation. Which TWO configuration settings are required in the installation package to achieve this? (Choose two.)

A security analyst for a healthcare company is configuring Prisma Cloud to monitor an AWS environment that stores protected health information. The compliance team requires that all data at rest be encrypted with customer-managed keys and that any deviation be detected within minutes. Which Prisma Cloud capability should the analyst use to continuously detect S3 buckets that are not encrypted with a customer-managed AWS KMS key?

A security operations center (SOC) analyst is investigating a series of alerts indicating that internal users are accessing malicious domains. The analyst wants to verify whether the Palo Alto Networks firewall is blocking these domains based on DNS sinkholing. Which firewall feature should the analyst check to confirm that DNS sinkholing is properly configured and operational?

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

A junior security analyst is reviewing the TCP/IP model as part of onboarding. She needs to identify which layer is responsible for logical addressing and routing of packets between different networks. Which layer of the TCP/IP model performs this function?

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

A SOC analyst is triaging an alert for a suspicious login to a cloud-based email service. The alert indicates a successful login from an IP address in a foreign country, but the user typically works from the United States. The analyst checks the user's recent activity and sees that the login occurred outside normal working hours. Which of the following actions should the analyst take NEXT to determine if the login is malicious?

A network administrator is configuring a site-to-site VPN between two offices using IPsec in tunnel mode. The administrator wants to ensure that only specific subnets can communicate over the VPN, and that the traffic is encrypted and authenticated. Which combination of IPsec components achieves this?

A security administrator is configuring Prisma Cloud Cloud Account onboarding for an AWS environment that includes standalone accounts as well as accounts that were created through AWS Organizations. The administrator wants to minimize the manual effort required to grant Prisma Cloud read-only access and to automatically include future accounts. Which approach should the administrator use?

A network security analyst is reviewing how a host on a corporate LAN resolves names and discovers services. The analyst wants to identify TWO protocols or mechanisms that operate at the application layer and rely on UDP for transport. (Choose two.)

An enterprise security administrator is designing a comprehensive security posture following Zero Trust principles on a Palo Alto Networks Next-Generation Firewall. Which TWO core concepts must be implemented to satisfy a true Zero Trust data and network architecture? (Choose two)

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

A hospital network administrator must ensure that only authorized medical devices can connect to a dedicated VLAN. The devices support 802.1X and have unique certificates. The administrator wants to enforce identity-based access at the switch port and reject any device without valid credentials. Which technology should be implemented?

When designing a Security Operations Center (SOC) incident triage workflow, which TWO core principles are fundamental for effective incident management? (Choose two)

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

A security team must ensure that objects in an Amazon S3 bucket cannot be made public, even if an administrator later attaches a permissive bucket policy. Which S3 setting should the team enable?

A security architect is designing an enterprise logging strategy where all Prisma Cloud audit alerts, vulnerability findings, and compliance violations must be streamed to a third-party SIEM (such as Splunk). Which Prisma Cloud feature should be configured to achieve real-time log export?

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to modify the memory of another process on a critical server. The analyst wants to determine whether the Cortex XDR agent blocked the attempt or only logged it. Which field in the Cortex XDR alert details should the analyst examine to confirm the action taken by the agent?

A security analyst at a financial firm notices that a Cortex XDR agent on a Windows 10 endpoint quarantined a file named 'invoice.pdf.exe' that was downloaded from a phishing email. The analyst wants to confirm the file's reputation and see if it has been seen across other organizations. Which Cortex XDR component should the analyst use to check the file's global reputation and threat intelligence?

A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)

Which TWO types of files or threats are typically inspected and analyzed by the WildFire cloud service when integrated with Cortex XDR? (Choose two)

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

A security analyst is reviewing a suspicious PowerShell script that was executed on a user's workstation. The script attempted to download a file from a remote server and execute it in memory. Which TWO Windows event log sources would provide the MOST relevant information to investigate this activity? (Choose two.)

Which security control is primarily responsible for inspecting decrypted web traffic for known viruses, trojans, and worms entering the network?

A security team is reviewing network traffic captures and wants to determine which internal workstation initiated a connection to an external web server. The capture contains only the packet headers of the conversation. Which pair of attributes in the packet header identifies the source of the connection?

A security engineer is deploying a Palo Alto Networks firewall in a network that uses NAT. The engineer needs to ensure that the firewall can identify applications that use dynamic ports, such as FTP, and apply the correct security policy. Which feature should the engineer configure to achieve this?

Which THREE actions occur when an endpoint is placed into 'Isolation' mode using Cortex XDR? (Choose three)

A security administrator is configuring a Cortex XDR agent policy to protect against exploit techniques such as memory corruption and return-oriented programming (ROP). Which two protection modules should be enabled to mitigate these threats? (Choose two.)

An organization is designing segmentation for a data center. The security architect wants east-west traffic between application tiers to be inspected and policy-controlled without forcing all traffic through a single physical appliance that could become a bottleneck. The design should also allow security policy to follow workloads as they move between hypervisors. Which approach best meets these goals?

Which THREE features are provided by the Cortex XDR agent to protect endpoints against modern malware and advanced threats? (Choose three)

An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?

A security team is deploying an intrusion prevention system (IPS) inline between an internal segment and the internet gateway. During testing, legitimate business traffic is being dropped because the IPS is matching benign patterns. The team wants to reduce false positives while keeping meaningful detection. Which TWO tuning actions are appropriate? (Choose two.)

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)

A system administrator at a small company receives an alert that an internal workstation is making repeated connection attempts to an external IP address on TCP port 445. The administrator wants to quickly identify which internal host is generating this traffic and verify whether the firewall is blocking it. Which action should the administrator take first?

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

A help desk technician receives a ticket from a user whose Windows laptop is running the Cortex XDR agent. The user reports that a business-critical line-of-business application now fails to launch, and the agent tray icon shows a red status. Before escalating, the technician wants to capture the reason the agent interfered with the application. Which Cortex XDR action should the technician perform first?

A small business owner wants to protect customer payment data. The owner asks a security consultant which control best reduces the impact if an attacker compromises a web server that stores payment records. The consultant recommends encrypting the payment records at rest with keys managed separately from the server. Which security principle does this recommendation primarily support?

A Cortex XDR administrator is investigating a Windows endpoint where the agent reported an exploit attempt against a document reader process. The exploit was blocked, but the administrator wants to understand the exact memory manipulation technique used before the block. Which Cortex XDR capability should the administrator use to examine the sequence of events and process behavior captured around the exploit?

A Tier-1 SOC analyst receives an alert from Cortex XDR indicating that a process on a Windows endpoint attempted to disable Windows Defender real-time protection. The analyst needs to gather the process name, command line, and parent process to decide whether to escalate. Which Cortex XDR console area should the analyst open to review this endpoint telemetry most directly?

A company is implementing a data loss prevention (DLP) strategy. The security team wants to prevent employees from emailing files that contain credit card numbers to external recipients. Which DLP component is primarily responsible for identifying the sensitive data within the email content?

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

A security analyst is reviewing a packet capture of a TCP session between an internal client and an external server. The capture shows the client sending a segment with the SYN flag set and the server responding with a segment that has both SYN and ACK set. The client then sends an ACK. What does this sequence indicate about the session?

A network engineer is analyzing a packet capture and notices that a host is sending a series of ICMP Echo Requests to a remote server. The host receives ICMP Echo Replies, but the payload sizes vary. The engineer wants to determine the maximum transmission unit (MTU) of the path to avoid fragmentation. Which protocol or mechanism is used to discover the path MTU?

An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?

A SOC analyst is triaging a phishing alert that includes an email attachment. The analyst needs to determine whether the attachment is malicious before escalating. Which TWO actions are appropriate first steps in this triage? (Choose two.)

An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?

A junior administrator is asked to identify the default administrative distance values used by a Palo Alto Networks firewall for routes learned from different sources. Which statement correctly identifies the default administrative distance for OSPF internal routes?

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

A security analyst is documenting the chain of custody for a hard drive that was seized from a suspect's computer. Which of the following is the PRIMARY purpose of maintaining a chain of custody?

A security analyst notices that a Cortex XDR agent on a Windows server has blocked a legitimate administrative tool because it matched a behavioral threat signature. The analyst wants to prevent this tool from being blocked in the future without disabling Behavioral Threat Protection entirely. What should the analyst do?

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

A SOC analyst is triaging a malware alert in Cortex XDR. The analyst needs to determine the scope of the infection by identifying other endpoints that communicated with the same malicious domain. Which TWO actions should the analyst take to achieve this? (Choose two.)

A security administrator is configuring the Cortex XDR agent on a group of Linux servers. The administrator wants to ensure that the agent can prevent exploitation of known vulnerabilities in common Linux services. Which TWO prevention modules in the Cortex XDR agent profile should the administrator enable to achieve this? (Choose two.)

An administrator is assigning IPv4 addresses to devices in a lab subnet. One host must be configured so that it can always be reached at the same address by other lab systems, and it must not depend on a DHCP server being available. Which configuration approach should the administrator use?

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

A cybersecurity apprentice is examining a suspicious packet capture. The captured frame shows a source MAC address of 00:1A:2B:3C:4D:5E, a destination MAC address of FF:FF:FF:FF:FF:FF, and an EtherType value of 0x0806. Based on these layer 2 header fields, which type of traffic is this?

A security awareness trainer is preparing a module on protecting against social engineering. The trainer wants to highlight common technical and human indicators that an email may be a phishing attempt. Which TWO indicators should the trainer include? (Choose two.)

A security administrator is configuring Cortex XDR to protect a fleet of Linux servers. The administrator wants to ensure that the agent can detect and prevent exploitation of vulnerabilities in commonly targeted services such as Apache and SSH. Which Cortex XDR module should be enabled and configured to provide this protection?

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

A network security engineer is configuring a new Palo Alto Networks firewall to securely allow remote users to access internal applications. The engineer decides to implement GlobalProtect with SSL VPN. Which TWO configurations are required to enable user authentication and ensure that only authorized users can access the internal applications? (Choose two.)

An administrator needs to configure granular endpoint settings for different departments within the organization. Which THREE components of Cortex XDR should be utilized? (Choose three)

An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?

A security engineer is configuring Prisma Cloud to monitor an AWS environment. The engineer wants Prisma Cloud to automatically detect when an IAM user is created with console access but no multi-factor authentication (MFA) enabled, and to raise an alert. Which Prisma Cloud capability should the engineer use to achieve this?

A security analyst is reviewing a SIEM alert about multiple failed login attempts followed by a successful login from an unusual geographic location. The analyst suspects a compromised account. Which TWO actions should the analyst take to validate and respond to this potential incident? (Choose two.)

A security team is implementing the principle of least privilege across its organization. Which TWO practices best support this principle? (Choose two.)

When performing threat hunting in Cortex XDR using XQL, an analyst needs to identify anomalous execution chains. Which THREE XQL query stages or clauses are valid and commonly used in building investigative queries? (Choose three)

A junior security administrator is configuring the Cortex XDR agent on a Windows endpoint and wants to ensure that the agent can block malicious files based on signatures and heuristics without requiring cloud connectivity. Which agent component is responsible for this local prevention capability?

A Cortex XDR administrator needs to prevent a specific known-malicious SHA-256 hash from executing on all Windows endpoints in a research lab, even if the file is renamed or copied to a new path. The administrator wants the block to take effect as quickly as possible without waiting for a full scan. Which Cortex XDR feature should be used?

A cloud operations team uses Prisma Cloud to monitor an Amazon Elastic Kubernetes Service cluster. The team wants Prisma Cloud to detect vulnerabilities in the container images that are already running in the cluster, without requiring a rebuild or a full registry rescan. Which Prisma Cloud capability should the team use?

A security analyst is reviewing a Cortex XDR alert on a Windows workstation where the agent reported a process that spawned from a Microsoft Word document, wrote a copy of itself into the user's Startup folder, and then contacted an external IP address. The analyst confirms the file hash is not present in any threat intelligence feed and the file signature is unsigned. Which Cortex XDR capability most directly generated this detection?

What is the primary benefit of deploying multi-factor authentication (MFA) for administrative access to security infrastructure?

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

A SOC analyst is reviewing a potential data exfiltration alert from a next-generation firewall. The alert indicates a large outbound transfer to an unknown external IP over TCP port 443. The analyst needs to determine if this is malicious or benign. Which of the following actions should the analyst take FIRST to gather the most relevant context?

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

A security operations team is configuring threat intelligence feeds in Cortex XSIAM. Which THREE indicator types can typically be ingested and correlated against network and endpoint telemetry? (Choose three)

A company is deploying a new VoIP phone system. The network administrator needs to ensure that voice traffic is prioritized over regular data traffic on the LAN. Which technology should be implemented on the switches to achieve this?

A security analyst is investigating a potential credential compromise in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user or role made a specific API call that modified a security group to allow unrestricted inbound access. Which AWS service should the analyst query to obtain this information?

A Cortex XDR administrator is reviewing the agent's self-protection capabilities on Windows endpoints. The administrator wants to ensure that the agent cannot be easily disabled or tampered with by malicious actors. Which TWO mechanisms does the Cortex XDR agent use to protect itself from being stopped or modified? (Choose two.)

A junior security analyst receives an alert that a user's account was accessed from two geographically distant locations within a few minutes. The organization has no travel policy exceptions for this user. Which cybersecurity principle is MOST directly relevant to investigating whether this is a genuine compromise?

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?

A cloud security team is configuring Prisma Cloud Compute to monitor containerized workloads in a Kubernetes cluster. They want to detect when a container attempts to access the host's process namespace, which could indicate a container escape attempt. Which Prisma Cloud Compute feature should they enable to achieve this?

A Tier-1 SOC analyst is monitoring the queue and receives an alert from the endpoint protection platform indicating that a known malware signature was detected and quarantined on a user's workstation. According to standard incident response procedures, what is the MOST appropriate immediate action for the analyst to take?

A financial services firm wants to confirm that its backup copies of a critical trading application can actually be restored after a ransomware incident. The backups are stored on immutable storage and replicated to an offsite location. Which activity best validates that the recovery capability will work when needed?

A network administrator is setting up a new branch office firewall. The ISP provides a single public IP address and requires the branch's internal web server (10.1.1.10) to be reachable from the internet on TCP port 443. The administrator configures a destination NAT rule translating the public IP to 10.1.1.10. However, external users still cannot access the web server. What is the most likely missing configuration?

A company uses a demilitarized zone (DMZ) to host a public web server. The security policy requires that the web server can only initiate outbound connections to a specific database server on the internal network and must not initiate any other outbound connections. Which firewall rule placement and action best enforces this requirement?

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

A security engineer must give an application running on an Amazon EC2 instance temporary credentials to read objects from a specific S3 bucket. The engineer wants to avoid storing long-term access keys on the instance. Which approach should the engineer use?

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

A SOC analyst is triaging an alert for a host that beaconed to a known command-and-control domain over HTTPS. The firewall shows the session was allowed because the traffic matched the SSL application with a valid server certificate. Which action should the analyst take to determine whether data was exfiltrated during the session?

A security analyst is reviewing Cortex XDR endpoint alerts and wants to confirm that the agent's exploit protection module is actively preventing known exploitation techniques on a Windows workstation. Which Cortex XDR agent capability should the analyst verify is enabled for this endpoint?

An administrator is reviewing Cortex XDR investigation tools. Which THREE features are available when investigating an incident in the Cortex XDR Incident View? (Choose three)

A junior administrator is documenting the corporate network and must list services that operate at the transport layer of the TCP/IP model. Which TWO protocols operate at the transport layer? (Choose two.)

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

A security analyst is reviewing a suspicious PowerShell script that was executed on a workstation. The script downloads a file from a remote URL, saves it to a temporary directory, and then executes it. Which TWO indicators should the analyst prioritize to determine whether this activity is malicious? (Choose two.)

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

A junior administrator is documenting the TCP/IP model layers for a training manual. The administrator needs to map the OSI model's Transport layer to its equivalent layer in the TCP/IP model. Which layer of the TCP/IP model corresponds to the OSI Transport layer?

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

An organization wants to protect its internal DNS servers from being used in DNS amplification attacks. The security team decides to implement DNS response rate limiting (RRL). Which statement best describes how RRL mitigates this threat?

A security analyst receives an alert about a workstation repeatedly attempting to connect to an IP address known for hosting malware. The analyst wants to confirm whether the connection was successful and what data might have been transferred. Which type of data should the analyst examine first?

A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?

A security team is reviewing an incident where an attacker gained initial access by sending an email with a malicious macro-enabled spreadsheet to a finance employee. The employee opened the file and enabled macros. Which control would have been MOST effective at preventing the macro from executing while still allowing legitimate business documents to open?

A security architect is designing a Prisma Cloud deployment for a Google Cloud environment that spans multiple projects under a single organization. The architect wants Prisma Cloud to discover resources in all current and future projects without configuring each project manually. What should the architect do?

A security administrator is reviewing logs and sees repeated failed login attempts against several user accounts from a single external IP address over a short period. The attempts use common usernames such as admin, root, and test. No account has been successfully accessed. Which type of attack is most likely occurring?

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

A security analyst at a financial firm receives an alert that a workstation has been communicating with a known malicious IP address. The analyst isolates the workstation from the network and begins reviewing logs. Which step of the incident response process is the analyst performing?

An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?

A tier-1 SOC analyst receives an alert for a blocked malware execution detected by WildFire on a firewall. What is the standard operational response procedure for this type of high-confidence prevention alert?

A SOC analyst is reviewing real-time firewall traffic in the Application Command Center (ACC). What is the primary purpose of the ACC in a Palo Alto Networks firewall?

A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?

A security analyst is reviewing a suspicious email reported by a user. The email contains a link to a website that asks for login credentials. The analyst wants to safely determine if the link is malicious without exposing the corporate network. Which of the following is the BEST action to take?

A security operations team notices that an attacker is using a compromised internal host to perform DNS tunneling to exfiltrate data to an external command-and-control server. The firewall is configured with a Security policy that allows DNS (UDP/53) from the internal zone to the external zone, and the DNS traffic is not being inspected by any security profile. The team wants to detect and block this activity with minimal impact on legitimate DNS traffic. Which Palo Alto Networks feature should they implement?

A retail company stores customer payment card numbers in a database. A compliance auditor asks the security team to reduce the impact if the database is compromised. The team proposes replacing the stored card numbers with surrogate values that can be mapped back only through a separately protected lookup table. Which data protection technique are they proposing?

Which security concept describes the practice of hiding internal network topology and IP address schemes from external entities using Network Address Translation (NAT)?

A Cortex XDR administrator is configuring an endpoint protection policy for a group of Windows servers that host a custom in-house database application. The application frequently writes large temporary files and spawns child processes during batch jobs. The administrator wants to reduce false positives without disabling protection entirely. Which TWO policy actions should the administrator take? (Choose two.)

A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?

An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process. The analyst wants to determine the parent process that spawned the suspicious executable and the full command line used. Which Cortex XDR feature should the analyst use to obtain this information?

A security engineer is configuring Prisma Cloud Compute to enforce runtime security policies for serverless functions in AWS Lambda. The goal is to detect and prevent malicious activities such as crypto mining and data exfiltration. Which TWO Prisma Cloud Compute capabilities should be enabled to achieve this? (Choose two.)

A security analyst is reviewing how data moves through the TCP/IP stack. She needs to identify TWO protocols that operate at the Transport layer and provide end-to-end communication between applications on different hosts. (Choose two.)

A SOC analyst is reviewing a SIEM alert that shows multiple failed login attempts followed by a successful login for the same user account from an unusual geographic location within a short time window. The account is used by a remote employee who normally connects from a single city. Which activity should the analyst prioritize to determine whether this represents a compromised account?

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

A security analyst is reviewing Cortex XDR endpoint alerts and notices that a process on a Windows endpoint performed a series of actions: it created a child process from a Microsoft Office application, then attempted to write to the memory of that child process. The analyst suspects a multi-stage attack. Which TWO Cortex XDR agent modules would most likely generate alerts for these actions? (Choose two.)

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

A financial services firm stores sensitive customer data in an Amazon S3 bucket. An auditor requires that all access to the bucket be logged, that logs capture the identity of the requester, and that logs be retained for one year. Which combination should the security administrator implement?

An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)

A help desk technician is on a support call with a remote user whose workstation cannot reach any resources on the corporate network. The technician asks the user to run a command that will show the workstation's IP address, subnet mask, and default gateway. Which command should the user run?

A financial services company is reviewing its identity and access management practices after an audit finding. The auditors noted that several former contractors still had active accounts and that some current employees retained access to systems they no longer used. The security team must recommend changes that directly address these findings. (Choose two.)

A hospital's security team must protect patient records stored on a file server. The compliance officer asks which control ensures that data remains unaltered and trustworthy while it is stored and while it travels between the server and clinical workstations. Which security objective is the officer asking about?

An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?

A Tier-1 analyst receives an alert that a user's credentials were used to authenticate to a SaaS application from an unfamiliar foreign IP address at 03:00 local time, while the user was asleep. The identity provider shows a successful single-factor login. Which immediate containment step best limits further unauthorized access while preserving evidence?

A security analyst at a healthcare company is reviewing a new Amazon S3 bucket that will store patient records. The compliance officer requires that the data be encrypted at rest and that the company retain control of the encryption keys and their rotation schedule. Which AWS service should the analyst recommend?

A Tier-1 SOC analyst is documenting an incident involving a suspicious PowerShell script executed on a user workstation. Which TWO pieces of information are MOST important to capture in the initial incident ticket to support later investigation? (Choose two.)

A Cortex XDR administrator needs to prevent users from copying sensitive files to unauthorized USB storage devices on a group of Windows endpoints. The administrator wants to allow only specific encrypted USB drives that are registered with the organization. Which Cortex XDR agent module should be configured to achieve this?

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

A security analyst is investigating a suspicious process on a Windows endpoint protected by Cortex XDR. The analyst wants to see the full command line, parent process, and network connections associated with that process. Which Cortex XDR console feature should the analyst use?

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password immediately or their account will be locked. The link leads to a website that looks identical to the company's login page. Which type of attack is this?

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

During a routine audit, a SOC supervisor wants to ensure that all administrative logins to Panorama and managed firewalls are centrally tracked and securely archived. Which log type in the PAN-OS logging architecture records administrator login sessions and configuration changes?

A network administrator is troubleshooting a connectivity issue between two hosts on the same VLAN. The hosts are connected to the same switch, but they cannot ping each other. The administrator suspects a Layer 2 problem. Which command should be used on the switch to verify the MAC address table and confirm that the switch has learned the MAC addresses of both hosts?

A network technician is configuring a small branch office where the ISP provides a single public IPv4 address. Multiple internal hosts must reach the internet simultaneously using that one address. Which technology should the technician implement?

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

A Cortex XDR administrator is preparing to deploy the agent to a group of Windows endpoints. The administrator wants to ensure that the agent can communicate with the Cortex XDR management console and receive policy updates. Which TWO network requirements must be met? (Choose two.)

An employee at a logistics firm plugs an unfamiliar USB drive found in the parking lot into a corporate laptop. Shortly afterward, the endpoint protection console reports that a process is attempting to encrypt files in the user's documents folder and rename them with a new extension. Which type of malware is MOST likely responsible?

A junior security analyst at a healthcare company receives a phone call from someone claiming to be the IT help desk. The caller says the analyst's VPN certificate is about to expire and asks the analyst to read back the six-digit code that just appeared in the analyst's authenticator app so the certificate can be renewed remotely. The analyst notices the caller ID shows an internal extension. What should the analyst do first?

A Tier-1 SOC analyst receives an alert indicating that a workstation's host-based antivirus quarantined a known malware binary. The analyst must follow the organization's standard operating procedure for confirmed malware containment. Which action should the analyst take FIRST?

A security analyst is investigating a Cortex XDR alert for a Linux server that shows a suspicious script executing from /tmp. The analyst wants to determine the script's origin and whether it has established persistence. Which Cortex XDR feature should the analyst use to trace the script's execution flow and identify any child processes or network connections?

A security analyst at a managed security service provider (MSSP) is triaging a phishing alert that was escalated from a customer's email gateway. The customer's environment includes Microsoft 365 and Palo Alto Networks Cortex XDR. The analyst needs to determine whether the potentially malicious URL in the email was ever clicked by any user in the customer's tenant. Which data source should the analyst query first to efficiently identify any user interaction with the URL?

Which TWO protocols are commonly used for device management and administrative access on a Palo Alto Networks firewall management plane? (Choose two)

Which TWO actions can a Security policy rule execute when traffic matches the rule criteria? (Choose two)

A cloud security engineer is configuring Prisma Cloud's anomaly detection for user behavior in an AWS environment. The engineer wants to reduce false positives from legitimate administrative activity while still detecting credential compromise. Which action best supports this goal?

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

An enterprise firewall is experiencing high session utilization due to a distributed denial-of-service (DDoS) SYN flood attack targeting a public web server. Which feature on the Palo Alto Networks firewall should an administrator configure to protect the server from resource exhaustion?

A financial services company is migrating workloads to Microsoft Azure and must strengthen its identity security posture. The security team wants to enforce controls that reduce the impact of compromised user accounts. Which TWO measures should the team implement? (Choose two.)

A mid-sized retailer is building its incident response capability after a ransomware near-miss. The apprentice is asked which activities belong in the preparation phase of the incident response lifecycle. (Choose two.)

A help desk technician is diagnosing a user's workstation that can reach a server by IP address but cannot reach it by hostname. The technician confirms the workstation has a valid IP address, default gateway, and can ping the server's IP successfully. Which network service should the technician investigate first?

A SOC analyst is reviewing an alert generated by the SIEM correlation rule for multiple failed logins followed by a successful login from an unusual geographic location. The account belongs to a finance employee who is currently traveling abroad. What is the MOST appropriate next step for the analyst?

A SOC analyst is reviewing a firewall log where an internal host repeatedly connected to an external IP address on TCP port 4444 every 60 seconds for several hours. The connections transferred only a few bytes each time. Which characteristic most strongly suggests this is command-and-control beaconing rather than normal user traffic?

A security engineer is deploying a Palo Alto Networks firewall in a hybrid cloud environment. The engineer needs to ensure that outbound traffic from the internal network to the internet is inspected for threats and that users are identified by their Active Directory credentials. The firewall is configured with a Trust zone for internal users and an Untrust zone for the internet. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

A help desk technician is explaining basic network concepts to a new hire. The technician needs to describe which protocol operates at the Transport layer of the OSI model and provides reliable, connection-oriented delivery. Which protocol should the technician identify?

An analyst notices that a specific URL is incorrectly categorized by the Palo Alto Networks URL Filtering database (BrightCloud/PAN-DB). What is the appropriate procedure to request a re-categorization of this URL?

An administrator is designing a Zero Trust network architecture on a Palo Alto Networks firewall. Which TWO best practices should be implemented in the Security policy rulebase? (Choose two)

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

A security analyst is reviewing traffic from a workstation that has been assigned the IPv4 address 192.168.10.77 with a subnet mask of 255.255.255.192. The workstation needs to send a packet to 192.168.10.130. What will the workstation do with this packet?

An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?

An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?

A security analyst is reviewing Cortex XDR endpoint alerts and notices a pattern where the same executable is repeatedly flagged for creating suspicious child processes, but the file hash is not present in any threat intelligence feed. The analyst wants to prevent this behavior from executing on all endpoints without blocking other legitimate applications that use similar process creation. Which Cortex XDR prevention module should the analyst configure to address this specific behavioral pattern?

A network engineer is troubleshooting an issue where a Palo Alto Networks firewall is not installing a static route into the virtual router's forwarding table. The route is configured with a next-hop IP address that is not directly connected to any interface on the firewall. What is the most likely reason the route is not active?

A cloud administrator is setting up a new Amazon RDS for MySQL database. The company policy requires that data be encrypted at rest and that the database not be reachable from the public internet. Which configuration should the administrator choose?

A security analyst is investigating a potential data exfiltration incident on a Windows endpoint. The analyst wants to collect forensic data from the endpoint, including running processes, network connections, and registry keys, without disrupting the user's work. Which Cortex XDR response action should the analyst use to gather this information remotely?

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large outbound transfer to an unknown IP address over port 443. The analyst wants to determine if this is malicious. Which of the following actions should the analyst perform FIRST to gather more context?

An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?

An organization is deploying a zero-trust network architecture using Palo Alto Networks firewalls. The security team needs to ensure that internal user traffic destined for sensitive database servers is strictly inspected for application-layer threats. Which security mechanism must be enforced to achieve Layer 7 visibility and control?

A company wants to protect its web application from attackers who try to inject malicious scripts that would execute in the browsers of other users viewing the application. Which security control should be implemented to mitigate this risk?

A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

A Cortex XDR administrator needs to ensure that endpoints in a high-security department can only communicate with a specific set of internal servers and cannot access the internet. Which Cortex XDR agent feature should be configured to enforce this network restriction?

A SOC analyst is reviewing a Cortex XSIAM alert for a suspicious PowerShell script execution. The analyst wants to see the full command line and the parent process of the PowerShell process. Which Cortex XSIAM feature should the analyst use?

A SOC analyst is triaging a phishing report where a user received an email with a link to a credential-harvesting page. The analyst wants to determine whether any other users in the organization received the same message. Which action best supports this goal using email security tooling?

A Tier-1 SOC analyst receives an alert from the SIEM indicating a possible brute-force attack against the domain controller. The analyst needs to follow the standard incident response process. According to NIST SP 800-61, which phase of the incident response lifecycle involves determining whether an event is actually an incident and its scope?

A hospital's IT team is classifying its information assets. A patient-record database stores names, dates of birth, insurance identifiers, and treatment notes. The compliance officer asks the apprentice to label the sensitivity of this data. Which classification best fits this data set?

An e-commerce company's web server was compromised after an attacker submitted crafted input that caused the application to return database error messages revealing table names. The developer wants to stop the application from interpreting user input as executable database code. Which control directly addresses this weakness?

A SOC analyst is investigating a potential data exfiltration incident. The analyst observes that a workstation has been communicating with an external IP address using DNS queries that contain long, random-looking subdomains. The volume of these queries is high, and the subdomains change frequently. Which type of attack is most likely occurring?

A cloud security analyst is reviewing the shared responsibility model for a public cloud environment. The analyst needs to identify which security tasks are the responsibility of the cloud customer. Which of the following is a customer responsibility?

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?

A network engineer is analyzing a packet capture and observes that a workstation sends a TCP segment with the SYN flag and a destination port of 443 to a web server. The server responds with SYN-ACK, and the workstation completes the handshake with ACK. Shortly after, the workstation sends a segment with the RST flag. Which statement best describes what the RST segment indicates in this scenario?

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

A security analyst is reviewing network traffic and observes a series of TCP packets where the flags field is set to SYN, then SYN-ACK, then ACK. The analyst needs to document the purpose of this exchange. What is the primary function of this three-way handshake?

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

A security analyst at a healthcare company needs to confirm that its cloud storage buckets comply with the HIPAA security rule. The company uses Prisma Cloud to monitor its AWS environment. Which Prisma Cloud capability should the analyst use to continuously evaluate the configuration of those S3 buckets against HIPAA controls?

A cybersecurity apprentice is analyzing traffic captures and notices that a workstation sends a single packet to a server, and the server responds with a packet that is much larger than the original. The apprentice suspects that the network path cannot handle the larger frame size. Which protocol should the apprentice examine to confirm that the path supports the larger frame size without fragmentation?

Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)

A small business owner wants to protect the company's network from external threats. The owner has installed a firewall and antivirus software on all computers. Which additional basic security measure should the owner implement to protect against unauthorized access to the wireless network?

An organization is deploying a comprehensive threat prevention strategy using Palo Alto Networks Security Profiles. Which THREE security profile types are available out-of-the-box to inspect data plane traffic for specific threat vectors? (Choose three)

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

A junior SOC analyst is examining a packet capture taken from a workstation that is failing to reach an internal web server. The capture shows the workstation sending a frame with destination MAC address 01:00:5E:00:00:FB and a destination IP address of 224.0.0.251. What is the workstation most likely attempting to do?

A security analyst is examining network traffic logs and notices that an internal host is sending a large number of SYN packets to multiple external IP addresses on port 80, but never completing the TCP handshake. The analyst suspects a SYN flood attack originating from the internal host. Which security feature should the analyst configure on the firewall to mitigate this type of attack?

A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?

A SOC analyst receives an alert from Cortex XSIAM indicating a possible brute-force attack against a user account. The analyst wants to quickly see the raw log events that triggered the alert. Which Cortex XSIAM component should the analyst use to view the underlying log data?

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

A junior security administrator is asked to verify that the Cortex XDR agent on a Windows endpoint is able to receive updated prevention policies from the cloud. The administrator checks the agent status in the Cortex XDR console and sees that the endpoint is listed as 'Connected' but the last policy update was over 30 days ago. Which action should the administrator take first to ensure the agent receives the latest policies?

An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?

A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?

A cloud operations team at a healthcare company stores patient records in an Amazon S3 bucket. An auditor asks the security administrator to confirm that the data is encrypted at rest and that the organization controls the encryption keys. Which AWS service should the administrator use to meet this requirement?

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?

A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?

An organization wants to ensure that sensitive data stored on employee laptops remains confidential even if a laptop is lost or stolen. The data must be unreadable without the correct credentials. Which security control should be implemented?

A SOC analyst notices that several endpoint alerts share the same file hash and were triggered on different hosts within a short period. Before escalating, the analyst wants to confirm whether this hash is known malware and gather context about its behavior. Which resource should the analyst consult first for this enrichment?

An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

A new cybersecurity apprentice is asked to classify the following event: an employee receives an email that appears to come from the IT department, asking them to click a link and reset their password immediately or their account will be disabled. The link leads to a fake login page that captures credentials. Which type of attack best describes this scenario?

A network technician is troubleshooting a connectivity issue between two hosts on the same VLAN. The technician suspects a duplicate IP address on the network. Which command should the technician use on a Windows host to display the MAC address associated with an IP address in the local ARP cache?

A security engineer is hardening an Amazon EC2 instance that hosts a public-facing web application. The engineer wants to reduce the attack surface at the network and host layers. Which TWO actions should the engineer take? (Choose two.)

A SOC analyst is investigating a malware alert on an endpoint. The analyst wants to understand the behavior of the malware to determine its capabilities. The analyst has a malware sample and needs to analyze it in a safe environment. Which action should the analyst take?

A help desk technician reports that a user's workstation can reach servers on the local /24 subnet but cannot reach any host on a remote subnet. The workstation has IP address 10.20.30.45/24 and default gateway 10.20.30.1. The technician runs ipconfig and sees the correct address and mask, but pinging 10.20.40.10 fails. Which troubleshooting step should the technician perform FIRST to determine whether the problem is local or beyond the gateway?

An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

A Cortex XDR administrator is configuring endpoint protection for a group of Windows servers that run a custom Java application. The application uses a Just-In-Time (JIT) compiler that frequently generates dynamic code, and the administrator observes that Exploit Protection is blocking the application's normal execution. What is the most appropriate action to resolve this while maintaining security?

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. The team wants to ensure that Prisma Cloud can detect identity and access management (IAM) misconfigurations across all three clouds, such as overly permissive roles and unused credentials. Which TWO Prisma Cloud capabilities should the team leverage to achieve this? (Choose two.)

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

An incident responder is investigating a suspected lateral movement attack where an attacker utilized stolen Kerberos tickets (Pass-the-Ticket). Which log source in Cortex XSIAM or Windows event collection is essential for detecting abnormal Kerberos service ticket requests (Event ID 4769)?

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

A new security analyst at a retail company receives a help desk ticket stating that an employee clicked a link in an email and a browser window opened asking for their corporate username and password. The page looks identical to the company's single sign-on portal, but the URL is misspelled. The analyst must classify this event. Which category BEST describes this activity?

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?

A junior security analyst is reviewing Prisma Cloud alerts for an Amazon S3 bucket that was made publicly accessible. The analyst needs to quickly understand the potential impact and prioritize remediation. Which Prisma Cloud capability should the analyst use first?

A small company runs its customer web portal on a single Amazon EC2 instance. The security lead must decide who is responsible for patching the guest operating system, according to the AWS shared responsibility model. Who is responsible?

A financial services firm must prove to auditors that its security controls are documented, reviewed, and operating effectively over time. The compliance manager asks which activity produces the evidence trail showing that controls were tested and management acknowledged the results.

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

A security administrator is configuring Cortex XDR agent settings for a group of Linux servers. The administrator wants to ensure that the agent does not interfere with a custom application that performs legitimate but unusual system calls, which are currently being flagged as malicious by the agent's behavioral threat protection. What should the administrator do to prevent the agent from blocking this application while maintaining security?

A small company is moving its first workload to Microsoft Azure and wants to use Prisma Cloud to monitor the environment. The administrator needs to grant Prisma Cloud read access to the Azure subscription so that it can collect resource configuration and evaluate policies. Which action should the administrator take?

A security analyst is reviewing a web server log and sees the following entry: `GET /products.php?id=1' OR '1'='1`. The analyst suspects an injection attack. Which type of attack is most likely being attempted?

A network administrator is reviewing a firewall's session table and notices that a file transfer from a trusted internal host to an external IP address is permitted, but deep packet inspection shows the file contains a known malware hash. The administrator wants to ensure that any future transfer of a file with that hash is blocked and logged. Which action should the administrator take?

An administrator needs to verify the MAC address associated with a specific IP address on the local network segment using the firewall CLI. Which command should be executed?

A small accounting firm has no dedicated IT staff. An employee receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to 'prevent account suspension.' The employee is unsure whether the email is legitimate. Which cybersecurity concept best describes this attack?

A Tier-1 SOC analyst is preparing to escalate a confirmed malware infection on a finance workstation to the Tier-2 team. Which TWO pieces of information are most essential to include in the escalation ticket to enable effective response? (Choose two.)

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

A security engineer at a mid-sized company is configuring a Palo Alto Networks firewall to allow users on the internal network to access specific external web services while blocking all other outbound traffic. The engineer creates a Security policy rule from the Trust zone to the Untrusted zone, sets the action to Allow, and attaches a URL Filtering profile that blocks categories such as 'malware' and 'phishing'. After committing, users report that they can still access any website, including those in the blocked categories. What is the most likely reason for this behavior?

A security team is evaluating Prisma Cloud's cloud infrastructure entitlement management (CIEM) capabilities for a multi-cloud environment. The team wants to identify identities with excessive permissions. Which TWO functions does Prisma Cloud CIEM provide to support this goal? (Choose two.)

A security engineer is deploying a new containerized workload in a Kubernetes cluster that is monitored by Prisma Cloud Compute. The engineer needs to ensure that the container cannot escalate privileges by gaining additional capabilities beyond those explicitly granted. Which Kubernetes security context setting should be configured to meet this requirement?

A hospital is reviewing its identity and access management practices after an audit finding. The auditors noted that several former employees still had active directory accounts and that some accounts had more access than their roles required. Which two actions directly address the audit findings? (Choose two.)

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

An administrator is configuring External Dynamic Lists (EDLs) in PAN-OS. Which THREE list types are natively supported for import into the firewall? (Choose three)

A security operations center (SOC) analyst receives an alert about a potential data exfiltration attempt. The analyst needs to determine which internal host is communicating with a known malicious IP address and what application is being used. Which PAN-OS feature should the analyst use to quickly correlate the traffic and identify the host and application?

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

A SOC analyst notices that an internal server is making repeated DNS queries for randomly generated domain names, and the queries are failing with NXDOMAIN responses. The server is not scheduled to run any new applications. Which type of malicious activity does this pattern MOST likely indicate?

A help desk technician receives a ticket stating that a Cortex XDR agent on a Windows laptop displays a red status in the console and the user cannot access the corporate VPN. The technician confirms the laptop has internet access and can browse external websites. The technician needs to restore the agent's management connection so the security team can see the device again. Which step should the technician take first?

A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?

A security analyst notices that a production Amazon RDS database is reachable from the internet on port 3306. The database sits in a private subnet, and the analyst must identify which configuration change most likely introduced this exposure. Which AWS component should the analyst review first?

A mid-sized retailer stores customer payment card data on an internal server. A security analyst is asked to recommend controls that protect the confidentiality of that data if the server's disk is physically stolen. Which control best addresses this specific risk?

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?

An organization deploys a Palo Alto Networks firewall in 'Virtual Wire' mode. How does this deployment mode process incoming Ethernet frames?

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

A junior security analyst is learning about cloud security posture management (CSPM) with Prisma Cloud. The analyst asks a senior colleague to explain the primary purpose of CSPM. Which statement best describes the primary purpose of Prisma Cloud's CSPM capabilities?

A security analyst is investigating a potential security incident in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user recently created a new access key. Which AWS service should the analyst query to find this information?

A security team uses Prisma Cloud to monitor an AWS environment. They notice that a newly created S3 bucket is not appearing in Prisma Cloud's resource inventory. The bucket was created 10 minutes ago. The team confirms that the AWS account is onboarded and other resources are visible. What is the MOST likely reason for the delay?

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent service stopped unexpectedly. The administrator restarts the Cortex XDR agent service, but the endpoint still shows as disconnected in the console several minutes later. The endpoint has valid network connectivity to other internal resources, and the agent logs show repeated failures during the initial handshake with the cloud tenant. Which action should the administrator take to resolve the agent-to-cloud communication failure?

A SOC analyst is triaging a phishing report submitted by an employee. The email contains a link to a credential-harvesting page that mimics the organization's webmail portal. The analyst has confirmed the URL is malicious. Which action should the analyst take to protect other users while preserving evidence?

A security analyst is investigating a suspected network intrusion. The analyst needs to capture full packet payloads for offline analysis and has physical access to a SPAN port on a switch. Which tool should be used to capture the traffic?

A security team is conducting a risk assessment for a new web application that will process customer orders. The team must identify which of the following are examples of technical security controls that reduce the likelihood or impact of an attack. (Choose two.)

A SOC analyst is documenting an incident in which an attacker gained initial access through a phishing email and then created a new local administrator account on a compromised workstation. The analyst must record evidence that supports both the initial access vector and the persistence mechanism. Which TWO artifacts should the analyst collect to support the investigation? (Choose two.)

A network security engineer is configuring a new Palo Alto Networks firewall. The company policy requires that all outbound web traffic from the internal network be inspected for threats, but the firewall must not decrypt traffic to banking or healthcare websites due to privacy regulations. The engineer creates a decryption policy rule to exclude those categories. What should the engineer do next to ensure that the excluded traffic is still scanned for threats?

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

Which TWO methods are valid ways to access the Command Line Interface (CLI) of a Palo Alto Networks firewall? (Choose two)

What is the primary purpose of deploying a Threat Intelligence platform (TIP) alongside traditional security controls?

A company is preparing an incident response plan. The security team wants to ensure that when a critical server is compromised, they can determine what happened, contain the threat, and restore normal operations. The team is defining the phases of the incident response lifecycle. Which sequence correctly represents the standard incident response phases?

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

A security analyst receives an alert from Cortex XDR indicating that a suspicious PowerShell script was executed on an employee workstation. Which underlying security telemetry mechanism enabled Cortex XDR to capture the exact process execution tree and command-line arguments?

When onboarding multi-account cloud environments into Prisma Cloud, administrators can choose from several integration methods. Which THREE advantages are gained by setting up centralized cloud account onboarding and role aggregation? (Choose three)

An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?

A network administrator is configuring a new Palo Alto Networks firewall and wants to ensure that users on the internal network can access the internet but cannot directly reach the firewall's management interface from the dataplane. The firewall has three zones: Trust, Untrust, and Management. Which configuration should the administrator implement to achieve this requirement?

A cloud security engineer is configuring Prisma Cloud to monitor a multi-cloud environment consisting of AWS, Azure, and Google Cloud. The engineer wants to ensure that Prisma Cloud can continuously assess the security posture of resources across all three providers. Which TWO actions are required to onboard these cloud accounts for posture management? (Choose two.)

A security administrator is configuring the Cortex XDR agent on a new Windows endpoint. The administrator wants to ensure that the agent can detect and block known malicious files by comparing file hashes against a cloud-based database. Which prevention module should be enabled?

An administrator is configuring log forwarding filters in PAN-OS to reduce the volume of unneeded informational logs sent to an external SIEM. Where are these log forwarding filters defined?

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

A SOC analyst receives an alert from Cortex XDR indicating that a user's credentials were used to authenticate to a cloud service from an unusual geographic location. The analyst wants to quickly determine if this is a false positive or a genuine account compromise. Which action should the analyst take first?

An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?