Cybersecurity-Practitioner Practice Question: A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound…
A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?
⚠ Common exam trap
The trap is confusing the network channel with the action taken over it — candidates may pick Execution or Exfiltration because 'something bad is happening,' but ATT&CK classifies the communication channel itself as Command and Control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command and Control
Command and Control (TA0011) in MITRE ATT&CK covers techniques adversaries use to communicate with compromised systems, including encrypted tunnels and application-layer protocols used to relay commands. An outbound encrypted tunnel to an unknown external IP is the textbook signature of C2. The other tactics describe earlier or different phases of the attack lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Execution
Why it's wrong here
Execution (TA0002) covers techniques for running malicious code on a system, such as PowerShell, command interpreters, scheduled tasks or user execution of a malicious file. The log entry describes network traffic leaving the host for an unknown external address, not code being run. Malware certainly executes before it communicates, which makes the option tempting, but the outbound encrypted channel itself falls under Command and Control.
- ✗
Lateral Movement
Why it's wrong here
Lateral Movement covers techniques for pivoting between hosts inside a compromised network, such as PsExec or SMB admin shares. The log shows an external channel, not internal host-to-host traversal. It is tempting because C2 beacons can later enable lateral movement, but the tactic describing the outbound tunnel itself is Command and Control.
- ✗
Initial Access
Why it's wrong here
Initial Access covers techniques that gain an initial foothold, such as phishing or exploiting a public-facing application. The outbound tunnel implies an established implant already running, not the entry vector. It is tempting because C2 often follows initial access, but the tactic for the communication channel itself is Command and Control.
- ✓
Command and Control
Why this is correct
Command and Control (TA0011) covers how attackers communicate with systems they have compromised, including encrypted channels, application layer protocols such as HTTPS or DNS, proxies and tunnelling, often with regular beaconing. An outbound encrypted session to an unknown external address fits it closely. Analysts would next check threat intelligence for the destination, look for regular timing patterns, and identify the process making the connection.
About these practice questions
This Cybersecurity-Practitioner question is part of Courseiva's 309-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar Cybersecurity-Practitioner questions
- An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce cont…
- A SOC analyst is triaging a Cortex XDR alert where a process on a Windows endpoint executed 'vssadmin.exe delete shadows…
- A SOC analyst receives a Cortex XDR alert indicating that a process attempted to modify the registry key 'HKLM\Software\…
- An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentica…
- A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling,…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Practitioner practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Practitioner exam.