Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) (Cybersecurity-Practitioner) — Questions 1–75

A Restrictions Profile governs application execution on the endpoint, and a Block List rule can deny execution based on the executable name or path. Because the rule keys on the executable identity rather than a hash, it continues to block the tool across version updates, and the agent logs the block event for reporting in the console.

Cortex XDR Device Control policies allow administrators to define granular rules based on device class, vendor ID, product ID, and serial number, permitting approved encrypted USB drives while blocking all other mass storage devices. This directly meets the requirement of selective USB access on managed Windows endpoints without disabling USB ports entirely.

Config Query in Prisma Cloud allows security teams to write custom policies using Resource Query Language (RQL) to inspect cloud resource configurations. The engineer can create a query that detects S3 buckets with public access settings and configure it to generate alerts. This is the appropriate feature for defining a custom misconfiguration policy.

Onboarding an Azure subscription through a registered application with certificate-based or federated identity credentials gives Prisma Cloud the read permissions it needs to evaluate subscription configuration while avoiding a stored long-lived client secret. Certificate credentials can be rotated on a schedule and federated credentials remove stored secrets entirely, satisfying the no-long-lived-credential constraint.

Prisma Cloud Data Security correlates data classification with network exposure, so an S3 bucket holding PII that is shared with external, unauthorised AWS accounts triggers an alert. This satisfies the stem's requirement for a high-risk finding combining sensitive data with external sharing.

In a VM-Series AWS deployment, the trust interface by default applies Source NAT to traffic leaving toward the untrust side, masking the instances' IPs. Disabling Source NAT on the trust interface preserves the original source IP, allowing security policy to match on workload addresses. This is the standard configuration when the design requires visibility of actual instance IPs for policy and logging.

Behavioral Threat exceptions in Cortex XDR allow administrators to suppress behavioral alerts for specific legitimate applications by scoping to file path, signer, or hash while leaving behavioral threat protection enabled for everything else. This precisely addresses the false-positive scenario without weakening other protection modules, which is exactly what the administrator needs.

APT campaigns pursue highly targeted objectives, focusing on specific intellectual property or geopolitical intelligence rather than broad, opportunistic gain. This deliberate targeting satisfies the stem's requirement for characteristics distinguishing APTs from opportunistic malware, which spreads indiscriminately for financial profit. Such focused intent also explains APTs' prolonged persistence and resource investment.

The Mobile Users component of Prisma Access provides secure internet access for remote users by connecting them through GlobalProtect. It applies security policies, including threat inspection and acceptable use controls, to web traffic from those users. This is the correct component for enforcing policies on remote user traffic in the described scenario.

Decrypting outbound HTTPS for inspection requires the firewall to re-sign traffic with its own certificate. Installing the Palo Alto Networks root CA into the endpoint trust store lets clients validate that certificate silently, preventing browser warnings while enabling inspection.

The Allow List in a Malware profile lets administrators specify files or hashes that should never be blocked, even if they are flagged as malicious. This is the correct way to exclude a specific internally developed tool from blocking while keeping the rest of the profile active. It ensures the tool runs without weakening overall protection.

The Behavioral Threat allow list lets administrators exempt specific executables from behavioral threat detection while leaving the module active for all other processes. By adding the line-of-business application and scoping the relevant behavioral indicators, the administrator suppresses only the known-good activity instead of weakening protection across the endpoint. This is the intended mechanism for tuning false positives without disabling the entire detection engine.

Config Policies in Prisma Cloud are used to define and enforce desired configurations for cloud resources. You can create a policy that requires S3 buckets to have encryption enabled. Prisma Cloud continuously evaluates resources against these policies and alerts on violations. This directly enforces the requirement for encryption at rest by identifying non-compliant buckets. It is the core capability for configuration enforcement.

Excessive XML API calls or script-driven configuration pushes load the management plane directly, since that CPU handles parsing and commit operations rather than dataplane traffic. This satisfies the stem's constraint of sustained 99% management-plane utilisation, distinguishing control-plane processing from forwarding load.

The Vulnerability Protection Profile inspects traffic for exploits such as SQL injection and buffer overflows, blocking them at the Security policy rule. It satisfies the stem's requirement to shield critical database servers from those specific attack signatures.

The inventory table records each managed agent's platform details, letting administrators filter endpoints by operating system type and version. This satisfies the question's requirement for information displayed per managed agent, supporting patch and coverage decisions across heterogeneous fleets.

Inter-zone rules enforce policy between the engineering and finance zones regardless of shared internal subnet addressing, so compromised engineering hosts cannot reach finance systems. Zone-based segmentation is the mechanism that blocks east-west lateral movement the stem requires.

Disabling unnecessary services and closing unused ports reduces the attack surface by eliminating potential entry points for attackers. This aligns with least privilege by ensuring only required services are running, minimizing the exposure of the system. It is a fundamental hardening practice that complements other access controls, making it harder for an attacker to find and exploit vulnerabilities.

The Cloud Identity Engine agent synchronises user and group objects from Microsoft Entra ID into Prisma Access, letting it map identities to traffic logs. This satisfies the no-captive-portal constraint by supplying identity data without inline user authentication.

Prisma Cloud Compute audits Lambda configuration against compliance baselines, flagging overly permissive IAM roles and exposed environment variables. This satisfies the stem's requirement for configuration-level posture assessment of serverless functions, distinct from code or runtime inspection.

The CSPM Compliance Dashboard continuously assesses cloud resource configurations against frameworks including CIS Benchmarks, HIPAA and PCI-DSS, surfacing violations and drift. It directly satisfies the continuous compliance-scanning requirement, whereas runtime protection and CI/CD scanning address different layers.

WildFire's behavioural analysis, covering registry modifications and API calls, is reached by clicking the sample hash within the WildFire portal or the Prisma Access Monitor > WildFire Submissions report, satisfying the requirement to view the detailed report for that specific sample.

An IP-type EDL parses entries strictly as IPv4 addresses, so domain names in the file trigger parsing errors and no entries load, leaving rules with nothing to match. The firewall downloaded the file successfully, ruling out connectivity.

The Prisma Cloud Compute CI/CD scanner plugin inspects images during pipeline execution and fails the build when critical CVEs are detected, preventing vulnerable images from reaching Amazon ECR. This directly satisfies the requirement to block builds containing critical vulnerabilities.

Explicit rules permitting only required traffic between internal zones enforce least privilege at the network layer, which is the core mechanism of micro-segmentation. Without them, lateral movement remains unrestricted, so this element satisfies the stem's requirement for essential Zero Trust segmentation design.

Brute Force sits within Credential Access because it targets credential material directly, satisfying the stem's requirement for techniques mapped to that tactic. Adversaries submit many authentication attempts against accounts to guess valid passwords, distinct from Discovery or Initial Access techniques, which address different adversary goals.

The Compute Defender daemonset runs on every cluster node, giving host-level visibility and enforcement that blocks unauthorised container process execution and file system writes at runtime. This satisfies the requirement for runtime protection across Kubernetes clusters in multiple public clouds.

Prisma Cloud Compute instruments serverless functions by attaching its Lambda layer, which injects the runtime wrapper. That wrapper triggers vulnerability and compliance scanning automatically at invocation, giving continuous assessment without modifying function code or managing separate scanning infrastructure.

LSASS memory dumping maps to OS Credential Dumping (T1003) under the Credential Access tactic, which covers techniques for stealing credentials such as account names and passwords. The stem specifies harvesting credentials, directly satisfying that tactic's definition rather than Execution, Collection or Privilege Escalation.

CSPM continuously scans cloud resources for misconfigurations, such as public storage buckets or overly permissive security groups, and evaluates them against compliance frameworks and custom policies. It provides a centralized view across AWS, Azure, and Google Cloud, enabling teams to detect and remediate posture issues. This is a core capability for configuration assessment in Prisma Cloud.

Modifying user permissions to gain higher-level access maps to Privilege Escalation, the tactic covering adversaries obtaining elevated permissions on a system or network. Prisma Access logs permission changes; the objective of reaching greater access, not initial entry, defines the tactic.

Zone Protection profiles include Port Scan Protection, which detects and blocks TCP port scans, host sweeps, and other reconnaissance activities. By applying a Zone Protection profile with Port Scan Protection enabled to the external-facing zone, the firewall can identify and mitigate port scans targeting internal hosts. This directly addresses the requirement to detect and block TCP port scans.

Behavioral Threat Protection rules can be scoped with exceptions that name specific files or paths. Adding an exception for the administrative script paths keeps the behavioral engine running for all other processes while preventing those trusted scripts from triggering alerts, which satisfies the requirement to suppress only the identified false positives.

Pre-defined exclusions match known applications by signature and standard ports, so a pinned certificate on TCP 8443 escapes them. An explicit No Decrypt rule placed above other rules matches the custom port and destination address directly, guaranteeing the medical portal's traffic bypasses interception regardless of the exclusion list.

Endpoint Management lists every deployed agent with its operational health, connection status and version, letting the administrator audit fleet state centrally. It is the console area purpose-built for agent lifecycle and status visibility, matching the stem's requirement exactly.

Least privilege means granting the minimum access necessary for a user's role. Role-based access control maps permissions to job functions, so an auditor gets read-only access while a preparer gets edit rights only for assigned clients. This directly limits unnecessary access to tax returns and is the most targeted enforcement of the principle in this scenario.

This is correct because DNS tunneling abuses the DNS protocol to encode data in queries and responses, often using port 53. The encoded payload and numerous outbound connections to various IPs are characteristic of DNS tunneling, which can be used for C2 or exfiltration. The use of UDP port 53 further supports this.

Credential Theft Prevention within a URL Filtering profile inspects submitted form data against corporate credential patterns, blocking submission to known phishing sites in real time. This directly satisfies the stem's requirement to stop users typing corporate credentials into phishing websites.

This is the definition of least privilege: users should have only the permissions required to complete their tasks, nothing more. In this scenario, developers should be given deployment-specific permissions rather than full administrative rights. This reduces the attack surface and limits the potential damage from accidental or malicious actions. Implementing least privilege often involves role-based access control and regular reviews of permissions.

East-west rules between internal VLANs must permit only approved applications, not any any, so malware cannot pivot laterally. Enforcing least-privilege application context on every internal segment satisfies the Zero Trust segmentation constraint in the stem.

WildFire submits the unknown sample to cloud sandbox analysis, derives a signature from the observed malicious behaviour, and pushes it to all subscribed Next-Generation Firewalls automatically, satisfying the minutes-scale global blocking requirement without manual signature updates.

Continuous context verification enforces identity, device health and application checks on every request, so access to the financial databases no longer depends on network location. This directly satisfies the stem's requirement for explicit verification rather than implicit trust.

DAG membership is populated by tag-to-IP mappings registered through User-ID. If neither the agent nor the GlobalProtect portal pushes the authenticated user's IP under the exact tag name the DAG filter references, the group stays empty and rules never match.

Cloud Network Security in Prisma Cloud maps network paths and identifies how cloud resources are exposed, including internet-facing entry points and risky connectivity. It complements CSPM by showing not just that a resource is misconfigured but whether that misconfiguration creates reachable exposure. This directly supports the requirement to identify risky network exposure across the three clouds.

Synthetic test monitoring satisfies the remote-location constraint by executing scripted user journeys and application access probes from distributed agents, independent of actual user traffic. This isolates whether degradation originates in the network path, endpoint, or application itself, giving Prisma ADEM the continuous, location-specific performance evidence needed to troubleshoot remote users.

A Vulnerability Protection Exception for that specific threat ID disables the signature's action for the matching traffic, clearing the false positive without weakening the broader security policy. Restricting it to the source or destination IP narrows scope, avoiding blanket exposure.

Data Loss Prevention profiles inspect traffic content against defined data patterns and can block or alert on sensitive data transfers. By attaching the DLP profile to the security rule that permits the cloud storage traffic, Prisma Access inspects uploads and enforces the block. This meets the requirement to use existing sensitive data patterns while allowing sanctioned services.

Application-level encryption with organization-managed keys ensures ePHI remains unreadable even if the device is lost, because the ciphertext cannot be decrypted without the organization's keys. This satisfies the requirement to avoid reliance on native device encryption and provides a consistent control across managed desktops and personal mobile devices.

Permitting 'any' in the application field decouples port from protocol, so traffic on 80 and 443 is no longer restricted to sanctioned apps. Attackers can tunnel command-and-control or exfiltration over those permitted ports, directly widening the attack surface the policy was meant to constrain.

A BTP exception scoped to both the application hash and the triggered rule ID suppresses only that precise detection, leaving BTP active for every other process and rule. The hash constrains the exception to this line-of-business binary, while the rule ID prevents blanket suppression of the injection technique across the estate.

For SSL decryption without warnings, the firewall uses a forward trust certificate to generate certificates for decrypted sites. User devices must trust the CA that signed the forward trust certificate. Therefore, the forward trust certificate (with private key) is installed on the firewall, and its CA certificate is installed in the trusted root store on user devices. This ensures seamless decryption.

This rule explicitly permits only HTTP and HTTPS traffic to the web server while denying all other traffic, which meets the requirement. It is a best practice to define a default-deny stance for all other traffic to minimize the attack surface. This approach ensures that only the necessary services are exposed to the internet, reducing the risk of exploitation.

Group Policy Object software installation deploys the Cortex XDR agent MSI to domain-joined Windows endpoints automatically at startup or logon, satisfying enterprise-scale distribution. It leverages existing Active Directory infrastructure, requiring no manual intervention per host, unlike scripted or console-based push methods.

Searching the WildFire Portal or firewall submission logs by SHA-256 hash queries historical verdicts and analysis reports already stored for the enterprise, returning results immediately without resubmitting the file. This satisfies the stem's requirement for the fastest way to check whether the hash was previously analysed.

Parameterized queries separate SQL code from user-supplied data, so special characters in parameters are treated as data rather than executable syntax. Strict input validation further rejects unexpected content before it reaches the database layer. Together they eliminate the structural weakness that allows injection, directly addressing the root cause rather than merely hiding symptoms observed in the logs.

Scanning internal subnets for open ports and active hosts is reconnaissance activity, which MITRE ATT&CK classifies under the Discovery tactic. Discovery covers techniques adversaries use to gain knowledge about the target environment before attempting exploitation.

Incident response playbooks in Cortex XDR can be configured to include manual approval steps before certain actions, such as closing an incident. By modifying the playbook to require analyst approval for closure, the team ensures that high-severity alerts are reviewed by a human before being resolved, directly meeting the requirement to prevent automatic resolution without review.

The Anti-Tamper password, generated in the Cortex XDR management console, authorises local command-line disabling of the agent. It satisfies the stem's requirement for local authorisation during troubleshooting, because the endpoint validates this password against its stored hash, permitting the temporary stop without a management-console connection.

The Endpoint Management inventory shows each managed endpoint with its connection status and last communication time. A status of Connected with a recent Last Seen timestamp confirms the agent has registered, is checking in with the console, and is therefore receiving policy updates as expected.

App-ID classifies traffic by application regardless of port or protocol, letting internal segmentation firewalls enforce granular allow/deny rules between tiers sharing a zone. This satisfies the requirement for precise intra-zone access control that port-based policies cannot achieve.

Windows Security Event Log polling lets the User-ID Agent parse domain controller logon events (4624) to build IP-to-user mappings, satisfying PAN-OS's requirement for server-based monitoring without an agent on every endpoint. It is a documented User-ID source alongside the User-ID Agent, so it qualifies as a valid mapping method.

RADIUS server profiles live under Device > Server Profiles > RADIUS, where the administrator defines the server address, shared secret and authentication port. This satisfies the stem's requirement to configure RADIUS authentication for firewall administrators, since Panorama pushes the profile to managed firewalls for administrator login.

Once stolen credentials are captured, the attacker redeems them by authenticating as the legitimate user, which is the use-of-valid-accounts phase. This grants initial access or enables lateral movement, immediately following the credential capture described in the exercise.

The Causality view in Cortex XDR provides a graphical representation of the process execution chain, showing parent-child relationships, network connections, and file operations associated with an alert. This allows the analyst to trace back to the initial infection vector and identify lateral movement or additional compromised endpoints, directly addressing the need to understand the attack's scope and origin.

Each cloud account or subscription must be onboarded into Prisma Cloud and identified with the correct provider type so the platform applies the appropriate API calls and policy set. Registration links the credential to the account and enables resource discovery. Without this step, the read-only credential alone would not be associated with a monitored scope, and posture findings would not be generated for that environment.

Agent self-protection is designed specifically to prevent users and processes from stopping the agent service, killing its processes, or unloading its kernel components. Enabling this setting on Linux endpoints ensures that even users with elevated privileges cannot easily disable protection. This directly addresses the requirement to prevent tampering with the agent on the servers.

Execution covers techniques that run adversary-controlled code on a victim host, including command and scripting interpreters such as PowerShell and signed binaries like Certutil used for payload download. These living-off-the-land behaviours fall under Execution, not Persistence, Discovery or Command and Control.

Even in Layer 2 mode, the firewall enforces Security policy between zones. If the Layer 2 interfaces are not bound to zones, no interzone rule can match the traffic, and the default deny silently drops it. Assigning interfaces to zones and creating the appropriate allow rules restores forwarding.

A Vulnerability Protection profile inspects traffic for known exploits and attack patterns, such as buffer overflows and SQL injection attempts, and can block or alert on them. In this scenario, the web server receives HTTP traffic that must be inspected for malicious requests, so applying a Vulnerability Protection profile to the permitting Security policy rule is the correct choice to detect and block those attacks.

External Dynamic Lists (EDLs) allow the firewall to dynamically import lists of IP addresses, URLs, or domains from an external source. By subscribing to a threat intelligence feed that provides malicious URLs and IPs, the firewall can automatically block access to those sites. This meets the requirement for a dynamically updated list.

Actions on Objectives is the kill chain's final phase, covering the attacker's actual goal after establishing persistence — here, encrypting files for ransom on the internal file server. It sits after Command and Control in the Lockheed Martin sequence.

Prolonged, stealthy presence directly satisfies the APT defining constraint: adversaries maintain persistence over months or years, evading detection through low-and-slow techniques rather than rapid exploitation. This extended dwell time enables continuous intelligence gathering and lateral movement, distinguishing APTs from opportunistic attacks that complete quickly.

Isolation limits the spread of an incident and is a classic containment action. Disabling the switch port severs network communication while preserving the host for forensic analysis. This activity occurs after detection and analysis, during containment, so it is correctly placed in the requested phases.

Source NAT with Dynamic IP and Port translates the source IP address of outbound traffic and uses port translation to allow many internal hosts to share a single public IP address. This is the correct choice because it enables the entire 10.1.1.0/24 subnet to access the internet through 203.0.113.5 by multiplexing sessions using different source ports.

Remote Response provides live terminal access, script execution and file retrieval on the endpoint itself, satisfying the requirement for real-time artefact collection rather than post-incident log review. It operates through the Cortex XDR agent, so no reimaging or offline imaging is needed.