Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) (Cybersecurity-Practitioner) — Questions 76–150

App-ID identifies applications by analyzing traffic characteristics, signatures, and behavior rather than relying on port numbers. This allows the analyst to determine the actual application generating the outbound traffic even if it uses a non-standard port, which is common with command-and-control communications. It is the correct tool for application identification in this scenario.

A Layer 3 interface with an IP address, routed to an Untrust zone, terminates the untrusted ISP segment and enforces zone-based policy between external and internal networks. Tap and virtual wire modes lack IP addressing or routing, so they cannot satisfy the requirement to connect and route to an untrusted ISP router.

The support dump subcommand packages agent logs, configuration and diagnostic data into an archive for offline analysis, satisfying the stem's requirement for a local troubleshooting step. It captures endpoint state without needing a remote console, which is exactly what on-box diagnostics demand.

Administrator activity and authentication logs capture login timestamps and source IPs, providing the audit trail that demonstrates administrative accountability and change control. Auditors can attribute configuration changes to named administrators, satisfying the framework's accountability requirement.

Cortex XDR manages FileVault, Apple's native full-disk encryption technology for macOS, reporting on its enablement and status across endpoints. This satisfies the stem's requirement for the underlying native macOS mechanism rather than a third-party encryption product.

Least-privilege principles grant users only the minimum access required for their job functions, directly satisfying the stem's constraint that permissions match specific roles. Unlike broader models such as role-based access alone, least privilege continuously restricts excess rights, reducing attack surface and limiting lateral movement if credentials are compromised.

The Untrust zone is the conventional designation for interfaces connected to the public internet, where traffic is treated as hostile by default. Security policy rules must explicitly permit traffic from Untrust to Trust or DMZ, which enforces a default-deny posture and supports least-privilege access control.

HTTP and Telnet transmit credentials and session data in cleartext, exposing the management plane to interception. Replacing them with HTTPS and SSH enforces encrypted administrative access, directly hardening the firewall's management interface against credential theft.

Searching for the scheduled task name across all endpoints helps identify other compromised hosts, determining the scope of the attack. This is a proactive step to contain a potentially widespread incident. Cortex XDR's threat hunting capabilities allow such queries, which can reveal lateral movement or additional infections.

This is correct because isolating the endpoint prevents lateral movement and further compromise. The attacker used wmic.exe for remote process creation, indicating an active threat. Isolation is a standard containment step to stop the spread while allowing further investigation.

Dynamic application security testing exercises a running application, sending crafted inputs and observing responses, which matches reviewing compiled behavior without source. It can reveal runtime issues such as injection flaws and authentication bypasses in the deployed module. This aligns precisely with the stated constraint of no source access and live execution.

The risk is a lingering active account after termination. Automating deprovisioning ties account state to the authoritative HR event, so disabling occurs within minutes rather than waiting for a manual ticket. This directly closes the window an ex-employee could exploit and is the most effective control for the stated risk.

Clientless VPN acts as a reverse proxy in front of legacy applications, terminating SAML authentication at the firewall and brokering access, so the legacy apps need no federation support. This satisfies the constraint of enforcing authentication without modifying the legacy applications.

A baseline Device Control policy that blocks removable media enforces the organization's requirement to prevent data exfiltration through unauthorized USB storage. This default-deny posture ensures that any device not explicitly approved is denied access. It is a necessary step because without a blocking policy, removable media would remain usable and the exfiltration risk would persist.

NIST SP 800-30 defines risk as a function of the likelihood that a threat exploits a vulnerability and the adverse impact of that event. Evaluating threat likelihood alongside impact magnitude lets the team rank the database vulnerability and prioritise mitigation accordingly.

Authentication is the IAM function that verifies the user's credentials, such as the SAML assertion presented during the Okta-to-Prisma Cloud single sign-on exchange. It confirms identity before authorisation evaluates permissions, so it is the component validating credentials in this integration.

Prisma Cloud IAM Security delivers CIEM by continuously analysing effective permissions across AWS, Azure and GCP, detecting excessive entitlements and unused identities, then generating least-privilege remediation. This directly satisfies the stem's requirement to discover, analyse and remediate excessive permissions across multi-cloud environments.

The Causality View in Cortex XDR visually maps the chain of processes, including parent-child relationships and injected code, and automatically tags observed behaviors with relevant MITRE ATT&CK techniques. This directly answers the analyst's need to understand the process lineage and adversary technique mapping in a single view, enabling rapid triage of the behavioral alert.

The attacker is using encrypted HTTPS traffic to a suspicious IP with no reverse DNS, which is a classic sign of a covert C2 channel. The low, steady traffic mimics normal browsing to evade detection, and the lack of association with business services indicates malicious intent. This technique allows attackers to maintain persistent access and exfiltrate data while blending in with legitimate traffic.

WildFire only receives files when SSL decryption exposes the HTTPS payload and the security rule attaches a WildFire Analysis profile forwarding that file type. Both conditions satisfy the stem's requirement for cloud analysis of the malware binary.

The heartbeat interval is set through the Agent Settings profile's Communication parameters, which govern agent-to-management-server check-in behaviour. This satisfies the stem's requirement to configure check-in frequency centrally, letting the administrator define the interval once and apply it across targeted endpoints rather than editing each agent locally.

Patient treatment records contain protected health information and heart-rate telemetry is live clinical data; both demand the highest handling controls, so Restricted is appropriate. Visitor parking maps are intentionally published for public consumption, so Public is correct. This risk-based split matches the sensitivity and regulatory obligations of each asset, making this the accurate classification.

Process Execution History captures the parent process and full command-line arguments for each process. For a PowerShell script, this reveals whether it was launched by a scheduled task (e.g., parent process svchost.exe or taskeng.exe) or interactively (e.g., parent process explorer.exe). It also shows the script block or command line, providing direct evidence of origin and execution context. This is the most direct feature for the analyst's goal.

Captive Portal intercepts unmapped source IPs and presents a web login, then relays credentials to Microsoft Entra ID via LDAP or SAML for validation. On success, the firewall writes the IP-to-username mapping into its User-ID table, satisfying the requirement to map addresses for identity-based policy enforcement.

Zone Protection profiles with SYN Flood protection activate SYN cookies or random-drop once configured thresholds are exceeded, absorbing spoofed half-open connections without exhausting the firewall's session table. Applied at the ingress zone, this directly counters the randomised-source SYN scan by validating handshakes before allocating state, satisfying the volumetric reconnaissance constraint in the stem.

Exploit protection monitors vulnerable processes for techniques like heap spraying, return-oriented programming, and stack pivoting, then terminates or blocks the offending action. This mitigates exploitation of unpatched software, directly hardening endpoints against the techniques attackers use to gain code execution.

Isolation mode blocks all network traffic except the Cortex XDR management channel and essential DNS/DHCP, preserving agent communication and name resolution while cutting lateral movement paths. This default allowlist satisfies the requirement to isolate the endpoint immediately without severing the agent's control link.

BIOC denotes a Behavioural Indicator of Compromise: a detection built from observed patterns of malicious behaviour, such as process or registry activity, rather than static signatures or file hashes. Cortex XDR uses these behavioural analytics to identify threats that evade signature-based detection.

Exceptions in Cortex XDR are module-specific and can target Behavioral Threat protection, allowing a defined process to bypass that module's blocking actions. Specifying the process path scopes the exception narrowly, preserving protection for other executables while stopping the repeated termination of the legitimate administrative tool.

Custom BIOC rules match behavioural patterns such as command-line strings across endpoints, generating alerts when the specified activity is observed. This satisfies the requirement for a behavioural alert spanning multiple endpoints, which static IOC matching cannot express.

Agent tamper protection prevents users—even those with local administrator privileges—from stopping, uninstalling, or modifying the Cortex XDR agent. When enabled, the agent guards its own processes, services, and files against tampering. This directly addresses the requirement to keep the agent running regardless of user actions through the system tray or other local controls.

Automated remediation directly satisfies the requirement to correct misconfigured resources from within the CSPM console. Prisma Cloud applies API-driven fixes to supported resource types without manual intervention, closing the configuration gap that generated the alert.

Defenders are required to enforce runtime policies in Kubernetes. A DaemonSet ensures a Defender pod runs on each node, providing visibility and enforcement for all containers. Without Defenders, Prisma Cloud Compute cannot monitor or block runtime behavior. This is a prerequisite for enforcing policies like preventing root containers or host path mounts.

Exploit Protection monitors for memory-corruption and code-injection techniques, including attempts by an unsigned or non-Microsoft process to allocate executable memory inside another process. This cross-process memory manipulation is a classic injection indicator, so the detection originates from the Exploit Protection module, which is specifically engineered to intercept these low-level exploitation behaviors on the endpoint.

The Console manages policies and displays results. A Defender deployed as a DaemonSet ensures that every node in the GKE cluster has a Defender pod running, which can inspect containers on that node and enforce runtime policies. This is the standard deployment model for Prisma Cloud Compute in Kubernetes. It provides visibility and protection at the node level, meeting the requirement to inspect images and enforce runtime policies.

SYN Flood Protection within a Zone Protection profile allows you to set thresholds for half-open connections, including per-source IP limits. Configuring this feature with a threshold of 100 per second for a single source IP directly addresses the requirement. It activates SYN cookies and other mitigations when the threshold is exceeded, protecting the firewall and internal hosts from SYN flood attacks.

The process details view provides critical information such as the hash, digital signature status, and full command line. An invalid signature on a file in System32 is a strong indicator of masquerading. Comparing the hash to known good versions and examining the command line can confirm if the process is legitimate or malicious.

A URL Filtering profile defines the categories to block or allow, and attaching it to the relevant Security policy rule enforces that profile for matching traffic. This blocks gambling and adult categories while permitting all other business-related sites.

A critical BIOC match signals active malicious behaviour, such as data exfiltration, rather than a mere static file detection. Cortex XDR's automated isolation triggers on high-severity behavioural alerts, so this satisfies the stem's requirement for an indicator that warrants immediate containment without analyst intervention.

Remote Services covers logon to remote hosts via SMB administrative shares, RDP and similar protocols, enabling an adversary to move between systems using valid accounts. MITRE ATT&CK places it squarely under Lateral Movement, unlike Execution or Credential Access tactics.

A no-decrypt rule placed above the decrypt rule matches the banking portal first and lets the TLS session pass through untouched, so certificate pinning is not broken. The firewall does not present its own certificate, so the client's pinned certificate remains valid. This is the intended mechanism for exempting pinned or privacy-sensitive destinations from inspection.

Identity analytics in Cortex XDR correlates user behavior and access patterns to detect anomalies such as impossible travel or credential misuse. It can identify compromised credentials by analyzing authentication events across multiple sources, even without endpoint malware, helping to pinpoint the source of the credential theft.

Branch-to-branch traffic is routed into Prisma Access, where the Cloud Security Processing Node applies security policy and inspection within the cloud infrastructure. This satisfies the requirement that inter-branch flows are inspected without backhauling through a physical data centre.

Panorama's Log Viewer consolidates firewall Traffic and Threat logs, letting the analyst filter by source IP to trace every session from the compromised host across 30 days, with applications, bytes transferred and correlated threat entries in one explorer view. This satisfies the forensic requirement for a single consolidated session view.

App-ID identifies applications regardless of port, protocol, or encryption, so it enforces the actual application rather than the port. By creating Security policy rules that allow only the necessary applications, the administrator ensures that even if a non-standard port is used, only sanctioned applications are permitted. This directly reduces the attack surface by preventing unknown or unwanted applications from traversing the firewall.

Zero Trust identity requires MFA combined with continuous, risk-based adaptive validation, re-evaluating each session rather than trusting a one-time login. This satisfies the stem's demand for fundamental identity practices, enforcing ongoing verification instead of static, perimeter-based trust.

Admission Control in Prisma Cloud Compute intercepts Kubernetes API requests to create pods and enforces policies that can block deployments based on image reputation, vulnerability status, or custom rules. It can prevent unapproved images from running by rejecting the admission request. This directly meets the requirement to allow only approved images.

ADEM continuously measures hop-by-hop path performance between branch users and SaaS applications, exposing latency, jitter and packet loss that ordinary traffic logs cannot. This directly satisfies the requirement to analyse end-to-end path performance for the slow SaaS application.

LDAP is a supported authentication server profile type in PAN-OS, letting the firewall query directory credentials directly. It satisfies the stem's requirement for an external identity provider server type configurable natively, alongside RADIUS, TACACS+, Kerberos, and SAML.

Trusted Images is a Prisma Cloud Compute feature that allows you to define a list of trusted image registries or specific images. When combined with Admission Control, it ensures that only images from trusted sources are admitted. This is a key part of enforcing approved images. Without Trusted Images, Admission Control might not have the necessary criteria to distinguish approved from unapproved images.

Encrypted HTTPS payloads remain opaque to Data Filtering profiles, so sensitive source code or cardholder data can leave the network without inspection. This directly satisfies the stem's constraint: no decryption policy on the firewall means content-based controls cannot identify or block exfiltration over TLS.

Assuming breach removes implicit trust and forces explicit verification of identity, device and context at every access request. This satisfies Zero Trust's core requirement that no session is trusted by default, regardless of network location.

This is correct because the first step in incident response is to validate the alert by gathering evidence. The suspicious process path and network connection warrant deeper analysis to determine if it is malicious. Collecting the hash, parent process, and connection details helps confirm the threat before taking containment actions.

Security Profiles are the grouped inspection modules attached to a policy rule, covering antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, data filtering and WildFire analysis. They define what content inspection applies once the rule matches traffic.

Palo Alto Networks firewalls include a built-in Brute Force Protection feature for the management interface. Located under Device > Setup > Management, it allows administrators to set the number of failed login attempts (threshold) and the duration to block the source IP. This feature automatically blocks the IP address after the threshold is exceeded, providing native protection against brute force attacks on management access.

Malware often names itself after legitimate system processes to avoid suspicion. The location /tmp/kworker and parent bash are strong indicators of compromise. The outbound DNS queries to an unapproved domain suggest command-and-control or data exfiltration. This is a classic masquerading technique.

When return packets arrive on an interface different from the one used for the outbound direction, the firewall may not find the session and can drop the traffic. Allowing asymmetric routing by relaxing strict TCP sequence checking and keeping both paths through the same firewall restores session handling for this scenario.

The Console is the central management and reporting interface for Prisma Cloud Compute. Runtime events such as host filesystem writes are reported by the Defender and surfaced in the Console with context including the container image, container name, and host node. This is the correct place to correlate the alert to the image and node.

AutoFocus aggregates threat intelligence and correlates indicators with actor TTPs, letting the analyst research threats targeting their sector. It provides the contextual hunting data required, unlike raw firewall logs or vulnerability scans, satisfying the exposure-assessment and TTP-research constraint.

Apple macOS endpoints are covered by a dedicated Cortex XDR agent build, supporting both Intel and Apple silicon architectures. This satisfies the question's requirement for an officially supported deployment platform, as macOS appears in Palo Alto Networks' documented supported operating systems list alongside Windows and Linux.

Cortex XDR agents are built to operate autonomously, enforcing the last-applied policy set and using locally stored threat intelligence while offline. This ensures endpoints retain protection during network outages or service disruptions. Once the connection is restored, the agent synchronizes any queued events and receives updated policies and content, so protection is continuous rather than dependent on live connectivity.

WildFire executes suspicious files in a cloud sandbox, observing static properties and dynamic runtime behaviour to identify malicious intent without prior signatures. This detects unknown zero-day malware, satisfying the stem's requirement for file-based threat analysis.

HIP profiles collect endpoint posture data such as patch level, disk encryption and management status, which Security policy then matches against zone and posture criteria. This blocks authenticated BYOD devices lacking compliant posture from reaching the sensitive database zone, enforcing Zero Trust.

Azure Standard Load Balancer uses flow symmetry, so return traffic from backend VMs bypasses the firewall unless source NAT rewrites the source IP. Enabling SNAT on VM-Series policies forces return traffic back through the active firewall, resolving the asymmetry constraint.

Zone Protection Profiles include flood protection that enforces packet-rate thresholds for ICMP, UDP, and other protocols, dropping excess traffic before it reaches the zone. This mitigates volumetric layer 3 and layer 4 floods against the internal network.

Registry Run keys (T1547.001) execute automatically at user logon, satisfying the adversary's need to retain access across restarts. MITRE ATT&CK classifies such autostart mechanisms under the Persistence tactic, which covers any technique enabling an attacker to keep foothold after system reboots, credential changes or other interruptions.

Valid accounts map to the Persistence tactic, while modifying group memberships to gain higher rights maps to Privilege Escalation. These are two distinct MITRE ATT&CK tactics, so the pairing of Persistence and Privilege Escalation accurately reflects both observed phases.

Checking whether the exploit protection module is enabled in the assigned policy and whether the server OS is supported directly addresses common causes of non-enforcement. Policy settings can be inadvertently left disabled, and certain OS versions may not support all modules, so this verification is the logical first diagnostic step.

Client-side encryption with customer-managed keys stored outside the provider's infrastructure ensures the cloud provider only handles ciphertext and cannot decrypt data. This directly satisfies the requirement that the provider cannot access plaintext, while still allowing the company to store data in the cloud.

The Incident Investigation view in Cortex XDR aggregates all related events and alerts for a given incident, including process, file, registry, and network activity. It provides a unified timeline and context, allowing the analyst to see the full scope of the attack without manually correlating disparate logs.

Configuring a Remote Network with local internet breakout allows internet-bound traffic from branch users to go directly to the internet from the Prisma Access location, rather than being backhauled to the corporate data center. This reduces latency and improves performance for SaaS and internet applications, meeting the requirement to avoid routing all internet traffic through the corporate network.

QoS classification only takes effect once enabled on the egress Layer 3 interface itself; security-rule profiles merely tag traffic. Without interface-level guaranteed and maximum bandwidth limits, packets bypass the QoS class engine and transmit best-effort, so VoIP still queues behind bulk data during peak hours.

CloudFormation and ARM templates are the native infrastructure-as-code services for AWS and Azure respectively, and bootstrap packages supply the initial configuration and licensing during instance launch. Together they satisfy the requirement for officially supported automated provisioning in public cloud environments.

Human operators pursuing a defined objective, adapting custom tooling and pacing exfiltration slowly, is the axis separating APTs from commodity campaigns, which rely on reusable, indiscriminate payloads. This satisfies the stem's custom C2, low-and-slow exfiltration and living-off-the-land indicators.

Separating tiers into distinct zones creates clear enforcement points, and permitting only required interzone flows enforces least privilege. This limits lateral movement because a compromised host in one tier cannot freely reach other tiers. It is a foundational segmentation practice.