Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) (Cybersecurity-Practitioner) — Questions 151–225

Enabling both Log at Session Start and Log at Session End ensures that a log entry is generated when the session begins and when it ends. This provides a complete audit trail for the session, capturing the start time and the end time along with other details. This is the correct configuration for full auditing.

Enabling container visibility on the Linux host agent allows the single host-level agent to observe container processes, file activity, and network connections at runtime without deploying an agent inside each container. This meets the requirement by extending host telemetry into container namespaces, so malicious behavior inside containers is detected and attributed to the host agent that already covers the server.

WildFire analyses files submitted after execution, so an unknown file runs before any verdict exists. Cortex XDR then applies the retroactive verdict once WildFire returns it, which explains why the agent did not block on first encounter. This satisfies the stem's constraint: analysis succeeded, yet local blocking occurred only afterwards.

Prisma Cloud allows analysts to dismiss alerts or apply policy suppression on specific resources, which stops those resources from generating new alerts while the policy remains active. If a bucket was dismissed or suppressed, it will no longer appear as non-compliant in subsequent scans, matching the team's observation. Reviewing dismissal and suppression settings is the correct way to determine why alerts disappeared without any remediation or policy deletion.

User-ID maps IP addresses to authenticated user identities, letting policy match on user rather than IP alone. Integrating the User-ID agent or Panorama mapping with the firewall supplies that identity data, which is precisely what Least Privilege Access under Zero Trust demands.

App-ID classifies each recognised session to a specific application and attaches its risk rating on a 1–5 scale, letting analysts prioritise threats. This risk level is one of the two data points the engine returns per session.

Behavioral Threat exceptions allow granular control over specific behaviors for designated processes. By specifying the legitimate process and the injection behavior, the administrator permits only that activity while other malicious behaviors remain blocked. This minimizes the security impact compared to broader exclusions.

The WildFire Submission Log records every file hash submitted for cloud analysis, whether triggered automatically by the agent or manually by an analyst. In this scenario, verifying whether the suspicious PDF hash appears in the submission log confirms if WildFire received it. It shows verdict, submission source, and analysis status, making it the authoritative place to validate cloud detonation for this incident.

The agent includes a dedicated communication service that establishes and maintains the channel to the Cortex XDR server, typically over TCP port 443 or a configured alternative. This service handles registration, heartbeat, policy retrieval, and alert forwarding. Verifying that this service is running and able to reach the server is the correct way to confirm active agent-to-server connectivity.

A module-scoped exception using both path and signer narrows the allowance to the specific legacy application while keeping Behavioral Threat protection active for everything else. Confirming policy application ensures the exception is in effect before the application runs, which is required to prevent another termination.

Collection covers gathering data and staging it, including compressing and encrypting files locally before exfiltration. The attacker's local compression and encryption of sensitive files is staging behaviour, which ATT&CK places under Collection rather than Exfiltration.

Registry modification events provide the persistence and configuration-change telemetry Cortex XDR needs, capturing keys and values written by processes on Windows endpoints. This satisfies the stem's requirement for comprehensive endpoint visibility, since registry activity reveals autorun, service and policy tampering that file and network data alone would miss.

SYN flood protection is a native flood defence within Zone Protection profiles, activating per-zone SYN cookie verification once configured thresholds are exceeded. It satisfies the stem's requirement for a flood mechanism by absorbing half-open TCP connection attempts, dropping spoofed or excessive SYN packets before they exhaust the firewall's session table.

This rule correctly specifies the source zone as Untrust (internet) and destination zone as DMZ (where the web server resides). It allows only the web-browsing and ssl applications, which correspond to HTTP and HTTPS. All other traffic will be denied by the implicit deny rule. This is the standard best practice for publishing a web server.

A BGP session stuck in Connect with SYNs sent but no SYN-ACK indicates the firewall's own policy is dropping inbound TCP/179. Verifying a Security policy rule permitting application bgp from the external zone to the to-firewall zone confirms control-plane traffic is allowed.

Setting the specific technique to 'Report' logs the exploit attempt without terminating the process, so the crashing plugin keeps running while telemetry reveals whether that rule caused the crash. Other techniques stay enforced, satisfying the requirement to troubleshoot without disabling exploit protection entirely.

GlobalProtect app is the endpoint client that authenticates users and builds the tunnel to Prisma Access security processing nodes. It satisfies the mobile user requirement, unlike agents such as Cortex XDR, which handle endpoint detection rather than remote-access connectivity.

Administrator role mapping binds PAN-OS admin accounts to roles derived from LDAP group attributes, so privileges follow dynamic directory membership rather than static local accounts. This enforces least privilege centrally and satisfies the requirement to tie administrator access to external directory-managed groups.

Excluding known benign processes or users from a BIOC rule reduces false positives while keeping the rule active for malicious activity. This is a standard tuning approach in Cortex XDR, allowing the SOC to maintain detection coverage for true threats without being overwhelmed by noise from legitimate administrative tools or trusted applications.

This combination directly targets the action of reading process memory and specifies lsass.exe as the target. It precisely detects credential dumping tools that use memory reads to extract credentials. The action field captures the low-level operation, while the target process name ensures focus on the critical security process.

A Defender DaemonSet must be deployed on each node to monitor and enforce runtime security policies for containers. The Defender intercepts system calls and enforces rules such as preventing unauthorized binary execution. Without the Defender, Prisma Cloud Compute cannot apply runtime protection. This is a fundamental requirement for container runtime security in Kubernetes.

CSPM > Alerts surfaces the failed IAM policy check as a misconfiguration finding, where RQL filters by AWS IAM service and built-in auto-remediation applies the fix directly, satisfying the requirement to view and remediate this specific S3 permission issue.

Verifying explicitly means every access request is authenticated and authorised using all available signals — identity, device health, location and behaviour — before granting resource access, satisfying the Zero Trust requirement that no actor is trusted by default based on network location alone.

Prisma Cloud supports onboarding an entire AWS organization so that member accounts are discovered and monitored, including accounts added later. Using the organization-level integration, often deployed through a CloudFormation stack set, establishes the required role and trust across accounts with minimal per-account work. This satisfies the need for automatic coverage of current and future accounts in the organization.

Geneve encapsulation lets the GWLB forward packets to the VM-Series while preserving the original flow, so the firewall inspects traffic transparently and returns it via the same tunnel. This satisfies the no-destination-NAT constraint, unlike templates relying on NAT for return-path routing.

Cloud provider audit logs record the identity, IAM role and API action behind every resource change. Ingesting them into Prisma Cloud lets investigators reconstruct who modified what and when, satisfying the forensic attribution requirement during post-incident analysis.

Active/Active distributes traffic across both firewalls simultaneously while session synchronisation replicates session tables, so either device can process existing flows after a failure. This satisfies the stem's requirement that both firewalls actively process traffic with real-time session state sharing.

A BTP exception rule scoped by specific criteria and file attributes allows the legitimate application to run while keeping behavioural protection active for everything else. This directly resolves the false block without disabling the protection module entirely.

Defence in depth layers independent controls across the attack surface; combining perimeter threat prevention, internal segmentation, Cortex XDR endpoint protection and MFA covers network, host and identity planes. A single firewall tier alone would not satisfy the principle's requirement for multiple overlapping layers.

Continue is a configurable URL Filtering action that displays a warning page requiring the user to acknowledge before proceeding, letting organisations permit access to a category while enforcing awareness. It sits alongside block, alert and override actions assignable per URL category.

The behavioral threat protection module in Cortex XDR supports response actions such as blocking and terminating a process when suspicious behavior is detected. Selecting the block-and-terminate action enables automatic termination and quarantine of the associated file, fulfilling the requirement for hands-free response to known ransomware behavior.

Prisma Cloud Compute admission control evaluates workloads before they are admitted to the cluster and can block deployment based on vulnerability thresholds. By scoping the rule to the production namespace, the engineer prevents vulnerable images from running there while leaving the staging namespace unaffected. This matches both requirements: deny in production, allow in staging for testing, without relying on post-deployment runtime enforcement.

Palo Alto Networks firewalls resolve application dependencies at commit; a rule referencing an application whose dependencies are absent triggers a warning. Explicitly adding the dependent application and its required dependencies lets the policy validate and commit successfully.

This is correct because the traffic is allowed due to lack of blocklist, but threat intelligence can reveal if the IP/domain is associated with malicious activity. By correlating with external threat feeds, the analyst can quickly assess whether the communication is likely malicious or benign, which is a standard validation step in incident response.

SQL injection inserts malicious SQL statements through unsanitised input fields, exploiting the application layer rather than the network layer. Next-generation firewall security profiles inspect HTTP payloads and match injection signatures, satisfying the stem's requirement for an application-layer attack mitigated by such profiles.

GlobalProtect authentication is enforced through Authentication Profiles bound to the portal and gateway, so referencing a profile linked to an MFA provider triggers the second factor during the connection phase. This satisfies the framework's requirement that MFA apply to all remote access connections.

Behavioural Threat Protection is a core Cortex XDR agent module, analysing process and file behaviour locally to detect malicious activity. It runs alongside other agent modules, satisfying the stem's requirement for genuine core architecture components.

Process Execution History in Cortex XDR logs detailed process information, including command-line arguments, parent-child relationships, and user context, enabling analysts to reconstruct the attack chain. It captures process creation events and links them to other activities like network connections and file operations, providing a comprehensive view for investigation. This is essential for determining if a process is malicious based on its behavior.

Forwarding unknown files to the WildFire cloud satisfies the zero-day constraint: signatures cannot detect never-before-seen malware, so the file must be executed in a sandbox to observe malicious behaviour. WildFire returns a verdict, enabling enforcement against threats with no existing signature.

The show session all command queries the firewall's session table, returning live sessions with source and destination ports, NAT-translated addresses and the security rule each flow matched, which is exactly the real-time detail the administrator requires.

Prisma Cloud Data Security focuses on data discovery, classification and protection across cloud object stores, using data security posture management to locate sensitive data such as PII and financial records in AWS S3 and similar services, rather than workload or network protection.

Cortex XDR agents can communicate directly with the cloud service over the internet, allowing them to receive signature and policy updates regardless of network location. This direct connectivity ensures roaming endpoints stay current without requiring VPN or proxy access to internal infrastructure, meeting the stated requirement.

Cortex XDR BIOC rules allow analysts to define custom behavioral logic based on process, command line, and other telemetry fields. The rule editor supports pattern matching for command-line arguments like -EncodedCommand and allows exclusions for specific users or processes. This directly fulfills the requirement to detect the behavior while excluding the legitimate service account, providing granular control over alerting.

SYN Flood Protection is part of Zone Protection and allows the administrator to set thresholds for half-open connections per source and per destination. It can activate randomly early drop or SYN cookies to mitigate SYN floods. This directly meets the requirement to limit half-open connections from a single source IP to a specific destination.

Grouping related rules into logical categories keeps the rulebase ordered and readable, so administrators can audit, review and troubleshoot policies efficiently. This supports the recommended top-down organisation, reducing shadowed or redundant rules as the policy set grows.

Security processing nodes are the data plane components of Prisma Access that perform threat inspection, URL filtering, and other security functions. When remote users connect via GlobalProtect, their traffic is directed to the nearest security processing node, where policies are enforced. This ensures that web traffic is inspected and malicious sites are blocked according to the configured security profiles. This is the correct component for the required inspection.

DNS Security streams DNS queries to Palo Alto's cloud service, where machine learning models inspect query patterns, domain characteristics and DGA behaviour, identifying newly registered and C2 domains that signature-based detection cannot yet recognise because no known signature exists.

A Security profile group bundles multiple profiles so they are applied together to matching traffic. Antivirus detects malware, Anti-Spyware detects command-and-control and spyware activity, and Vulnerability Protection detects exploits against known vulnerabilities. Attaching this group to the rule provides the layered inspection the administrator requires for outbound web traffic.

Immutable storage with retention locks prevents modification or deletion for a defined period, and separating credentials removes the backup from the compromised domain's control. An offline or air-gapped copy is unreachable by an attacker operating within production. This combination directly satisfies the requirement for a guaranteed, isolated, unalterable copy that survives a ransomware event affecting production servers.

CSPM scans cloud resources for misconfigurations, including publicly accessible storage buckets, overly permissive security groups, and unencrypted databases. It uses cloud provider APIs to inventory resources and apply policy checks. This is a fundamental function of CSPM, allowing security teams to remediate risks before they are exploited. It does not provide runtime protection but is essential for maintaining a secure cloud posture.

Application whitelisting allows only approved applications to execute, blocking all others by default. This directly prevents unauthorized code from running, even if malware bypasses antivirus. It enforces a strict execution policy, making it a robust defense-in-depth control. It is particularly effective against zero-day exploits and advanced malware.

Process execution logs in Cortex XDR capture detailed information about process creation, including command lines, parent-child relationships, and file executions. By querying these logs, the analyst can see if the downloaded file was executed and what processes it spawned, directly answering the investigation question.

For SSL decryption, the firewall acts as a man-in-the-middle, presenting its own certificate to clients. To avoid errors, clients must trust the firewall's CA. Using the internal CA to issue the firewall's decryption certificate and distributing that CA to clients ensures trust. This allows the firewall to decrypt and re-encrypt traffic transparently, and clients will not see certificate warnings.

EDR with behavioral analytics and process lineage tracking detects malicious activity by observing anomalous process behavior, such as a productivity application spawning PowerShell or WMI. This approach is effective against LOLBins and fileless attacks because it focuses on actions rather than static file signatures, providing the visibility the SOC needs.

Panorama provides centralised policy management, pushing rules and software updates to VM-Series firewalls across AWS, Azure, GCP and on-premises from one console, satisfying the single-pane-of-glass requirement. It manages the full firewall estate regardless of cloud provider, unlike native tools such as AWS Firewall Manager or Microsoft Entra ID, which scope to their own platforms.

Isolating the endpoint via Cortex XDR immediately cuts network communication while keeping the endpoint powered on and the agent active, preserving volatile memory and process state for forensic analysis. This containment step prevents lateral movement and further command-and-control traffic without destroying evidence, aligning with standard incident response containment procedures.

Without a route directing branch traffic into the tunnel interface, the IPsec tunnel carries no traffic. BGP or static routes satisfy the mandatory routing requirement, ensuring branch subnets are advertised to and reachable through the Prisma Access mobile gateway.

Causality View in Cortex XDR visually maps the sequence of process executions, showing parent-child relationships and command-line arguments across endpoints involved in an incident. This directly answers the analyst's need to trace how WINWORD.EXE led to powershell.exe and what arguments were used, enabling rapid triage of the attack chain.

WMI is a legitimate Windows administration utility abused to run commands and payloads on local and remote hosts, so the adversary behaviour is running malicious code. MITRE ATT&CK categorises this under Execution, which covers techniques that result in code running on a system.

Embedded machine learning classifiers run inference locally on the endpoint, so detection of the abused administrative tool occurs without cloud connectivity. This satisfies the stem's offline constraint, since Local Analysis in Cortex XDR relies on on-device behavioural models rather than signature lookups or cloud queries.

Assuming breach drives microsegmentation and least-privilege inspection of all traffic, shrinking the blast radius of any compromised asset. This satisfies the Zero Trust requirement that no implicit trust be granted based on network location alone.

App-ID permits only explicitly required business applications, directly enforcing least privilege for outbound traffic, while WildFire and Anti-Spyware profiles inspect those permitted flows to detect exfiltration payloads. This satisfies the stem's constraint by combining granular allow-listing with content inspection rather than blanket port-based rules.

The asset inventory in Prisma Cloud allows you to filter resources by attributes such as public access. For S3 buckets, you can filter by 'Public' or specific ACL settings to quickly list all publicly accessible buckets. This provides a centralized view and is the most direct method to identify the buckets in question. It also allows for exporting the list for further analysis.

A File Blocking Profile attached to the Security rule inspects the application layer, letting the administrator permit document viewing while denying upload actions within the same application family, achieving granular control that a blanket application block cannot.

Prisma Cloud Compute delivers runtime defence, vulnerability management and compliance across containers, hosts and serverless functions, satisfying the stem's workload-protection requirement. Unlike the cloud security posture modules that assess configuration, Compute enforces runtime protection at the workload layer, covering every platform named in the question.

T1218: Signed Binary Proxy Execution describes the abuse of legitimate signed binaries to execute malicious code, bypassing security controls that trust signed executables. Common examples include rundll32.exe, regsvr32.exe, and mshta.exe. In this scenario, the attacker used a signed binary to proxy execution, which aligns directly with this technique. It is a form of defense evasion.

A Malware Profile exception scoped to the executable's SHA-256 hash allows only that exact binary, unlike folder or wildcard exclusions that could be abused by substituted files. This preserves maximum security while unblocking the development tool.

Anti-Tamper Protection enforces kernel-level restrictions that block non-administrative users from stopping, modifying or removing the Cortex XDR agent, directly satisfying the stem's requirement that end users cannot tamper with or uninstall it. It also prevents unauthorised service termination, ensuring continuous telemetry and policy enforcement on each workstation.

The incident view in Cortex XDR groups related alerts into a single incident, providing a unified timeline and causality chain that spans multiple endpoints. This allows the analyst to see the common root cause, such as a phishing email or a shared vulnerability, and prioritize remediation based on the incident's scope and severity.

Application Control in Cortex XDR enforces execution policies based on allow lists or block lists of applications. Configuring an allow list of approved applications with block and report actions ensures that only approved software runs and that attempts to launch anything else are prevented and logged. This directly satisfies the requirement to restrict execution to approved applications on the macOS laptops.

APTs deliberately use living-off-the-land binaries, encrypted channels and sandbox evasion to bypass antivirus, EDR and network monitoring. This evasion capability sustains undetected access over months, matching the classic APT lifecycle trait of remaining hidden from standard security tooling.

A malware profile in Cortex XDR allows administrators to define hash-based blocklists that prevent execution of files matching the specified SHA-256 hash, independent of file name or path changes. This directly addresses the requirement to block a known-malicious executable regardless of renaming, since hash matching is content-based rather than name-based.

Vishing is voice-based phishing, where an attacker uses a phone call to manipulate a victim into disclosing sensitive information or performing an action. The caller impersonating IT support and requesting a one-time passcode fits this definition precisely, because the deception is delivered verbally over the telephone rather than through email or a website.

Monitor > Logs > Threat records each Threat Prevention block with its signature ID, severity, and the associated packet capture, directly satisfying the need to verify which signature dropped the response. Filtering by the destination website and C2 category isolates the exact entry, confirming whether the callback verdict was a false positive.

The DNS proxy forwards queries to upstream resolvers, so invalid or missing primary and secondary external DNS server addresses cause resolution failures for internal clients. Verifying these configured IPs confirms the proxy has reachable forwarders for external domain lookups.