Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) Cybersecurity-Practitioner Questions 301–309 | Page 5/5

301

MCQmedium

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

A.Create a rule that allows any application, and apply a Vulnerability Protection profile to block proxy exploits.

B.Create a rule that allows web-browsing and ssl, and apply a Data Filtering profile to block proxy credentials.

C.Create a rule that allows web-browsing only, and apply a File Blocking profile to block proxy downloads.

D.Create a rule that allows web-browsing and ssl, and apply a URL Filtering profile that blocks proxy-avoidance-and-anonymizers category.

AnswerD

Allowing web-browsing and ssl applications permits normal internet access, while applying a URL Filtering profile that blocks the proxy-avoidance-and-anonymizers category prevents users from accessing proxy sites and anonymizers. This meets the requirement to allow any website but block bypass methods. The URL Filtering profile inspects the requested URLs and blocks those categorized as proxy or anonymizer.

Why this answer

To allow general internet access while blocking proxy sites and anonymizers, the administrator should allow web-browsing and ssl applications and apply a URL Filtering profile that blocks the proxy-avoidance-and-anonymizers category. This ensures users can access legitimate websites but cannot use proxies to bypass security controls. The other options either restrict HTTPS access or do not block proxy sites.

Exam trap

The trap here is assuming that File Blocking or Data Filtering profiles can block proxy sites, when in fact URL Filtering is the correct feature for controlling access to web categories like proxy-avoidance-and-anonymizers.

Full explanation →

302

MCQhard

A security team uses Prisma Cloud to monitor a Google Cloud organization. An auditor asks for evidence that no Cloud Storage bucket in any project allows anonymous public access, and the team must also be alerted within minutes whenever a new bucket is created with public access enabled. Which combination of Prisma Cloud features should the team rely on?

A.A Prisma Cloud policy that detects publicly accessible Cloud Storage buckets, with an alert rule that notifies the security team when the policy is violated.

B.A Prisma Cloud compliance report for a Google Cloud benchmark, plus a scheduled email digest delivered to the security team once per day.

C.A Prisma Cloud Compute host vulnerability scan of the Google Cloud virtual machines that host the applications writing to the buckets.

D.Prisma Cloud cloud discovery to inventory all buckets, plus a saved search the team reviews manually each shift to spot new public buckets.

AnswerA

A policy encodes the condition being checked, in this case public access on a Cloud Storage bucket, and an alert rule attached to that policy generates notification when the condition is detected. Prisma Cloud evaluates resource configuration continuously, so a newly created public bucket is flagged and the team is notified shortly after creation, satisfying both the evidence and the rapid alerting requirements.

Why this answer

Detecting public access on Cloud Storage buckets and notifying the team quickly requires a policy that expresses the configuration condition plus an alert rule that fires on violation. Because Prisma Cloud continuously evaluates resource configuration against policies, a newly created public bucket is detected and generates a notification within the evaluation cycle. Benchmark reports and manual review provide evidence or visibility but not the minutes-level alerting the scenario requires.

Exam trap

The trap here is assuming that a compliance benchmark report or a saved search provides alerting, when those produce findings and query results rather than timely notifications on new violations.

Full explanation →

303

MCQeasy

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

A.The Palo Alto Networks Next-Generation Firewall data plane

B.The Cortex XSOAR incident playbook engine

C.The external MFA server or Identity Provider integrated via RADIUS or SAML

D.The local administrator database on Panorama

AnswerC

The external MFA server or Identity Provider holds the second-factor secret and validates the push token, returning the authentication result to Prisma Access. Prisma Access itself acts as the service provider or gateway, not the token validator, so the integrated RADIUS or SAML component satisfies the stem.

Why this answer

The secondary MFA token (such as a push notification) is validated by the external MFA server or Identity Provider integrated via RADIUS or SAML. Prisma Access delegates the MFA challenge and validation to the configured authentication service, not to the firewall data plane or Panorama local database.

Exam trap

Cybersecurity-Practitioner often tests the misconception that the firewall or Panorama itself validates MFA tokens — candidates must remember that MFA validation is delegated to an external MFA server or IdP via RADIUS or SAML.

How to eliminate wrong answers

Option A is wrong because the Palo Alto Networks Next-Generation Firewall data plane forwards packets and applies security policy — it does not validate MFA tokens. Option B is wrong because Cortex XSOAR is a security orchestration and automation platform for incident response, not an authentication component. Option D is wrong because the local administrator database on Panorama stores local admin credentials but does not validate secondary MFA tokens such as push notifications; MFA validation requires an external MFA server or IdP.

Full explanation →

304

Multi-Selectmedium

An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)

Select 2 answers

A.Restricting administrator access profiles to specific Device Groups matching the engineer's assigned region

B.Using a single un-audited shared administrator account for multiple SOC team members

C.Creating custom Admin Role Profiles that restrict users to specific read-only tabs

D.Assigning the built-in superuser role to a Tier-1 helpdesk analyst who only needs to view logs

E.Enabling SAML authentication with dynamic role attribute mapping from an IdP

AnswersB, D

A single shared administrator account removes individual attribution and accountability, so actions cannot be traced to a person and privileges cannot be scoped per user. This violates least privilege, which requires each SOC member to hold only the access their role needs.

Why this answer

Option B is correct because a single un-audited shared administrator account for multiple SOC team members violates least privilege: it prevents individual accountability and non-repudiation, forces all users to inherit the same (typically broad) privileges, and makes it impossible to scope rights to each person's actual duties. Option D is correct because assigning the built-in superuser role to a Tier-1 helpdesk analyst who only needs to view logs grants far more privilege than required—superuser has full read/write access across the entire Palo Alto Networks environment, whereas a read-only role limited to logs would satisfy the task. Option A does not violate least privilege; restricting admin access profiles to specific Device Groups matching an engineer's region is a proper scoping control.

Option C is also compliant, since custom Admin Role Profiles limited to specific read-only tabs enforce least privilege. Option E is not a violation either; SAML authentication with dynamic role attribute mapping from an IdP supports least privilege by automatically assigning appropriately scoped roles based on identity attributes.

Exam trap

Cybersecurity-Practitioner often tests whether candidates recognize that least privilege is about both scope (superuser vs. read-only) and accountability (shared vs. individual accounts) — the trap is focusing only on role scope and missing the shared-account violation.

Full explanation →

305

Multi-Selecteasy

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

Select 2 answers

A.Antivirus Profile

B.Quality of Service (QoS) Profile

C.Zone Protection Profile

D.Network Access Profile

E.URL Filtering Profile

AnswersA, E

The Antivirus profile scans traffic streams for malware signatures and exploits, satisfying the requirement to inspect outbound HTTP/HTTPS for malicious content. Attached to the Security policy rule, it enforces threat detection inline, complementing URL filtering to deliver comprehensive protection.

Why this answer

The Antivirus Profile (A) is correct because it scans the allowed web traffic for malware, viruses, and exploit signatures, which directly addresses the requirement to inspect HTTP/HTTPS content for malicious payloads. The URL Filtering Profile (E) is correct because it inspects the requested URLs and categorizes them, allowing the firewall to block or alert on malicious, phishing, or otherwise risky web destinations. Together, these two profiles provide the layered content inspection needed for comprehensive outbound web protection.

The QoS Profile (B) only manages bandwidth prioritization and does not inspect traffic for threats. The Zone Protection Profile (C) defends against flood and reconnaissance attacks at the ingress zone level, not against malicious URLs or malware in web sessions. The Network Access Profile (D) is not a valid security profile for content inspection and does not provide URL or malware filtering.

Exam trap

The trap here is confusing zone-level defenses (Zone Protection Profile) or traffic-shaping tools (QoS) with the content-inspection profiles that are actually attached to a Security policy rule; candidates must remember that URL Filtering and Antivirus are the two profiles that address malicious URLs and malware in allowed web traffic.

Full explanation →

306

MCQeasy

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

A.Quality of Service (QoS)

B.User-ID

C.GlobalProtect

D.WildFire

AnswerA

Quality of Service classifies and prioritises traffic, guaranteeing critical server flows preferential treatment over guest internet traffic during congestion. It enforces bandwidth allocation and queueing policies, directly satisfying the requirement to keep critical traffic ahead of lower-priority guest usage.

Why this answer

Quality of Service (QoS) is the feature that classifies, prioritizes, and schedules traffic to ensure critical server traffic is treated preferentially over guest internet traffic during congestion. QoS policies on Palo Alto Networks firewalls use QoS profiles and QoS policy rules to assign traffic to classes and apply bandwidth guarantees, limits, and priority (real-time, high, medium, low).

Exam trap

The trap is confusing security or identity features (User-ID, GlobalProtect, WildFire) with traffic-management features; only QoS provides prioritization and bandwidth control during congestion.

How to eliminate wrong answers

Option B is wrong because User-ID maps IP addresses to users for policy enforcement and logging; it does not prioritize or shape traffic. Option C is wrong because GlobalProtect is a remote-access VPN solution for secure user connectivity, not a traffic-prioritization mechanism. Option D is wrong because WildFire is a cloud-based malware analysis and threat prevention service; it inspects files for malicious behavior but does not manage bandwidth or congestion.

Full explanation →

307

MCQmedium

A security engineer manages an AWS environment where developers frequently create S3 buckets. The engineer must ensure that every new bucket is encrypted with SSE-KMS using a customer managed key, and that unencrypted buckets are remediated automatically within minutes without developer action. Which Prisma Cloud capability should be configured to meet this requirement?

A.A Prisma Cloud auto-remediation policy that applies the required SSE-KMS default encryption configuration to non-compliant S3 buckets when the policy is triggered.

B.A Prisma Cloud alert rule scoped to S3 bucket resources that triggers a webhook to a ticketing system whenever default encryption is missing.

C.A Prisma Cloud compliance standard built from the CIS AWS Foundations Benchmark, with email notifications sent to the security team when a bucket lacks encryption.

D.A Prisma Cloud saved search that lists all S3 buckets without default encryption so the engineer can run a script against the results each morning.

AnswerA

Auto-remediation policies in Prisma Cloud can apply corrective configuration to a non-compliant resource automatically, which is exactly what is needed to enable default SSE-KMS encryption on buckets that lack it. Because the action is executed by the platform rather than by a developer or ticket queue, remediation occurs within the policy evaluation cycle, satisfying the minutes-level and no-developer-action constraints.

Why this answer

The requirement combines a specific desired state, SSE-KMS with a customer managed key, with automatic correction and no human involvement. A Prisma Cloud auto-remediation policy is the only listed capability that both detects the non-compliant bucket configuration and applies the corrective encryption setting itself, so unencrypted buckets are fixed within the platform's evaluation cycle rather than waiting on notifications, tickets, or manual scripts.

Exam trap

The trap here is treating a compliance finding or alert notification as if it were remediation, when reporting and alerting leave the resource in its non-compliant state.

Full explanation →

308

Multi-Selecthard

A security team is building a defense-in-depth strategy and wants to reduce the likelihood that a compromised user account can be used to move laterally across the environment. Which two controls most directly limit lateral movement using stolen credentials? (Choose two.)

Select 2 answers

A.Segmenting the network and restricting east-west traffic between zones

B.Deploying a signature-based antivirus agent on all workstations

C.Publishing an acceptable use policy for employees to sign annually

D.Enforcing least privilege so accounts hold only the permissions required for their role

E.Increasing password complexity requirements for all user accounts

AnswersA, D

Network segmentation with strict east-west controls prevents a compromised host from freely reaching other systems even if valid credentials are available. It enforces boundaries that must be crossed, creating opportunities for detection and containment. Combined with least privilege, segmentation directly limits how far an attacker can pivot after stealing an account, which is the goal described in the scenario.

Why this answer

Lateral movement with stolen credentials is best constrained by reducing what those credentials can reach and do. Least privilege ensures a compromised account carries minimal authority, while network segmentation restricts which systems an authenticated session can contact. Together they force an attacker to cross enforced boundaries and operate with limited permissions, creating detection opportunities and containing the breach.

Controls that only address malware files or user policy do not directly limit credential-based pivoting.

Exam trap

The trap here is treating any security control as equally relevant to lateral movement, when only authorization limits and network boundaries actually constrain a stolen credential.

Full explanation →

309

MCQeasy

A SOC analyst is triaging alerts in Cortex XDR and notices a high volume of false positives from a custom detection rule that triggers on legitimate administrative activity. The analyst wants to reduce noise without disabling the rule entirely. Which action should the analyst take?

A.Disable the rule and rely on other detections.

B.Modify the rule's severity to low.

C.Add a suppression rule to ignore alerts from the administrative user account.

D.Create an exception in the rule to exclude the specific administrative activity.

AnswerD

Creating an exception allows the analyst to exclude known legitimate administrative activities from triggering the rule, reducing false positives while still detecting malicious behavior. Exceptions can be based on specific criteria such as process name, command-line arguments, or user accounts. This approach maintains the rule's effectiveness for other scenarios and is a standard practice in SOC operations to tune detections.

Why this answer

Creating an exception for the specific administrative activity allows the rule to continue detecting malicious behavior while filtering out known benign actions. This fine-tuning reduces false positives without compromising detection capabilities, aligning with best practices in SOC operations for alert management.

Exam trap

The trap here is opting to disable or broadly suppress the rule, which would eliminate detection of true threats, rather than applying a targeted exception.

Full explanation →

Certified Cybersecurity Practitioner (Cybersecurity-Practitioner) (Cybersecurity-Practitioner) — Questions 301–309