Cybersecurity Fundamentals

A security engineer is designing a defense-in-depth strategy for a new web application. The engineer wants to implement controls that map to the principle of least privilege and reduce the attack surface. Which two of the following controls best align with these goals? (Choose two.)

A small accounting firm stores client tax returns on a file server. The partners ask which control most directly enforces the principle of least privilege for employees accessing those returns. Which control should be implemented?

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

A security administrator is implementing the principle of least privilege for a group of developers who need to deploy code to a production server. Currently, they have full administrative rights. The administrator wants to restrict their access to only what is necessary for deployment. Which of the following best describes the principle of least privilege?

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The organization has a internal certificate authority (CA) and wants to ensure that users do not receive certificate warnings. Which action must the engineer take?

A security engineer is configuring a firewall to protect an internal web server that hosts a public-facing application. The engineer wants to ensure that only HTTP and HTTPS traffic from the internet can reach the server, while all other traffic is blocked. The firewall is a stateful inspection firewall. Which of the following rules should be implemented to achieve this requirement?

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

A security analyst notices that an internal web server is receiving a high volume of requests containing long strings of special characters in URL parameters, and the application log shows database error messages being returned to clients. The analyst suspects the application is vulnerable to an injection attack. Which practice most directly prevents this class of vulnerability in the application code?

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

An organization is reviewing its threat intelligence feeds and security posture to prepare for advanced persistent threat (APT) campaigns. Which TWO characteristics are typically associated with advanced persistent threats? (Choose two)

A financial services company is updating its incident response plan. The security manager wants to ensure the plan covers activities that occur during the containment, eradication, and recovery phases. Which two activities belong to those phases? (Choose two.)

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

A software company wants to verify that its internally developed payment module does not introduce exploitable weaknesses before release. The security team will perform a review that examines the compiled application's behavior while it runs, without access to the original source code. Which activity matches this requirement?

A retail company wants to reduce the risk that a terminated employee's account is still usable hours after departure. Which identity and access management practice best addresses this specific risk?

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

A security analyst is investigating a suspected data exfiltration incident. The analyst observes that outbound network traffic from a compromised host is encrypted and destined for an IP address that has no reverse DNS record and is not associated with any known business service. The traffic volume is steady but low, mimicking normal user browsing patterns. Which of the following BEST describes the technique being used by the attacker?

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

A hospital's IT team is classifying the sensitivity of different data types to prioritize protection efforts. They label patient treatment records, real-time heart-rate monitor telemetry, and publicly published visitor parking maps. Which data classification scheme correctly reflects the risk-based handling these assets require?

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

A security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. They want to ensure that all traffic is logged at session start and session end for auditing purposes. Which setting should they configure in the security policy?

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

A security operations team is implementing zero trust network access (ZTNA) principles across the enterprise. According to foundational Zero Trust architecture guidelines, which THREE tenets must be enforced? (Choose three)

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

A security operations center (SOC) receives an alert that a user's workstation is communicating with a known command-and-control (C2) server. The analyst checks the firewall logs and sees that the traffic is allowed because it uses TCP port 443 and the destination IP is not on any blocklist. The analyst wants to quickly determine whether this is a false positive or a real compromise. Which of the following is the MOST appropriate next step to validate the alert?

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

A company's risk management framework requires multi-factor authentication (MFA) for all remote access connections. The organization utilizes GlobalProtect for remote workers. Where should the administrator configure the authentication profile to enforce MFA during the GlobalProtect connection phase?

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

A hospital must ensure that electronic protected health information remains available and unaltered even if a ransomware incident encrypts production servers. The security officer is selecting a recovery control that provides a guaranteed, isolated copy of data that cannot be modified by an attacker who has compromised the production domain. Which control best meets this requirement?

A security administrator is implementing a defense-in-depth strategy for the organization's endpoint devices. The administrator wants to ensure that even if malware bypasses the antivirus software, it cannot execute unauthorized code. Which of the following security controls BEST addresses this requirement?

A security administrator is configuring a next-generation firewall to inspect encrypted traffic. The organization uses a internal certificate authority (CA) to issue certificates for all internal servers. The administrator wants to ensure that the firewall can decrypt and inspect TLS traffic to these internal servers without generating certificate errors on client devices. What should the administrator do?

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

A security administrator is configuring a Palo Alto Networks firewall to block malicious downloads. They want to ensure that when a user attempts to download a file that is identified as malicious by WildFire, the download is blocked and the user is notified. Which two actions must the administrator take? (Choose two.)

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

A security analyst is investigating a potential data breach and needs to determine the integrity of a critical file that may have been tampered with. The analyst has a known-good hash of the file from a trusted backup. Which of the following should the analyst do to verify the file's integrity?

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

A security operations center analyst is reviewing an alert about an internal workstation that resolved a domain name belonging to a known malware command-and-control (C2) server. The analyst wants to confirm whether the workstation actually established a connection to that C2 server, rather than just performing a DNS lookup. Which data source should the analyst correlate with the DNS logs to make this determination?

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

A security team is building a defense-in-depth strategy and wants to reduce the likelihood that a compromised user account can be used to move laterally across the environment. Which two controls most directly limit lateral movement using stolen credentials? (Choose two.)