troubleshooting

A Cortex XDR administrator needs to prevent users on managed Windows endpoints from launching an unauthorized peer-to-peer file-sharing tool. The administrator wants the Cortex XDR agent to block the executable and record the attempt in the console without relying on file hash values that change with every update. Which Cortex XDR agent capability should the administrator configure?

An organization wants to prevent users on managed Windows endpoints from writing data to unapproved USB mass storage devices while still allowing approved encrypted USB drives to be used. Which Cortex XDR capability should the administrator configure to meet this requirement?

A cloud security engineer is configuring Prisma Cloud to monitor AWS accounts for compliance with the CIS AWS Foundations Benchmark. The engineer wants to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should be used to create a policy that triggers an alert for this specific misconfiguration?

A company runs production workloads in Microsoft Azure and wants Prisma Cloud to continuously assess those subscriptions against its security policies without storing long-lived Azure credentials in the platform. Which onboarding method should the administrator use?

An administrator is reviewing Prisma Cloud Data Security reports and identifies several high-risk findings related to AWS S3 buckets. Which THREE conditions or findings would trigger an alert in Prisma Cloud Data Security? (Choose three)

A security engineer is deploying a VM-Series firewall in AWS to inspect outbound traffic from a VPC. The design requires that the firewall preserve the original source IP of the instances so that security policy can be applied based on actual workload addresses. The engineer configures the firewall's untrust interface with an Elastic IP and sets the trust interface to use a static private address. When testing, the instances' traffic appears to originate from the firewall's trust IP rather than the instances' own IPs. Which configuration change should the engineer make to preserve the original source IP?

A Cortex XDR administrator notices that a specific Windows endpoint repeatedly triggers behavioral threat alerts for a legitimate internally developed accounting application. The administrator wants the application to run without generating further behavioral alerts while keeping all other protection modules active. What is the MOST appropriate action?

An incident response team is analyzing an Advanced Persistent Threat (APT) group that has successfully infiltrated a corporate network. Which THREE characteristics are typically associated with APT campaigns compared to opportunistic malware? (Choose three)

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The organization wants to ensure that users' web traffic is inspected for threats and that acceptable use policies are enforced. Which Prisma Access component is responsible for applying security policies to web traffic from remote users?

An organization wants to inspect encrypted outbound HTTPS traffic to detect malware without causing certificate warnings on user workstations. Which component must be installed on the client endpoints to achieve this?

A Cortex XDR administrator is configuring a Malware profile to prevent the execution of known malicious files. The administrator wants the agent to block files based on hash reputation from WildFire and local analysis, but also wants to allow a specific internally developed tool that is sometimes flagged as a false positive. Which Cortex XDR feature should the administrator use to exclude the tool from being blocked while keeping the rest of the Malware profile active?

A security administrator is configuring a Cortex XDR agent policy for a group of Windows workstations that run a proprietary line-of-business application. The application frequently triggers behavioral threat alerts because it spawns command interpreters and writes to system directories. The administrator wants to suppress these known-good alerts without disabling behavioral threat protection for the rest of the endpoint. What should the administrator configure?

An administrator is using Prisma Cloud to monitor a multi-cloud environment. They need to ensure that any Amazon S3 bucket containing sensitive data is encrypted at rest. Which Prisma Cloud capability should be used to continuously enforce this requirement?

An administrator notices that the firewall's management plane CPU utilization is consistently at 99%. Which THREE factors or troubleshooting steps should the administrator investigate? (Choose three)

An administrator wants to ensure that critical database servers are protected against vulnerability exploits, SQL injections, and buffer overflows. Which security profile must be applied to the relevant Security policy rule to provide this protection?

Which TWO pieces of information are displayed in the Cortex XDR Endpoint Management inventory table for a managed agent? (Choose two)

An organization is deploying an explicit Zero Trust micro-segmentation strategy using Palo Alto Networks Next-Generation Firewalls. They want to ensure that if a workstation is compromised in the engineering VLAN, lateral movement to the financial VLAN is blocked, even if both belong to internal corporate subnets. Which firewall feature must be configured to achieve this?

A security engineer is designing a defense-in-depth strategy for a new web application. The engineer wants to implement controls that map to the principle of least privilege and reduce the attack surface. Which two of the following controls best align with these goals? (Choose two.)

An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?

An administrator is configuring Prisma Cloud Compute to protect serverless functions in AWS Lambda. Which THREE features are supported for serverless function protection? (Choose three)

Which Prisma Cloud feature continuously scans cloud resource configurations to detect compliance violations against frameworks such as CIS Benchmarks, HIPAA, and PCI-DSS?

An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?

An administrator configures an external dynamic list (EDL) pointing to a URL hosting a plain-text list of malicious IP addresses. The firewall successfully downloads the EDL, but security rules referencing this EDL fail to block traffic to those IPs. Inspection reveals that the EDL entries are showing as 'parsing error' in the system logs. What is the most likely cause of this issue?

An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?

An organization is building a Zero Trust Architecture and deploying Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation. Which THREE design elements are essential for a successful Zero Trust segmentation deployment? (Choose three)

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

An organization running Kubernetes clusters across multiple public clouds wants to enforce runtime protection that blocks unauthorized container process execution and file system writes. Which Prisma Cloud component performs this enforcement?

An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance. The administrator wants to detect and block TCP port scans targeting the internal network from external sources. Which feature should the administrator configure to achieve this?

A Cortex XDR administrator is tuning the Behavioral Threat Protection module because several legitimate administrative scripts are generating false positives on managed endpoints. The administrator wants to keep the protection active while suppressing alerts only for the specific script paths involved, without disabling the module globally. What is the correct approach?

An administrator configures a decryption exclusion based on the 'Pre-defined SSL Decryption Exclusions' list. However, an internal audit reveals that a specific sensitive medical portal is still being intercepted and decrypted. The portal uses certificate pinning and a non-standard port (TCP 8443). How can the administrator ensure this specific traffic is never decrypted?

Where in the Cortex XDR management console can an administrator view the operational health, connection status, and version of all deployed agents?

A small accounting firm stores client tax returns on a file server. The partners ask which control most directly enforces the principle of least privilege for employees accessing those returns. Which control should be implemented?

A SOC analyst is reviewing a Palo Alto Networks firewall traffic log and notices a large number of outbound connections to various IP addresses on port 53. The connections are using UDP and the payload appears to contain encoded data. Which type of malicious activity is most likely occurring?

An enterprise wants to mitigate the risk of credential theft attacks where users type their corporate credentials into known phishing websites. Which Palo Alto Networks feature provides real-time protection against corporate credential phishing?

A security administrator is implementing the principle of least privilege for a group of developers who need to deploy code to a production server. Currently, they have full administrative rights. The administrator wants to restrict their access to only what is necessary for deployment. Which of the following best describes the principle of least privilege?

A security architect is designing a Zero Trust network segmentation model using Palo Alto Networks Next-Generation Firewalls. To prevent lateral movement of malware across internal VLANs, which operational rule must be strictly enforced?

During an incident response investigation, a security analyst identifies a novel malware sample that evaded traditional signature-based detection. The security team needs to ensure that the firewall automatically blocks this exact malware variant globally across all deployed Next-Generation Firewalls within minutes without manual signature updates. Which platform component provides this capability?

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

An administrator configures a dynamic address group (DAG) based on User-ID tags, but security rules referencing this DAG fail to match traffic from users who have successfully authenticated via GlobalProtect. What is the most likely root cause?

A security architect is designing a Prisma Cloud deployment to protect workloads across AWS, Azure, and Google Cloud. The architect must ensure that Prisma Cloud can detect misconfigurations in cloud resources and identify risky network exposure. Which TWO capabilities should the architect enable? (Choose two.)

Which TWO metrics or features are provided by Prisma Autonomous DEM (ADEM) to troubleshoot remote user application performance issues? (Choose two)

A network administrator is troubleshooting why an internal application is unable to communicate with an external API over a non-standard TCP port. The firewall's security policy allows the IP addresses and port, but traffic is being dropped by threat prevention. Upon checking logs, the administrator sees a threat ID associated with a vulnerability signature. What is the most appropriate way to resolve a false positive safely?

An organization uses Prisma Access for secure internet access and wants to prevent users from uploading sensitive documents to unsanctioned cloud storage services. The security team already has data patterns defined for sensitive content. Which Prisma Access capability should be configured to inspect uploads and block the transfer?

A healthcare organization must protect the confidentiality of electronic protected health information (ePHI) while allowing clinicians to access it from both managed desktops and personal mobile devices. The security team wants a control that renders ePHI unreadable if a device is lost or stolen, without relying on the device's native encryption. Which control should the team implement?

A security administrator is reviewing security policy rules and notices that many rules use 'any' for the application field. According to security best practices and the attack lifecycle, why is allowing 'any' application dangerous?

An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The organization has a internal certificate authority (CA) and wants to ensure that users do not receive certificate warnings. Which action must the engineer take?

A security engineer is configuring a firewall to protect an internal web server that hosts a public-facing application. The engineer wants to ensure that only HTTP and HTTPS traffic from the internet can reach the server, while all other traffic is blocked. The firewall is a stateful inspection firewall. Which of the following rules should be implemented to achieve this requirement?

Which TWO methods can be utilized to distribute Cortex XDR agent installation packages across an enterprise Windows environment? (Choose two)

A security analyst needs to verify whether a suspicious file hash observed in an external threat report has ever traversed the corporate network or been analyzed by WildFire. Which tool provides the fastest way to search historical WildFire sample analysis results across the entire enterprise?

A security analyst notices that an internal web server is receiving a high volume of requests containing long strings of special characters in URL parameters, and the application log shows database error messages being returned to clients. The analyst suspects the application is vulnerable to an injection attack. Which practice most directly prevents this class of vulnerability in the application code?

During a threat hunting exercise on a Palo Alto Networks firewall, an analyst identifies an adversary scanning internal subnets to map out open ports and active hosts prior to launching an exploit. According to MITRE ATT&CK, which Tactic describes this phase?

A SOC team is using Cortex XDR to investigate a security incident. The analyst notices that a critical alert was automatically resolved without any analyst action. The team wants to ensure that all high-severity alerts are reviewed by a human before closure. Which Cortex XDR configuration should the analyst modify to enforce this requirement?

An administrator needs to temporarily disable the Cortex XDR agent on an endpoint for troubleshooting purposes. What mechanism is used to authorize this action locally using the command line?

A Cortex XDR administrator needs to confirm that a newly deployed Windows endpoint has successfully registered with the management console and is receiving policy updates. Which indicator in the Cortex XDR management console confirms that the endpoint is actively managed?

A security team is designing a defense-in-depth strategy for lateral movement prevention inside the data center. They decide to deploy internal segmentation firewalls (ISFW). Which core Palo Alto Networks capability enables these firewalls to enforce precise access control between different application tiers inside the same network zone?

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

An administrator wants to configure authentication for firewall administrators using RADIUS. Where in the Panorama Web Interface should the administrator configure the RADIUS server profile?

During a simulated phishing exercise, an employee clicks a link in an email that directs them to a credential-harvesting page mimicking the corporate single sign-on portal. According to the common attack lifecycle, which phase immediately follows this successful credential capture?

A SOC analyst is reviewing a Cortex XDR incident involving a suspicious executable that was flagged as malware. The analyst wants to determine the initial infection vector and whether the malware has spread to other endpoints. Which Cortex XDR feature should the analyst use to visualize the process execution chain and related network activity?

A cloud security team is deploying Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and Google Cloud. The team wants to use the Cloud Security Posture Management (CSPM) capabilities and needs to understand which onboarding components are required to enable posture visibility across these providers. (Choose two.)

A security engineer is deploying Cortex XDR agents to a fleet of Linux servers. The engineer wants to prevent users on those servers from terminating the agent process or unloading its kernel module. Which Cortex XDR feature should the engineer enable to protect the agent from tampering on the Linux endpoints?

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

A network security team is deploying a Palo Alto Networks firewall in Layer 2 mode between two internal segments. Users report that ARP resolution works but traffic between the segments is silently discarded. Which configuration element most likely explains why the traffic is dropped despite correct Layer 2 forwarding?

A security administrator is configuring a Palo Alto Networks firewall to protect a web server in a DMZ zone. The administrator wants the firewall to inspect the HTTP traffic for known attack patterns and block malicious requests while allowing legitimate web traffic. Which Security Profile type should the administrator apply to the Security policy rule that permits HTTP traffic to the web server?

A network security engineer is configuring a Palo Alto Networks firewall to prevent users from accessing known malicious websites. The engineer wants to ensure that the firewall blocks access based on a dynamically updated list of malicious URLs and IP addresses. Which feature should be configured to achieve this?

An incident responder is investigating a ransomware outbreak on an internal file server. During the analysis, the responder needs to categorize the attack steps using the cyber kill chain framework. Which THREE phases are part of the standard Lockheed Martin cyber kill chain? (Choose three)

An organization is reviewing its threat intelligence feeds and security posture to prepare for advanced persistent threat (APT) campaigns. Which TWO characteristics are typically associated with advanced persistent threats? (Choose two)

A financial services company is updating its incident response plan. The security manager wants to ensure the plan covers activities that occur during the containment, eradication, and recovery phases. Which two activities belong to those phases? (Choose two.)

A security administrator is configuring a NAT policy on a Palo Alto Networks firewall. Internal users in the 10.1.1.0/24 subnet need to access the internet, but the organization has only a single public IP address, 203.0.113.5, on the untrusted interface. The administrator wants all internal users to share this public IP address when accessing external resources. Which NAT type should the administrator configure?

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

A security analyst is investigating unusual outbound traffic from an internal server. The analyst suspects the server may be communicating with a command-and-control server. Which Palo Alto Networks firewall feature should the analyst use to identify the application generating the traffic, regardless of the port being used?

An administrator needs to configure a Palo Alto Networks firewall interface to connect to an untrusted ISP router. Which interface type is appropriate for this connection?

Which THREE diagnostic or troubleshooting steps can be performed using the 'cytool' command-line utility on a local endpoint? (Choose three)

An enterprise is preparing for an external security audit and needs to ensure compliance with risk management frameworks regarding administrative accountability and change control. Which THREE features on a Palo Alto Networks firewall support these compliance requirements? (Choose three)

An administrator is configuring disk encryption management in Cortex XDR for macOS endpoints. Which underlying native macOS technology does Cortex XDR manage and report on for disk encryption?

A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?

A network administrator is documenting the security zones on a Palo Alto Networks firewall. The firewall has an interface connected to the public internet and another connected to a DMZ hosting a web server. Which zone type should be assigned to the interface facing the public internet to apply the strictest default posture?

Which THREE actions are recommended best practices when securing the management plane of a Palo Alto Networks firewall? (Choose three)

A SOC analyst is reviewing a Cortex XDR alert for a Windows endpoint. The alert indicates that a process has created a scheduled task to run a PowerShell script that downloads a file from a remote server. The analyst wants to gather additional evidence to determine the scope of the compromise. Which TWO of the following actions should the analyst take? (Choose two.)

A SOC analyst is reviewing a Cortex XDR incident involving a compromised endpoint. The analyst observes that the attacker used 'wmic.exe' to create a process on a remote system. Which of the following is the most appropriate immediate containment action?

A software company wants to verify that its internally developed payment module does not introduce exploitable weaknesses before release. The security team will perform a review that examines the compiled application's behavior while it runs, without access to the original source code. Which activity matches this requirement?

A retail company wants to reduce the risk that a terminated employee's account is still usable hours after departure. Which identity and access management practice best addresses this specific risk?

A security architect is designing a Zero Trust network where users must authenticate before accessing any internal application. However, legacy internal applications do not support modern identity federation protocols. Which Palo Alto Networks feature can be deployed to front-end these legacy applications and enforce authentication and access control without modifying the legacy applications?

A Cortex XDR administrator is preparing to enable the Device Control module for a group of Windows endpoints. The organization wants to prevent data exfiltration via removable media while still allowing approved USB storage devices used by the IT team. Which TWO actions must the administrator take to achieve this with Device Control? (Choose two.)

An organization is updating its enterprise risk management framework to align with NIST SP 800-30 guidelines. The security team needs to prioritize mitigation efforts for a newly discovered vulnerability in a critical database. Which combination of factors must the team evaluate to determine the overall risk level?

An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?

Which Palo Alto Networks product provides Cloud Infrastructure Entitlement Management (CIEM) to discover, analyze, and remediate excessive permissions and identities across multi-cloud environments?

A SOC analyst at a company using Cortex XDR notices that several endpoints triggered a behavioral threat alert indicating a process injected code into a remote process and then created a network connection to an unfamiliar external IP. The analyst wants to quickly determine whether this activity is related to a known adversary technique and gather context about the process lineage. Which Cortex XDR feature should the analyst use to view the causal chain and map the activity to MITRE ATT&CK techniques?

A security analyst is investigating a suspected data exfiltration incident. The analyst observes that outbound network traffic from a compromised host is encrypted and destined for an IP address that has no reverse DNS record and is not associated with any known business service. The traffic volume is steady but low, mimicking normal user browsing patterns. Which of the following BEST describes the technique being used by the attacker?

An enterprise environment experiences a sophisticated zero-day attack where a custom malware binary is downloaded via HTTPS. Decryption is enabled on the firewall. For WildFire to successfully analyze this file, which specific configuration requirement must be met within the Security policy and WildFire analysis profile?

An administrator wants to configure the frequency at which the Cortex XDR agent checks in with the management server. Where is this heartbeat interval configured?

A hospital's IT team is classifying the sensitivity of different data types to prioritize protection efforts. They label patient treatment records, real-time heart-rate monitor telemetry, and publicly published visitor parking maps. Which data classification scheme correctly reflects the risk-based handling these assets require?

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script execution on a critical server. The analyst wants to determine the script's origin and whether it was executed interactively or via a scheduled task. Which Cortex XDR feature provides the most direct evidence for this determination?

A security administrator is configuring User-ID to enforce identity-based security policies. Which TWO methods can the Palo Alto Networks firewall use to map IP addresses to usernames in an enterprise environment? (Choose two)

An attacker performs a reconnaissance scan against an enterprise perimeter using TCP SYN packets with randomized source ports and IP addresses to map active hosts. Which Palo Alto Networks feature is specifically designed to mitigate this type of volumetric reconnaissance and connection exhaustion attack at the ingress interface?

A security team is hardening Windows endpoints managed by Cortex XDR and wants to reduce the attack surface exploited by common malware techniques. Which TWO capabilities does the Cortex XDR agent provide to restrict malicious behavior at the endpoint? (Choose two.)

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

An administrator is reviewing endpoint security profiles and notices the term 'BIOC'. What does BIOC stand for in the context of Cortex XDR?

A security analyst is investigating a Windows endpoint where the Cortex XDR agent has blocked a series of suspicious process executions. The analyst wants to permanently allow a legitimate internal administrative tool that the agent keeps terminating, without weakening protection for other executables. Where should the analyst configure this exception in the Cortex XDR management console?

A security analyst wants to configure a custom alert rule in Cortex XDR that triggers whenever a specific command-line pattern is observed across multiple endpoints. Which feature should the analyst use to create this behavioral alert?

A Cortex XDR administrator needs to prevent users on a specific endpoint group from disabling the Cortex XDR agent through the Windows system tray. The administrator wants the agent to remain running and protected even if a user has local administrator rights. Which Cortex XDR agent setting should the administrator configure to achieve this?

Which TWO actions can an administrator perform within the Prisma Cloud Cloud Security Posture Management (CSPM) console to remediate misconfigured cloud resources? (Choose two)

An administrator is configuring Prisma Cloud Compute to protect a Kubernetes cluster. The security team wants to enforce runtime policies that prevent containers from running as root and from mounting sensitive host paths. Which TWO actions must the administrator take to achieve this? (Choose two.)

A security analyst at a manufacturing company is reviewing a Cortex XDR alert on a Windows endpoint. The alert shows that a user-space process with a non-Microsoft digital signature attempted to allocate executable memory in the address space of a signed Microsoft Office process. The analyst wants to confirm which Cortex XDR agent protection module generated this specific detection before writing the incident report. Which protection module is responsible for detecting this behavior?

A cloud security architect is designing a Prisma Cloud Compute deployment to protect containers running in a Kubernetes cluster on Google Kubernetes Engine (GKE). The architect must ensure that the Defender can inspect container images and enforce runtime policies. Which component must be deployed and configured?

A network security engineer is configuring a Palo Alto Networks firewall to protect against SYN flood attacks. The engineer wants to limit the number of half-open connections from a single source IP address to 100 per second. Which feature should be configured to achieve this?

During a Cortex XDR investigation, a SOC analyst notices that a process named 'svchost.exe' is making outbound connections to an IP address in a foreign country. The process path is 'C:\Windows\System32\svchost.exe', but the digital signature is invalid. Which Cortex XDR capability should the analyst use to determine if this is a masquerading attempt?

An administrator wants to prevent users from accessing specific URL categories such as 'gambling' and 'adult' while allowing all other business-related sites. Where should this restriction be configured?

Which THREE conditions or indicators typically trigger an automated endpoint isolation action in Cortex XDR? (Choose three)

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

A security engineer is tuning a Decryption policy on a Palo Alto Networks firewall. The organization must inspect TLS traffic to a sanctioned SaaS application, but must not break sessions to a banking portal that uses certificate pinning. Which action in the Decryption policy rule should be applied to the banking portal traffic to achieve this?

A SOC analyst is investigating a Cortex XDR alert where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects credential theft but finds no evidence of malware on the user's endpoint. Which Cortex XDR capability should the analyst use to identify the source of the credential compromise?

When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?

During an investigation of a compromised endpoint, an analyst needs to trace all network connections initiated by that specific host over the past 30 days, including the applications used, bytes transferred, and threat logs generated. Which Palo Alto Networks logging and visualization tool provides a consolidated session explorer view for this forensic analysis?

A security administrator is reviewing traffic logs on a Palo Alto Networks firewall and notices that a large volume of sessions from the internal network is matching a Security policy rule that permits any application on any port. The administrator wants to reduce the attack surface by ensuring that only specific applications are allowed, even when they use non-standard ports. Which feature should the administrator implement to achieve this?

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

A security operations team is using Prisma Cloud Compute to protect containers in a Kubernetes cluster. They want to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked. Which Prisma Cloud Compute feature should they configure to enforce this requirement?

An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?

An administrator is configuring authentication profiles in PAN-OS to integrate an external identity provider. Which TWO of the following server types can be directly configured as authentication server profiles in a Palo Alto Networks firewall? (Choose two)

An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)

An enterprise is conducting a threat modeling exercise and evaluating risks associated with encrypted traffic. Which THREE security challenges are introduced when SSL/TLS encryption is enabled without decryption policies on the firewall? (Choose three)

An enterprise is implementing a Zero Trust Architecture across its cloud and on-premises environments using Palo Alto Networks Prisma Access and Next-Generation Firewalls. Which THREE of the following principles are core tenets of a Zero Trust Architecture? (Choose three)

A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?

A network security engineer is configuring a security policy rule and notices that the security profile attachment area shows options for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, Data Filtering, and WildFire Analysis. What is the collective term for these configurable security inspection modules?

A security administrator is configuring a Palo Alto Networks firewall to protect against brute force attacks on the management interface. The administrator wants to limit the number of failed login attempts and automatically block the source IP after a threshold is reached. Which configuration should be implemented?

A SOC analyst is investigating a Cortex XDR incident involving a Linux server. The analyst observes that a process named 'kworker' is making outbound DNS queries to a domain that is not in the approved list. The process is running from /tmp/kworker, and its parent process is 'bash'. Which of the following is the most likely explanation?

A security operations analyst is investigating asymmetric routing through a Palo Alto Networks firewall. Return traffic from an external server arrives on a different interface than the interface that forwarded the original outbound request. Which firewall behavior should the analyst expect to see, and what is the appropriate mitigation?

A security analyst is investigating an alert from Prisma Cloud Compute indicating that a container in a Kubernetes cluster attempted to write to the host filesystem. The analyst needs to determine which container image and which node were involved. Which Prisma Cloud Compute component provides this runtime visibility?

A security analyst wants to evaluate the organization's current threat exposure and understand the tactics, techniques, and procedures (TTPs) used by threat actors targeting their specific industry sector. Which Palo Alto Networks tool or feature should the analyst consult for contextual threat hunting and intelligence research?

Which TWO platforms are officially supported for deploying the Cortex XDR Agent? (Choose two)

A Cortex XDR administrator is preparing a response playbook for endpoints that lose contact with the management console. The administrator wants to understand what the agent does locally with threat intelligence and policy enforcement when it cannot reach the Cortex XDR service. Which statement correctly describes the agent's behavior while disconnected?

Which THREE mechanisms are employed by Cortex XDR to protect endpoints against unknown zero-day file-based malware? (Choose three)

An enterprise is deploying a Zero Trust network model where all traffic must be inspected, authenticated, and authorized. An auditor asks how the organization ensures that unmanaged BYOD devices do not connect to sensitive internal database zones even if they authenticate successfully. Which feature combination enforces this posture check?

An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?

An administrator wants to configure Zone Protection Profiles to safeguard the internal network against common layer 2 and layer 3 attacks. Which THREE attack mitigation features are available within a Zone Protection Profile? (Choose three)

An analyst investigating an APT campaign notes that the threat group modified Windows registry run keys to maintain persistence. In the context of MITRE ATT&CK, under which Tactic should this specific technique be documented?

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

A security analyst observes that a Cortex XDR agent on a Windows server is not enforcing exploit protection rules even though the policy is assigned. The agent status shows as connected and other modules are working. Which action should the analyst take first to diagnose the issue?

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

A SOC analyst receives a Cortex XDR alert indicating that a process attempted to write to a protected system directory. The analyst wants to quickly gather all related events, including file modifications, registry changes, and network connections, to understand the full scope. Which Cortex XDR feature should the analyst use?

An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?

An administrator configures a QoS profile to prioritize VoIP traffic over bulk data transfers. However, after applying the profile, VoIP packets are still experiencing high latency during peak business hours. Inspection shows that the QoS profile is applied correctly to the security rules, but the packets are not being placed into the correct QoS class. What is missing in the interface configuration?

Which TWO deployment methods are officially supported for provisioning VM-Series firewalls in public cloud environments like AWS and Azure? (Choose two)

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

A security architect is designing a network segmentation strategy using Palo Alto Networks firewalls. The design must limit lateral movement and enforce least privilege between internal tiers. Which TWO practices support this goal? (Choose two.)

A security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. They want to ensure that all traffic is logged at session start and session end for auditing purposes. Which setting should they configure in the security policy?

A Cortex XDR administrator is rolling out the agent to a set of Linux servers that host a containerized workload. The administrator wants the agent to detect malicious activity occurring inside containers without requiring a separate agent deployment per container. Which Cortex XDR capability should the administrator enable to meet this requirement?

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

A security team has onboarded an AWS account into Prisma Cloud and enabled the Cloud Security Posture Management (CSPM) policy set. During the initial scan, the team notices that several S3 buckets flagged previously as non-compliant are no longer generating alerts, even though no remediation occurred. The team wants to understand which mechanism could suppress these alerts without deleting the policy. Which Prisma Cloud capability should the team review?

An organization is adopting a Zero Trust architecture. During the implementation of Least Privilege Access, the network security team needs to configure security policies that restrict traffic based on user identity rather than IP addresses alone. Which feature must be enabled and integrated with the Palo Alto Networks firewall to achieve this?

A security operations team is reviewing firewall traffic logs. Which TWO key pieces of information does the App-ID engine provide for every recognized session? (Choose two)

An administrator is configuring Cortex XDR to allow a legitimate application that performs process injection for accessibility purposes. The application is currently being blocked by the agent's protection modules. Which action should the administrator take to allow the application while minimizing the reduction in security?

A security analyst is investigating a Windows endpoint where a user downloaded a legitimate-looking PDF invoice. The file executed a macro that spawned a child process, and Cortex XDR generated a 'Local Analysis Malware' alert. The analyst wants to determine whether the file was also submitted to WildFire for cloud-based verdict. Which Cortex XDR feature should the analyst check to confirm whether the file hash was sent for WildFire analysis?

A security operations analyst wants to verify that Cortex XDR agents on managed endpoints are actively communicating with the Cortex XDR server and receiving policy updates. Which Cortex XDR component is responsible for maintaining this communication channel between the agent and the management server?

An administrator is deploying Cortex XDR agents to a large fleet of Windows servers. A small subset of servers runs a legacy application that the Behavioral Threat protection module repeatedly terminates. The administrator wants to keep the module active on these servers but stop the false positives, and must ensure the exception is applied before the application runs again. What is the most appropriate approach?

An incident responder analyzing an APT intrusion discovers that the attacker compressed and encrypted sensitive files locally on a compromised server before staging them for exfiltration. Under the MITRE ATT&CK framework, which Tactic describes this staging behavior?

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

An administrator is configuring Zone Protection profiles to mitigate potential network attacks. Which TWO flood protection mechanisms are available within a Zone Protection profile? (Choose two)

A network administrator is configuring a Palo Alto Networks firewall to protect an internal web server. The administrator wants to allow only HTTP and HTTPS traffic to the server from the internet while blocking all other inbound traffic. Which type of security policy rule should be created to achieve this?

An administrator is troubleshooting a BGP routing peer connection between the Palo Alto Networks firewall and an external provider router. The BGP session is stuck in the 'Connect' state. Inspection of system logs indicates TCP port 179 packets sent by the firewall are being transmitted, but no SYN-ACK is received. Which troubleshooting step or feature verification should be performed first?

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

When setting up Prisma Access Mobile Users, what is the recommended client software installed on end-user laptops to establish secure connections to the cloud security processing nodes?

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

A SOC manager is reviewing alert triage metrics and notices a high number of false positives from a Cortex XDR BIOC rule. The manager wants to reduce noise without disabling the rule entirely. Which action should the SOC manager take?

A SOC team is using Cortex XDR to monitor for credential dumping attempts. They want to create a BIOC (Behavioral Indicator of Compromise) rule that detects when a process attempts to access the memory of lsass.exe. Which field combination should they use in the BIOC rule to specifically detect this behavior?

A security engineer is configuring Prisma Cloud Compute to protect containers in a Kubernetes cluster. The engineer wants to enforce runtime protection that prevents containers from executing unauthorized binaries. Which two actions are required to achieve this? (Choose two.)

An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?

A security operations team is implementing zero trust network access (ZTNA) principles across the enterprise. According to foundational Zero Trust architecture guidelines, which THREE tenets must be enforced? (Choose three)

A cloud operations team manages an AWS organization with many accounts and wants to onboard all current and future accounts into Prisma Cloud CSPM with minimal manual effort. The team needs new accounts created under the organization to be monitored automatically without repeating individual onboarding steps. Which onboarding approach should the team use?

An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?

Which TWO benefits are achieved by integrating Prisma Cloud with cloud provider audit logs (such as AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs)? (Choose two)

A security architect is designing high availability (HA) for a pair of Palo Alto Networks firewalls to ensure business continuity during hardware failures. Which HA operational mode ensures that both firewalls actively process traffic and synchronize session tables in real-time?

Which TWO actions should an administrator take when a legitimate software application is falsely blocked by Cortex XDR Behavioral Threat Protection (BTP)? (Choose two)

An enterprise security architect is designing a defense-in-depth strategy using Palo Alto Networks Panorama and Next-Generation Firewalls. Which implementation best exemplifies the defense-in-depth security principle?

A network security team is configuring URL Filtering profiles to protect users from malicious web content. Which THREE actions can be assigned to specific URL categories within a URL Filtering profile? (Choose three)

A security team wants Cortex XDR to automatically terminate a process and quarantine the associated file when a known ransomware behavior is detected on an endpoint, without requiring analyst intervention. Which policy setting must be enabled to achieve automatic response?

An organization uses Prisma Cloud Compute to protect containers running in a Kubernetes cluster. A security engineer needs to ensure that a container image cannot run if it contains a critical vulnerability, but the team still wants developers to be able to deploy the image to a staging namespace for testing. Which Prisma Cloud Compute capability should the engineer configure to meet both requirements?

An administrator configures a Security policy rule with an application dependency on 'ssl', but the target application is 'custom-app'. When committing the configuration, the firewall generates a warning or error regarding application dependencies. What is the correct way to handle application dependencies in Palo Alto Networks firewalls?

A security operations center (SOC) receives an alert that a user's workstation is communicating with a known command-and-control (C2) server. The analyst checks the firewall logs and sees that the traffic is allowed because it uses TCP port 443 and the destination IP is not on any blocklist. The analyst wants to quickly determine whether this is a false positive or a real compromise. Which of the following is the MOST appropriate next step to validate the alert?

A security analyst is investigating common cyber threats targeting web applications. Which TWO threats are classified as web-based injection or application-layer attacks that can be mitigated by security profiles on a next-generation firewall? (Choose two)

A company's risk management framework requires multi-factor authentication (MFA) for all remote access connections. The organization utilizes GlobalProtect for remote workers. Where should the administrator configure the authentication profile to enforce MFA during the GlobalProtect connection phase?

Which THREE security modules are included as core components of the Cortex XDR agent architecture? (Choose three)

A SOC analyst is investigating a Cortex XDR alert indicating that a process attempted to write to a suspicious registry key on a Windows endpoint. The analyst wants to determine if the process is malicious by examining its behavior. Which Cortex XDR capability provides the most comprehensive view of process activity, including command-line arguments and parent-child relationships?

A security administrator is configuring a WildFire analysis profile to protect the network from zero-day malware. Which THREE actions can be configured within a WildFire analysis profile when an unknown file is inspected? (Choose three)

An administrator wants to view real-time session information, including source/destination ports, translated IPs, and matched security rules, for active traffic flowing through the firewall. Which CLI command should the administrator execute?

What is the primary function of the Prisma Cloud Data Security module?

A Cortex XDR administrator wants to ensure that endpoints can continue to receive updated threat signatures and policy changes even when they are roaming outside the corporate network. Which agent capability supports this requirement?

A SOC team is using Cortex XDR to investigate a series of alerts indicating suspicious PowerShell execution on multiple endpoints. The analyst wants to create a custom detection rule that triggers when PowerShell is launched with the -EncodedCommand parameter and the parent process is not a known administrative tool. The analyst also wants to exclude a specific service account that legitimately uses encoded commands for automation. Which approach should the analyst take in Cortex XDR to meet these requirements?

A network administrator is configuring a Palo Alto Networks firewall to prevent TCP SYN flood attacks. The administrator wants to limit the number of half-open connections from a single source IP address to a specific destination. Which feature should the administrator configure?

An administrator is configuring security policies on a Palo Alto Networks firewall and wants to ensure best practices for rule organization and management. Which TWO practices are recommended when designing security rules? (Choose two)

A security administrator is configuring Prisma Access to provide secure internet access for remote users. The administrator wants to ensure that web traffic from remote users is inspected for threats and that malicious sites are blocked. Which Prisma Access component is responsible for this inspection?

An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?

A security administrator is reviewing a Palo Alto Networks firewall configuration and notices that a Security policy rule allowing outbound web traffic has no security profiles attached. The administrator wants to ensure that the rule is protected against known vulnerabilities, malware, and command-and-control traffic. Which security profile group should the administrator attach to the rule to provide this protection?

A hospital must ensure that electronic protected health information remains available and unaltered even if a ransomware incident encrypts production servers. The security officer is selecting a recovery control that provides a guaranteed, isolated copy of data that cannot be modified by an attacker who has compromised the production domain. Which control best meets this requirement?

A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)

A security administrator is implementing a defense-in-depth strategy for the organization's endpoint devices. The administrator wants to ensure that even if malware bypasses the antivirus software, it cannot execute unauthorized code. Which of the following security controls BEST addresses this requirement?

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script that downloads a file from a remote server. The analyst wants to determine if the file was executed and, if so, what child processes it spawned. Which Cortex XDR data source should the analyst query?

A security administrator is configuring a next-generation firewall to inspect encrypted traffic. The organization uses a internal certificate authority (CA) to issue certificates for all internal servers. The administrator wants to ensure that the firewall can decrypt and inspect TLS traffic to these internal servers without generating certificate errors on client devices. What should the administrator do?

A security operations center (SOC) is evaluating detection capabilities for a sophisticated adversary who uses living-off-the-land binaries (LOLBins) and fileless techniques. Traditional signature-based endpoint detection has failed to identify these intrusions. Which detection approach should the SOC prioritize to improve visibility into such threats?

An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?

A SOC analyst at a financial institution receives a high-severity alert from Cortex XDR indicating that a user's workstation executed a PowerShell script that downloaded and ran a file from a known malicious IP. The analyst wants to immediately contain the endpoint to prevent lateral movement, but must preserve forensic evidence. Which action should the analyst take first?

When configuring Prisma Access Remote Networks, which THREE core components or settings are mandatory to establish a secure IPsec tunnel from a branch office firewall to a Prisma Access mobile gateway? (Choose three)

A SOC analyst is triaging a Cortex XDR incident where a suspicious process spawned from a Microsoft Word document. The process tree shows WINWORD.EXE launching powershell.exe with an encoded command. The analyst wants to quickly determine the parent-child relationship and command-line arguments across all endpoints in the incident. Which Cortex XDR feature should the analyst use?

During an incident investigation in Cortex XDR, an analyst identifies that an attacker utilized Windows Management Instrumentation (WMI) to execute commands remotely across multiple endpoints. According to the MITRE ATT&CK framework, under which tactic should this activity be categorized?

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

An enterprise security architect is designing a Zero Trust architecture using Palo Alto Networks products. Which THREE foundational principles must be enforced to achieve a true Zero Trust network posture? (Choose three)

An administrator is configuring security profiles on a Palo Alto Networks Next-Generation Firewall to mitigate potential data exfiltration attempts. To best adhere to the principle of least privilege regarding outbound traffic, which action should the administrator take?

A cloud security administrator is using Prisma Cloud to monitor an AWS environment. The administrator needs to identify which S3 buckets are publicly accessible. Which Prisma Cloud feature should be used to quickly find this information?

An administrator configures a Security policy rule to block all file-sharing applications. However, users are still able to upload files using an authorized cloud collaboration tool that shares the same parent application family. Which feature should the administrator use to granularly block file uploads while permitting standard document viewing?

Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?

A SOC analyst is investigating a Cortex XDR incident where an attacker used a signed binary to proxy execution of malicious code. The analyst observes that the binary is a legitimate Windows utility often abused for defense evasion. Which MITRE ATT&CK technique is most likely associated with this behavior?

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

A SOC analyst is reviewing a Cortex XDR incident that includes multiple alerts across several endpoints. The analyst wants to identify the common root cause and prioritize remediation. Which Cortex XDR feature should the analyst use to visualize the relationships between alerts and affected hosts?

A Cortex XDR administrator is reviewing endpoint protection settings for a group of macOS laptops used by the finance department. The organization wants to ensure that only approved applications can execute on these laptops and that any attempt to run unapproved software is blocked and reported. Which Cortex XDR capability should the administrator configure to meet this requirement?

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

A Cortex XDR administrator needs to prevent a specific known-malicious executable from running on all Windows endpoints in the environment, regardless of file name changes. Which Cortex XDR capability should be configured to block the file based on its hash?

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

A security administrator is troubleshooting an issue where internal users cannot reach a specific external website, and the traffic is being dropped by the firewall. The administrator suspects a Threat Prevention profile is blocking the response as a command-and-control callback. Where should the administrator look to verify the exact threat signature ID and packet capture that triggered the block?

An administrator is troubleshooting a scenario where internal clients cannot resolve external domain names through the firewall configured as a DNS proxy. Which TWO settings should be verified on the firewall? (Choose two)

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

A security team is using Prisma Cloud to monitor their AWS environment. They want to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should they use to detect this misconfiguration?

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

A network engineer is configuring a Palo Alto Networks firewall and wants to ensure that internal hosts cannot resolve malicious domains known to host malware delivery mechanisms. Which security profile should be configured and attached to the security rule?

An administrator configures high availability (HA) active/passive mode between two Palo Alto Networks firewalls. During a failover test, the administrator observes that stateful sessions are dropped, forcing users to re-authenticate and re-establish their TCP connections. What is the most likely configuration error?

An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?

An administrator deploys User-ID using Palo Alto Networks User-ID Agent on a Windows Server. Users report that after logging off their workstations, the firewall continues to attribute their web traffic to them for up to 45 minutes. How can the administrator reduce this timeout duration?

A security analyst is investigating a security alert generated by the firewall indicating potential data exfiltration. Which security profile should the analyst inspect and tune to detect and prevent sensitive information, such as credit card numbers, from leaving the network?

An administrator is configuring a secure IPsec VPN tunnel between an on-premises Palo Alto Networks firewall and a Prisma Access Remote Networks mobile gateway. During negotiation, Phase 2 fails. Where should the administrator check to view detailed IKE and IPsec negotiation error messages?

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

A security analyst is reviewing network traffic logs and notices that an internal host is sending DNS queries for a domain that is known to be associated with a domain generation algorithm (DGA). The queries are for random-looking subdomains of that domain and occur at regular intervals. Which type of malware behavior is most likely indicated?

During an incident response investigation using Palo Alto Networks Cortex XDR, an analyst identifies an endpoint exhibiting unusual outbound connections to a known command and control IP address. According to the cyber kill chain model, at which phase is this threat actor currently operating?

An administrator is reviewing the Palo Alto Networks firewall traffic logs and sees a session marked with the application 'unknown-tcp'. What does this application classification typically indicate?

A security team is onboarding a new AWS account into Prisma Cloud. The cloud account was created under AWS Organizations, and the team wants to grant Prisma Cloud the least-privilege permissions needed to discover resources and read CloudTrail logs. Which onboarding method should the team use?

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

An organization is analyzing the Cyber Kill Chain framework to improve their defensive posture against advanced persistent threats (APTs). Which THREE phases of the Cyber Kill Chain involve active interaction between the attacker's infrastructure and the internal target enterprise network, where a Palo Alto Networks firewall can detect or disrupt the attack? (Choose three)

An organization is subjected to a distributed denial-of-service (DDoS) attack involving HTTP GET floods targeting their public-facing web server. The firewall is deployed inline. Which specific platform capability should be tuned to mitigate this application-layer attack without blocking legitimate users?

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

A security administrator is configuring a Palo Alto Networks Next-Generation Firewall to enforce security policies. They need to ensure that only traffic from specific applications is allowed, regardless of port or protocol. Which feature should they use?

An organization is implementing a defense-in-depth security model using a Palo Alto Networks Next-Generation Firewall. Which TWO security profile types should be deployed to inspect content payloads for known malware and software exploit attempts? (Choose two)

A SOC analyst is triaging a Cortex XDR alert where a process on a Windows endpoint executed 'vssadmin.exe delete shadows /all /quiet'. The parent process is 'cmd.exe', which was spawned by a Microsoft Word macro. Which Cortex XDR artifact should the analyst pivot to first to determine if this is part of a broader ransomware attack?

A SOC analyst receives a Cortex XDR alert indicating that a process attempted to modify the registry key 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run' on a critical server. The analyst wants to quickly determine which process made the modification and its command line. Which Cortex XDR artifact should the analyst examine first?

What is the primary purpose of bootstrapping a VM-Series firewall during deployment in a public cloud?

A security team wants to prevent a specific known-malicious executable from running on all Windows endpoints managed by Cortex XDR. The file's SHA-256 hash is known, but the filename may vary. They must ensure the block is enforced even if the file is renamed. Which Cortex XDR capability should they use?

A network engineer has deployed an active/passive HA pair of PA-5220 firewalls. During a routine failover test, the engineer notices that existing TCP sessions are dropped and must be re-established. Which feature should be enabled to prevent session disruption during failover?

An administrator needs to prevent known malware and spyware from entering the network through downloaded files and web traffic. Which security profile type should be attached to the Security policy rule?

A Cortex XDR administrator wants to reduce alert noise from a custom internal application that legitimately writes to the Windows registry Run key during installation. The administrator needs to suppress future alerts for this specific behavior on a defined group of developer endpoints without disabling the Behavioral Threat module globally. Which Cortex XDR capability should the administrator use?

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

A security operations team is using Prisma Cloud to monitor their AWS environment. They receive an alert about an S3 bucket that is publicly accessible. The team wants to quickly identify which users or roles have permissions to modify the bucket policy. Which Prisma Cloud feature should they use?

Which TWO log types are generated by VM-Series firewalls and can be forwarded to Panorama or external SIEM platforms for cloud security analysis? (Choose two)

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

A security engineer is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. The engineer wants to ensure that the firewall can identify applications that use non-standard ports and apply appropriate security policies. Which technology should the engineer rely on to achieve this?

A Cortex XDR administrator is investigating an alert where a process attempted to inject code into a legitimate system process. The administrator wants to understand the sequence of events that led to the alert. Which Cortex XDR feature provides a visual representation of related events and process lineage to aid in this investigation?

A network administrator is configuring a Palo Alto Networks firewall to allow DNS traffic from the trust zone to the untrust zone. The administrator wants to ensure that only DNS queries to specific external DNS servers are allowed, and that all other DNS traffic is blocked. Which configuration should be used?

During a risk assessment, a security auditor notes that administrator accounts share a single generic login on the firewall. The auditor recommends implementing Role-Based Access Control (RBAC) and individual administrator accounts. Which Palo Alto Networks feature supports granular administration controls and authentication integration?

A security analyst is reviewing alerts generated by Palo Alto Networks WildFire. An unknown executable file was uploaded, analyzed in the sandbox, and determined to exhibit malicious behavior such as registry modification and process injection. What type of threat analysis is WildFire primarily performing in this scenario?

An administrator is configuring a complex network environment with multiple virtual routers and needs to ensure proper routing and path selection. Which THREE statements regarding Palo Alto Networks virtual routers are accurate? (Choose three)

An administrator configures a dynamic update schedule for Antivirus and WildFire signatures. The firewall successfully downloads the updates, but fails to install them automatically. Where should the administrator check to verify and configure the installation schedule settings in PAN-OS?

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?

A SOC analyst is triaging a Cortex XDR alert showing a process named 'powershell.exe' that was launched by 'winword.exe' on a finance workstation. The command line includes '-EncodedCommand' with a long Base64 string. The analyst wants to quickly determine if this represents malicious activity or a legitimate macro. Which action should the analyst take first?

A Cortex XDR administrator is configuring a Behavioral Threat protection policy for a finance department. The policy must prevent credential theft attempts where a non-browser process reads LSASS memory on Windows endpoints. The administrator wants the agent to block the behavior without terminating the parent process. Which Cortex XDR configuration should the administrator apply to meet this requirement?

Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

An administrator is configuring a Palo Alto Networks firewall to provide secure remote access for employees. The requirement is to allow employees to connect to the corporate network from home using a client that establishes an encrypted tunnel to the firewall. Which feature should the administrator configure?

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

A SOC analyst is triaging a Cortex XDR alert for a Windows endpoint that shows a process named 'svchost.exe' making an outbound HTTPS connection to a known malicious IP address. The process path is C:\Users\Public\svchost.exe, and its parent process is 'explorer.exe'. Which of the following best describes the appropriate next step for the analyst?

A security administrator is configuring a Palo Alto Networks firewall to block malicious downloads. They want to ensure that when a user attempts to download a file that is identified as malicious by WildFire, the download is blocked and the user is notified. Which two actions must the administrator take? (Choose two.)

A security team is implementing risk management practices by securing the firewall management plane. Which THREE best practices should be implemented to protect the management interface from unauthorized access? (Choose three)

A security engineer is investigating a Cortex XDR alert on a Windows endpoint. The alert indicates that a process attempted to create a scheduled task, which is a common persistence technique. The engineer wants to see the exact command line and parent process that initiated this action. Which Cortex XDR artifact should the engineer examine?

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

A SOC analyst receives an alert from Cortex XDR indicating that a user's endpoint has communicated with a known command-and-control (C2) server. The analyst verifies the alert and confirms the communication. According to the incident response process, which step should the analyst take first?

A security analyst is examining an advanced malware sample reported by Cortex XDR. The malware utilizes sophisticated evasion techniques. Which THREE of the following MITRE ATT&CK techniques are commonly associated with the Defense Evasion tactic? (Choose three)

An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)

An administrator needs to implement authentication for administrative access to the Palo Alto Networks firewall using an external RADIUS server. Which TWO components must be configured on the firewall to achieve this? (Choose two)

A security analyst is investigating a potential data breach and needs to determine the integrity of a critical file that may have been tampered with. The analyst has a known-good hash of the file from a trusted backup. Which of the following should the analyst do to verify the file's integrity?

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?

A financial institution is adopting a zero trust architecture. The security team must ensure that access to internal applications is granted based on multiple factors, including user identity, device health, and context. They are evaluating different access control models. Which of the following models BEST aligns with the zero trust principle of 'never trust, always verify'?

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

A security administrator is configuring data protection for a cloud environment monitored by Prisma Cloud. The administrator wants the platform to detect when sensitive information such as credit card numbers is stored in object storage buckets and to generate an alert without blocking access. Which Prisma Cloud capability should the administrator enable?

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

A cloud security engineer is reviewing Prisma Cloud alerts for an Azure subscription. Several alerts indicate that storage accounts allow public blob access. The engineer wants to remediate the issue at scale across all current and future storage accounts in the subscription without disrupting applications that legitimately serve public content through a CDN. What should the engineer do?

An administrator is designing a high-availability network using Panorama and Palo Alto Networks firewalls. Which TWO tasks can be performed directly by Panorama regarding firewall management and deployment? (Choose two)

A Cortex XDR administrator is reviewing endpoint protection profiles and notices that a group of endpoints has the Exploit protection module enabled but the Malware protection module disabled. The administrator wants to understand the security implication of this configuration. Which statement best describes the effect?

A healthcare organization is using Prisma Cloud to secure its multi-cloud environment. The security team needs to identify all Amazon EC2 instances that have public IP addresses and are not protected by a security group restricting inbound traffic to only necessary ports. Which Prisma Cloud capability should they use to quickly find these instances?

A newly hired administrator needs to confirm that a Windows endpoint's Cortex XDR agent is healthy and communicating with the management server. The administrator opens the endpoint's local agent console. Which status indicator should the administrator expect to see when the agent is fully operational and connected?

A security operations center analyst is reviewing an alert about an internal workstation that resolved a domain name belonging to a known malware command-and-control (C2) server. The analyst wants to confirm whether the workstation actually established a connection to that C2 server, rather than just performing a DNS lookup. Which data source should the analyst correlate with the DNS logs to make this determination?

A security administrator is implementing a defense-in-depth strategy for an organization's endpoint devices. The administrator needs to select controls that specifically mitigate the risk of malware executing on endpoints. Which two of the following controls are most directly effective for this purpose? (Choose two.)

A network administrator is configuring a Palo Alto Networks firewall to allow outbound access to the internet for internal users. The administrator wants to ensure that users can access any website but must not bypass security controls using proxy sites or anonymizers. Which Security policy configuration should the administrator implement?

A security team uses Prisma Cloud to monitor a Google Cloud organization. An auditor asks for evidence that no Cloud Storage bucket in any project allows anonymous public access, and the team must also be alerted within minutes whenever a new bucket is created with public access enabled. Which combination of Prisma Cloud features should the team rely on?

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)

An administrator wants to secure outbound web browsing traffic by inspecting HTTP/HTTPS traffic for malicious URLs, malware, and exploits. Which TWO security profiles should be attached to the Security policy rule to achieve comprehensive protection? (Choose two)

An administrator wants to ensure that critical server traffic is always prioritized over standard guest internet traffic during periods of network congestion. Which feature should be configured?

A security engineer manages an AWS environment where developers frequently create S3 buckets. The engineer must ensure that every new bucket is encrypted with SSE-KMS using a customer managed key, and that unencrypted buckets are remediated automatically within minutes without developer action. Which Prisma Cloud capability should be configured to meet this requirement?

A security team is building a defense-in-depth strategy and wants to reduce the likelihood that a compromised user account can be used to move laterally across the environment. Which two controls most directly limit lateral movement using stolen credentials? (Choose two.)

A SOC analyst is triaging alerts in Cortex XDR and notices a high volume of false positives from a custom detection rule that triggers on legitimate administrative activity. The analyst wants to reduce noise without disabling the rule entirely. Which action should the analyst take?