Cybersecurity Fundamentals practice questions

URL Filtering profile configured to block malicious categories

Why it fails: URL Filtering inspects HTTP request paths and hostnames against category databases; it does not match outbound sessions against command-and-control IP threat feeds. It is tempting because it blocks malicious web destinations, and would be correct if the traffic were users browsing known malicious URLs rather than beaconing to C2 addresses.

Vulnerability Protection profile configured to block buffer overflows

Why it fails: Incorrect. Vulnerability protection shields against known exploit attempts targeting software flaws rather than C2 callbacks.

WildFire analysis profile configured for forward unkown file actions

Why it fails: Incorrect. WildFire focuses on sandboxing and analyzing unknown files for zero-day malware.

Data Filtering profile configured with URL category exceptions

Why it fails: Incorrect. Data filtering inspects text payloads, whereas File Blocking targets file types and extensions.

WildFire analysis profile configured for static code review

Why it fails: Incorrect. WildFire analyzes files for malware behavior, not proprietary source code compliance.

URL Filtering profile configured with Custom URL categories

Why it fails: Incorrect. URL filtering categorizes web destinations by domain, not internal file upload content.

Configure an Application Override policy to bypass threat inspection for all traffic

Why it fails: Incorrect. Application override disables threat inspection entirely, leaving the network unprotected.

Disable all logging in the Security policy rules for internal zones

Why it fails: Incorrect. Disabling all logging creates blind spots and violates compliance monitoring requirements.

Lower the firewall management plane CPU threshold limits

Why it fails: Incorrect. CPU thresholds do not affect threat log verbosity or SIEM alert generation.

Configure a custom URL Filtering category to block the vendor advisory website

Why it fails: Incorrect. Blocking the advisory website does not prevent exploitation traffic from reaching vulnerable internal servers.

Deploy an Application Override policy to drop all traffic using the affected application port

Why it fails: Incorrect. Application override disables App-ID inspection and dropping ports can cause unintended business disruption.

Enable strict WildFire forwarding for all outbound DNS requests originating from the server subnet

Why it fails: Incorrect. WildFire analyzes files, whereas vulnerability exploitation traffic consists of network packets containing exploit payloads.

WildFire analysis profile with file forwarding set to 'async'

Why it fails: Asynchronous WildFire forwarding submits files for later sandbox analysis, so the download completes before any verdict returns and nothing is blocked inline. It is tempting because WildFire detects unknown, zero-day malware, and async forwarding suits alerting and retrospective review rather than inline prevention.

Data Filtering profile configured to drop executable file extensions

Why it fails: Data Filtering matches file extensions and MIME types, so renamed or embedded malware bypasses it and known signatures are never checked. It is tempting because dropping executable extensions blocks obvious payloads and suits coarse data-loss or download-type policy, not signature-based inline malware prevention.

URL Filtering profile configured to block malicious download categories

Why it fails: URL Filtering blocks or allows web destinations by category and reputation; it cannot inspect the file payload itself, so a known malware file hosted on an allowed site still downloads. It is tempting because category-based blocking stops access to known malicious hosting sites, which suits browsing policy enforcement rather than file inspection.

Objects > Security Profiles > Administrator Access list

Why it fails: Incorrect. Security profiles apply to data plane traffic, not administrative management sessions.

Policies > Decryption rulebase configuration tab

Why it fails: Incorrect. Decryption policies control data plane user traffic inspection, not firewall administrator access.

Network > Interfaces > Loopback configuration menu

Why it fails: Incorrect. Loopback interfaces are used for internal routing and termination, not management plane crypto setup.

SSL Inbound Inspection Decryption

Why it fails: Incorrect. Inbound Inspection requires the server's private key to decrypt inbound traffic destined for internal servers.

Kerberos Decryption Service integration

Why it fails: Incorrect. Kerberos decryption is used for ticket-based authentication inspection, not general SSL/TLS web traffic.

SSH Decryption Proxy mode

Why it fails: Incorrect. SSH decryption inspects Secure Shell terminal traffic, not HTTPS web traffic.

Management IP addresses of the individual firewall control planes

Why it fails: Incorrect. Management IP addresses must be unique for each peer.

Hostname configured in the device management settings

Why it fails: Incorrect. Hostnames can be unique per peer for identification.

DNS server IP addresses configured in device setup

Why it fails: Incorrect. DNS configurations can differ without affecting HA pairing.

Distributed Denial of Service (DDoS)

Why it fails: DDoS aims to exhaust service availability rather than guess authentication tokens.

Cross-Site Scripting (XSS)

Why it fails: XSS targets web applications by injecting malicious scripts into trusted websites.

SQL Injection

Why it fails: SQL injection attacks database query structures via input fields.

Discretionary Access Control (DAC)

Why it fails: DAC allows resource owners to set permissions at their discretion. It does not enforce time-based restrictions or automatic expiration. A developer could be granted read-only access, but it would persist until manually changed. DAC lacks the centralized, policy-driven control needed for temporary access that expires after a set period, making it a poor fit.

Role-Based Access Control (RBAC)

Why it fails: RBAC assigns permissions based on roles, not temporary needs. While roles can be created for developers, RBAC lacks built-in time-based expiration. Implementing time-limited access would require additional mechanisms like scheduled role revocation, which is not inherent to RBAC. Thus, it does not directly satisfy the requirement for automatic expiration after 8 hours without extra tooling.

Mandatory Access Control (MAC)

Why it fails: MAC uses labels and clearances to enforce access, typically in high-security environments. It does not provide a simple way to grant temporary, read-only access to a database for a specific group. MAC is rigid and centrally controlled, making it unsuitable for dynamic, time-bound access needs like this scenario. It would be overly complex and not align with the requirement.

Threat Vault

Why it fails: Threat Vault is a resource that provides information about threats, including signatures and advisories. It is not a log search tool. It can help understand a threat but does not allow querying historical traffic logs for specific indicators. The analyst requires a way to search past sessions, which Threat Vault does not provide.

WildFire

Why it fails: WildFire is a cloud-based malware analysis service that identifies malicious files and generates signatures. It does not provide historical search of network traffic logs. While WildFire can inform about malicious files, it does not directly allow searching past traffic for specific hashes or IPs. The analyst needs a log search capability.

Traffic logs

Why it fails: Traffic logs record sessions and can be searched, but they do not include file hashes. File hashes are found in WildFire submission logs or data filtering logs. Searching traffic logs for a file hash would not yield results because that information is not stored there. The analyst needs a log that contains file hash data.

Weaponization

Why it fails: Weaponization is the stage where an attacker creates a deliverable payload, such as a malicious document or exploit. It occurs before delivery and does not involve communication from a compromised host. The observed scheduled task and external communication indicate post-compromise activity, not the preparation of an attack tool. Thus, it is not weaponization.

Exploitation

Why it fails: Exploitation is the stage where the attacker leverages a vulnerability to execute code on the target. While the PowerShell script might be part of exploitation, the ongoing communication with an external IP suggests a later stage. Exploitation is a one-time event, whereas the scheduled task and persistent communication indicate C2. The scenario focuses on active communication, not the initial exploit.

Actions on Objectives

Why it fails: Actions on Objectives is the final stage where the attacker achieves their goal, such as data exfiltration or destruction. While C2 often precedes this, the scenario does not show data theft or damage. The presence of a C2 channel and persistence mechanism suggests the attacker is maintaining access, not yet performing final actions. Thus, it is not the most likely stage.

Network segmentation

Why it fails: Network segmentation limits the spread of ransomware after initial execution by isolating systems. It does not prevent the initial execution on an endpoint. Segmentation is a containment and lateral movement control, not a preventive control for endpoint execution. It is valuable in defense-in-depth but does not directly stop ransomware from running on a host, making it less effective for this specific goal.

Regular offline backups

Why it fails: Offline backups are critical for recovery after a ransomware attack, allowing restoration without paying a ransom. However, they do not prevent the initial execution of ransomware on endpoints. Backups are a recovery control, not a preventive one. While essential for resilience, they do not stop ransomware from encrypting data in the first place, so they are not the best answer for preventing execution.

User security awareness training

Why it fails: User awareness training helps users recognize phishing and avoid risky behavior, reducing the likelihood of ransomware delivery. However, it does not technically prevent execution if a user is tricked. Training is a valuable layer but is not a direct technical control against execution. It is more effective for prevention of initial infection vectors but cannot guarantee blocking ransomware execution.

URL Filtering profile with custom block lists

Why it fails: URL Filtering inspects HTTP and HTTPS requests, so it cannot block DNS resolution of malicious domains; the host still resolves them before any web request occurs. It is tempting because custom block lists do stop users browsing known malicious sites, which would be correct if the requirement were web access rather than DNS.

Data Filtering profile with pre-defined patterns

Why it fails: Data Filtering profiles inspect outbound traffic for sensitive data patterns such as credit card numbers, not DNS queries for malicious domains. It is tempting because it blocks data exfiltration, and would be correct if the requirement were preventing confidential files leaving the network rather than stopping domain resolution.

Vulnerability Protection profile with severity filters

Why it fails: Vulnerability Protection profiles inspect traffic for exploits against software flaws, not DNS queries, so malicious domain resolution proceeds unchecked. It is tempting because it targets malware delivery, but blocking known malicious domains requires an Anti-Spyware profile with DNS sinkholing enabled.

The decryption policy must exempt WildFire inspection traffic to prevent performance degradation on the data plane

Why it fails: Exempting WildFire inspection traffic prevents decrypted file copies from reaching the WildFire service, so the malware binary is never submitted for sandbox analysis. Exemptions suit trusted high-bandwidth flows where inspection overhead is unwanted, not the analysis path the scenario requires.

A custom URL Filtering profile must be applied to decrypt traffic matching the unknown-file category

Why it fails: URL Filtering profiles classify web categories and enforce access rules; they do not decrypt traffic or forward files to WildFire. Decryption is performed by a Decryption policy, and WildFire submission requires a WildFire Analysis profile attached to the Security policy's allow rule for the unknown-file category.

The Security rule must utilize an application override to bypass App-ID processing for encrypted file transfers

Why it fails: An application override skips App-ID, so the firewall stops identifying the file transfer as the application WildFire submits for analysis, defeating inspection. Overrides suit custom or evasive applications needing fixed port handling, not malware submission, which requires the decryption policy to forward decrypted files to WildFire.

Panorama Log Collector forwarding engine

Why it fails: Panorama's Log Collector aggregates and stores firewall logs for centralised management and reporting; it performs no threat-intelligence correlation or TTP mapping. It is tempting because Panorama does surface logged traffic and threat events, but that is operational visibility across managed firewalls, not sector-specific adversary research.

Application Command Center (ACC) dashboard

Why it fails: The ACC dashboard visualises traffic, application, and threat data already traversing the firewall; it does not provide sector-specific actor TTP research. It is tempting for internal traffic monitoring, but contextual threat intelligence requires AutoFocus or Unit 42 research.

GlobalProtect Host Information Profile (HIP) engine

Why it fails: GlobalProtect HIP collects endpoint posture data — patch level, antivirus, disk encryption — to gate VPN access under HIP profiles. It is tempting because HIP profiles do inform policy decisions about device trust, yet they describe endpoint compliance, not threat-actor TTPs or sector exposure intelligence.

Palo Alto Networks MineMeld open-source threat intelligence

Why it fails: MineMeld aggregates and distributes threat intelligence feeds but does not automatically push a novel variant's signature to every firewall within minutes without manual updates. It is tempting because it centralises indicator sharing, and would be correct for curating and redistributing known indicators across security tooling.

Traps Advanced Endpoint Protection cloud service

Why it fails: Traps is an endpoint protection cloud service, so it cannot push a firewall signature to block a malware variant globally; it detects and prevents execution on endpoints. It is tempting because cloud-delivered threat intelligence sounds similar, and Traps would be the right choice to stop the sample running on managed hosts.

AutoFocus Context-Aware Threat Intelligence service

Why it fails: AutoFocus is a threat-intelligence portal for research and hunting, not an inline enforcement mechanism that pushes signatures to firewalls automatically. It is tempting because it aggregates malware intelligence globally, but blocking requires WildFire's signature generation feeding dynamic updates to the Next-Generation Firewalls.

GlobalProtect with Clientless VPN

Why it fails: Clientless VPN provides browser-based access to internal web applications; it does not supply the user identity context that identity-based policy enforcement requires. It is tempting because it is a GlobalProtect remote-access feature, and would be correct for giving users agentless access to specific internal web apps.

App-ID cloud-based application signatures

Why it fails: App-ID classifies applications by signature, not user identity, so policy still cannot key on who is connecting. It is tempting because App-ID is the firewall's core application-visibility feature, and it would be right when the requirement is to allow or block specific applications regardless of user.

WildFire threat intelligence cloud

Why it fails: WildFire is a cloud sandbox that analyses files for malicious behaviour; it does not enforce identity-based policy. It is tempting because it is a Palo Alto security subscription, but User-ID, integrated with directory services, is the feature that maps traffic to user identity for Least Privilege enforcement.

NAT policy source translation mapping

Why it fails: NAT policy performs address translation, not inter-tier access enforcement; ISFW segmentation relies on Security policy rules with App-ID and zone or address objects to control traffic between tiers. NAT would be the right choice when translating addresses for outbound or inbound connectivity, not for tier isolation.

Static routing table optimization

Why it fails: Routing tables determine packet paths, not security policy, so they cannot enforce tier-to-tier access control. It is tempting because optimising routes feels like tightening internal traffic flow, and it would be the right choice when reducing hop count or steering traffic between subnets.

Zone Protection profiles against SYN floods

Why it fails: Zone Protection profiles defend against flood and reconnaissance attacks at the ingress zone boundary; they do not inspect inter-tier traffic. App-ID, applied in security policy between internal segments, provides the application-level identification ISFW needs to enforce tier-to-tier access control within one zone.

WildFire API token generation and management

Why it fails: WildFire API tokens authenticate submissions to the WildFire cloud sandbox for file analysis; they grant no administrative role separation or directory authentication. It is tempting because tokens do control API access, but that governs threat-analysis lookups, not granular firewall administrator privileges or integration with Microsoft Entra ID.

User-ID clientless mapping via Windows User-ID Agent

Why it fails: Clientless User-ID mapping identifies users from directory traffic for policy enforcement; it does not create individual administrator logins or assign granular administrative roles. It is tempting because it integrates authentication with Microsoft Entra ID, but it addresses user-to-IP mapping for security policy, not administrative privilege separation.

GlobalProtect Portal client configuration profiles

Why it fails: GlobalProtect portal client configuration profiles distribute VPN client settings, split-tunnel and authentication options to endpoints, not administrative roles on the firewall. It is tempting because GlobalProtect integrates with authentication services, but administrative RBAC and per-admin accounts are configured through admin roles and authentication profiles.