Palo Alto Networks Cybersecurity Practitioner Cybersecurity-Practitioner Exam Questions

Page: 1 / 14
Total 225 questions
Question 1

Which two workflows are improved by integrating SIEMs with other security solutions? (Choose two.)



Answer : B, D

Log normalization -- SIEMs standardize log formats from various sources, making it easier to analyze and correlate security events.

Incident response -- Integration enables faster detection, investigation, and automated or guided response to security incidents by using correlated data from multiple tools.

Hardware procurement and security team training are not directly influenced by SIEM integration.


Question 2

Which feature of cloud-native security platforms (CNSPs) focuses on protecting virtual machine (VM), container, and serverless deployments against application-level attacks during runtime?



Answer : A

Workload security in a Cloud-Native Security Platform (CNSP) focuses on protecting VMs, containers, and serverless deployments against application-level attacks during runtime. It ensures that workloads remain secure by monitoring behavior, enforcing policies, and detecting threats in real time.


Question 3

Which security function enables a firewall to validate the operating system version of a device before granting it network access?



Answer : C

Host Intrusion Prevention Systems (HIPS) operate on endpoints to enforce security policies by monitoring system calls, file integrity, and configuration settings. HIPS can validate device compliance, including operating system versions and patch levels, before permitting network access. This capability prevents vulnerable or outdated devices from becoming attack vectors. Palo Alto Networks integrates HIPS functionalities in its endpoint security solutions, providing granular control to enforce organizational security standards and reduce risk from non-compliant endpoints. Unlike network-based inspection, HIPS works locally on hosts to stop threats at their origin.


Question 4

What are two common lifecycle stages for an advanced persistent threat (APT) that is infiltrating a network? (Choose two.)



Answer : A, D

Lateral movement is a key stage where the attacker moves across the network to find valuable targets.

Privilege escalation involves gaining higher access rights to expand control within the compromised environment.

Communication with covert channels is a tactic used during persistence or exfiltration, while deletion of critical data is not a standard APT lifecycle stage --- it's more characteristic of destructive attacks.


Question 5

Which of the following is a Routed Protocol?



Answer : C

A routed protocol is a protocol by which data can be routed. It provides appropriate addressing information in its internet layer or network layer to allow a packet to be forwarded from one network to another network. Examples of routed protocols are the Internet Protocol (IP) and Internetwork Packet Exchange (IPX). IP is the most widely used routed protocol on the Internet and other networks. It assigns a unique logical address to each device and enables data to be fragmented, reassembled, and routed across multiple networks.Reference:

Routing v/s Routed Protocols in Computer Network

Routing protocol - Wikipedia

CCNA Certification: Routed Protocols vs Routing Protocols

What is the difference between Routing Protocols and Routed Protocols


Question 6

Which term describes data packets that move in and out of the virtualized environment from the host network or a corresponding traditional data center?



Answer : A

North-South traffic refers to the data packets that move between the virtualized environment and the external network, such as the internet or a traditional data center. This traffic typically involves requests from clients to access applications or services hosted on virtual machines (VMs) or containers, or responses from those VMs or containers to the clients. North-South traffic can also include management or monitoring traffic from external devices to the virtualized environment.Reference:Fundamentals of Cloud Security,East-West and North-South Traffic Security,What is the meaning / origin of the terms north-south and east-west traffic?


Question 7

Which Palo Alto Networks tool is used to prevent endpoint systems from running malware executables such as viruses, trojans, and rootkits?



Answer : B

Cortex XDR is a cloud-based, advanced endpoint protection solution that combines multiple methods of prevention against known and unknown malware, ransomware, and exploits. Cortex XDR uses behavioral threat protection, exploit prevention, and local analysis to stop the execution of malicious programs before an endpoint can be compromised. Cortex XDR also enables remediation on the endpoint following an alert or investigation, giving administrators the option to isolate, terminate, block, or quarantine malicious files or processes. Cortex XDR is part of the Cortex platform, which provides unified visibility and detection across the network, endpoint, and cloud.Reference:

Cortex XDR - Palo Alto Networks

Endpoint Protection - Palo Alto Networks

Endpoint Security - Palo Alto Networks

Preventing Malware and Ransomware With Traps - Palo Alto Networks


Page:    1 / 14   
Total 225 questions