Palo Alto All Post Exams Questions

Which acronym represents a set of routines, protocols, and tools for building software applications and integrations? a. PCAP b. API c. IoC d. IoT

API

Which IP address type is commonly self-assigned by a DHCP client when no DHCP server is available? a. NAT b. PAT c. APIPA d. Static

APIPA

On the NGFW, which type of User-ID technique can be configured to probe Microsoft Windows servers for active network sessions of a user? a. Client Probing b. Internet Probing c. Server Probing d. Connection Probing

Client probing

What is the primary function of coin miner malware? a. Coin miner is a sophisticated macro virus that propagates through sharing of Microsoft Office documents, and captures user online banking logon information. b. Coin miner malware's primary function is to use .lnk shortucts to secretly deliver additional malware. c. Coin miner malware hijacks systems to create or mine cybercurrency without victims consent or awareness.

Coin miner malware hijacks systems to create or mine cybercurrency without victims consent or awareness.

Select the Prisma Cloud capability that decouples workload identity from IP addresses, leverages tags and metadata to assign a logical identity to applications and workloads, and then uses it to enforce ID-based micro-segmentation and security policies that adapt to your dynamic environments. a. Machine identity b. UEBA c. Identity and access management (IAM) security d. Access management

Machine identity

The term "cloud native" refers to an approach to building and running applications that takes full advantage of a cloud computing delivery model instead of an on-premises data center.

True

Traps leverages the intelligence obtained from tens of thousands of subscribers to the WildFire cloud-based threat analysis service to continuously aggregate threat data and maintain the collective immunity of all users across endpoints, networks, and cloud applications.

True

True or False. The compute cluster is the building block for hosting the application infrastructure and provides the necessary resources in terms of compute, storage, networking, and security.

True

True or False. The process in which end users find personal technology and apps that are more powerful or capable, more convenient, less expensive, quicker to install, and easier to use, than enterprise IT solutions is known as consumerization.

True

To safely enable SaaS usage in your organization, start by clearly defining the SaaS applications that should be used and which behaviors within those applications are allowed. Which category of applications are not allowed, then controlling their usage with granular policies a. Tolerated b. Permitted c. Unsanctioned d. Sanctioned

Unsanctioned

Which type of Wildfire analysis method supports a custom-built, evasion-resistant virtual environment in which previously unknown submissions are executed within a virtualized test environment to determine real world effects and behavior. a. Machine b. Static c. Bare Metal d. Dynamic

Dynamic

The terms 'ingress/egress' best match the following descriptions: Ingoing/outgoing, detection/prevention, trusted/untrusted, patching/updating

Ingoing/outgoing

In the serverless model, applications rely on managed services that abstract away the need to manage, patch, and secure infrastructure and virtual machines.

True

Which three options are threat intelligence sources for AutoFocus? A. WildFire B. URL Filtering with PAN-DB Service C. Unit 42 Threat Intelligence and Research Team D. Third-Party Intrusion Prevention Systems

A B C

WIldFire prevents known and unknown malware threats.

False

A mutex is a program object that allows multiple program threads to share the same resource, such as file access, but not simultaneously.

True

Playbooks (or runbooks) are task-based graphic workflows that help visualize processes across security products. These playbooks can be fully automated, fully manual, or anywhere in between.

True

Which capability of a Zero-Trust segmentation platform uses a combination of anti-malware, intrusion prevention, and cyberthreat prevention technologies to provide comprehensive protection against both known and unknown threats, including threats on mobile devices? a. Least privilege access control b. Secure access c. Inspection of all traffic d. Cyberthreat protection

Cyberthreat prevention

Which of the following are typical mobile device management software capabilities? Select all that apply. DLP Personal Firewalls Policy enforcement Malware prevention

DLP, Policy enforcement, Malware prevention

Which OSI layer has 'sublayers' where you will find the LLC and MAC content? a. Transport b. Application c. Network d. Data Link e. Physical

Data Link

Which Content-ID filtering capability controls the transfer of sensitive data patterns such as credit card and social security numbers in application content and attachments? a. Data filtering b. File blocking by type c. File filtering by size d. File transfer function control

Data filtering

When two devices on the same LAN are establishing an IP connection, which IP address setting is not relevant? a. IP Address b. Subnet Mask c. Default Gateway

Default Gateway

Attacks that result in a Data Breach are most likely performed by internal threat actors (employees).

False

True or False. Wired Equivalent Privacy (WEP) is the most effective protocol for securing wireless networks.

False

True or False. The Lockheed Martin Cyber Kill Chain® framework is a five-step process that an attacker goes through in order to attack a network.

False, it is 7-steps

The ability to withstand a catastrophic series of events is commonly known as:

Fault tolerance

CRC, Cyclic Redundancy Check, is used to verify: a. Frame Integrity b. UDP handshakes c. QoS - Quality of Service d. Least-Cost path

Frame Integrity

Which type of attacker is motivated by political or social causes? Cyberterrorist State-affiliated Cybercriminal Hacktivist

Hacktivist

What would be the best description of 'polymorphism and metamorphism' ? Hiding techniques, Encrypting algorithm, SPIM, SPAM

Hiding techniques

A cloud access security broker (CASB) is software that monitors activity and enforces security policies on traffic between an organization's users and cloud-based applications and services.

True

Identity and access management (IAM) uniquely identifies users and groups in a directory service (such as Active Directory), controls what resources those users and groups can access, and what functions they can perform on a resource (such as read, write, delete, and execute).

True

True or False. Business intelligence (BI) software consists of tools and techniques used to surface large amounts of raw unstructured data to perform a variety of tasks including data mining, event processing, and predictive analytics.

True

True or False. Certain personal characteristics, such as a photographic image or fingerprint, when combined with other personal information, such as a name or phone number, is considered Personally Identifiable Information (PII).

True

True or False. Hubs traditionally operate at Layer 1 - Physical Layer, of the OSI model, while Switches traditionally operate at Layer 2 - Data Link Layer, of the OSI model.

True

True or False. Most Botnets are designed to withstand the loss of a command and control (CnC) server, meaning that the entire Botnet infrastructure must be disabled almost simultaneously.

True

WildFIre performs deep packet inspection of malicious outbound communications to disrupt C&C activity.

True

Select the type of cybersecurity solution or feature that discovers threats by identifying activity that deviates from a baseline. a. Software configuration management (SCM) b. Integrated development environment (IDE) c. Dynamic User List (DUL) d. User and entity behavior analytics (UEBA)

UEBA

Select the appropriate slash notation for an IPV4 class C address. a. /24 b. /16 c. /8 d. /32

/24

Which of the following netbit subnet values is the default for IPv4 Class C addresses? a. /24 b. /16 c. /8 d. /30

/24

Which PA series firewall brings next-generation firewall capabilities to distributed enterprise branch offices, retail locations, and midsize businesses in a small form factor. a. 220 b. 220R c. 800 d. 3200

220

Which key method does Traps not use to prevent malicious executables on the endpoint? a. Wildfire inspection and analysis b. Access control inspection c. Malware techniques mitigation d. Policy-based restrictions

Access control inspection

Windows Directory Services allows you to: a. Administer user accounts and logon policies b. Create VPN network connections c. Open and close firewall ports

Administer user accounts and logon policies

Seventh layer of OSI model

Application

Which application identification technique determines whether the initially detected application protocol is the "real one" or if it is being used as a tunnel to hide the actual application (for example, Tor might run inside HTTPS). a. Heuristics b. Application protocol detection and decryption c. Application signatures d. Application protocol decoding

Application Protocol Decoding

Which is not a Zero Trust design principle? A. Adopt a least privilege strategy and strictly enforce access control B. Allow internal users to access network services through remote access C. Ensure that all resources are accessed securely, regardless of location D. Inspect and log all traffic

B

Which security-as-a-service layer in Prisma Access SASE capability provides visibility into SaaS application usage, understands where their sensitive data resides, enforces company policies for user access, and protects their data from hackers. a. Cloud Access Security Broker (CASB) b. Threat Prevention c. Secure Web Gateway (SWG) d. Data Loss Prevention (DLP)

CASB

The first phase of implementing security in virtualized data centers consists of: a. Consolidating servers across trust levels b. Consolidating servers within trust levels c. Selectively virtualizing network security functions d. Implementing a dynamic computing fabric

Consolidating servers WITHIN trust levels

Select the scalable, cloud-based log repository that stores context-rich logs generated by Palo Alto Networks security products, including next-generation firewalls, Prisma Access, and Cortex XDR agents. a. Cortex XDR management console b. Cortex XDR endpoint agent. T c. WildFire malware prevention service d. Cortex Data Lake

Cortex data lake

Which Palo Alto Networks NGFW report can be created and scheduled to show exactly the information you want to see by filtering on conditions and columns to include. You can also include query builders for more specific details in report data? a. Custom reports b. Botnet reports c. Predefined reports d. PDF summary reports

Custom Reports

What type of attack is intended to rapidly cause damage to the victim's network and system infrastructure, as well as their business and reputation? Reconnaissance Attack Distributed Denial of Service (DDoS) Man in the Middle Attack (MITM) Social Engineering Attack

DDoS

Second layer of OSI model

Data link

A 'rootkit' is usually associated with which of the following: DoS Christmas tree attack Escalation of privelage

Escalation of Privilege

What are the results of techniques used against a system that are designed to gain access through vulnerabilities in the code of an operating system or application?

Exploits

An attacker only needs to successfully execute one step of the Cyber Kill Chain® to infiltrate a network, whereas a defender must "be right every time" and break every step of the chain to prevent an attack.

False

AutoFocus is an optional module that can be added to Next Generation Firewalls?

False

HTTPS is an application protocol used to transfer clear text data between web servers and web browsers.

False

Prisma SaaS is an inline service, so it doesn't impact latency, bandwidth, or end-user experience.

False

Representational state transfer (REST) is an Extensible Markup Language (XML) format for conveying data about cybersecurity threats in a standardized format

False

The principle of least privilege in network security requires that only the permission or access rights necessary to perform an authorized task is denied.

False

True or False. An effective security strategy is to deploy Perimeter-Based Network defenses, where countermeasures are defined at a handful of well-defined ingress/egress points to the network. You can then assume that everything on the internal network can be trusted.

False

Which of the following does ARP mapping resolve? a. IP to DNS mapping b. DNS to IP mapping c. MAC to DNS mapping d. IP to MAC mapping e. MAC to IP mapping f. DNS to MAC mapping

IP to Mac mapping

Select the DevOps process in which developers or IT operations teams can programmatically provision and manage the infrastructure stack (such as virtual machines, networks, and connectivity) for an application in software. a. IaC b. PaaS c. IaaS d. SaaS

IaC

A Zero Trust network security model is based on which security principle? a. Least privilege b. negative control c. Due diligence d. non-repudiation

Least Privelage

Which protocol requires every router to calculate and maintain a complete map, or routing table, of the entire network. a. Link State b. Static c. Distance-Vector d. Convergence

Link State

Malicious software or code that typically damages, takes control of, or collects information from an infected endpoint is known as: Vulnerability Exploit Anti-Virus Malware

Malware

Third layer of OSI model

Network

Data that moves in and out of the virtualized environment from the host network or a corresponding traditional data center is also known as: a. East-West b. Unknown c. North-East d. North-South

North South

PCI DSS is mandated and administered by the: PCI Security Standards Council (SSC) European Union (EU) U.S. Federal Government United Nations (UN)

PCI SSC

Select the three pillars of security orchestration. a. SaaS, IaaS, PaaS b. Virtualization, Storage, Cloud c. Software, Hardware, Storage d. People, Process, Technology

People, process, technology

First layer of OSI model

Physical

Sixth layer of OSI model

Presentation

Which Prisma Access SASE capability can be used to block inappropriate content (such as pornography and gambling) or websites that businesses simply don't want users accessing while at work, such as streaming services like Netflix. a. Firewall as a Service (FWaaS) b. Zero Trust Network Access (ZTNA) c. Secure Web Gateway (SWG) d. Virtual Private Network (VPN)

SWG

Fifth layer of OSI model

Session

Fourth layer of OSI model

Transport

An Android Package Kit (APK) file is an app created for the Android mobile operating system.

True

An autonomous system (AS) is a group of contiguous IP address ranges under the control of a single internet entity. Individual autonomous systems are assigned a 16-bit or 32-bit AS number (ASN) that uniquely identifies the network on the internet. ASNs are assigned by the Internet Assigned Numbers Authority (IANA).

True

AutoFocus allows you to build sophisticated multilayer searches at the host and network-based artifact levels, and target your search within industry, time period, and other filters. These searches allow you to make previously unknown connections between attacks and plan your incident response actions accordingly.

True

Before a file runs, the Cortex XDR agent queries WildFire with the hash of any Windows, macOS, or Linux executable file, as well as any dynamic link library (DLL) or Office macro, to assess its standing within the global threat community. WildFire returns a near-instantaneous verdict on whether a file is malicious or benign.

True

Botnets are commonly designed to be managed by a CnC - Command and Control - server.

True

Development and Operations teams meet regularly, share analytics, and co-own projects from beginning to end.

True

IronSkillet is a set of day-one, next-generation firewall configuration templates for PAN-OS® that are based on security best practice recommendations.

True

Sanctioned SaaS applications fulfill a legitimate business need, but certain usage restrictions may be necessary to reduce risk.

True

The Security Operating Platform proactively blocks known threats, which provides baseline defenses against known exploits, malware, malicious URLs, and C2 activity.

True

The Traps agent injects itself into each process as it is started and automatically blocks advanced attacks that would otherwise evade detection.

True

The internet of things (IoT) refers to the network of physical smart, connected objects that are embedded with electronics, software, sensors, and network connectivity.

True

The key to Traps is blocking core exploit and malware techniques, not the individual attacks.

True

The primary issue with a perimeter-based network security strategy in which countermeasures are deployed at a handful of well-defined ingress and egress points to the network is that it relies on the assumption that everything on the internal network can be trusted.

True

WIldFire operates on which concept? a. virtualized sandbox b. IPS and SIEM tool correlation c. cloud-based reputation service d. file-based scanning against a signature database

Virtualized Sandbox

Which of the following WLAN standards is the LEAST secure? Pick two. WPA WEP WPA2 WPS

WEP WPS

What type of malware typically targets a computer network by replicating itself in order to spread rapidly? Backdoor Worm Virus Logic Bomb

Worm

What does the Linux 'man' command let you do? a. Manage Passwords b. Get Help c. Manually configure the network interface d. Manage Accounts

get help

The cloud computing service model in which a provider's applications run on a cloud infrastructure and the consumer does not manage or control the underlying infrastructure is known as: Identity as a Service (IDAAS) Platform as a Service (PAAS) Infrastructure as a Service (IAAS) Software as a Service (SAAS)

SAAS

Which type of network separates the control and management processes from the underlying networking hardware, making them available as software that can be easily configured and deployed. a. SD-MAN b. LAN c. SD-WAN d. WAN

SD-WAN

Which protocol would you use when setting up a 'trap' or 'trigger' for event notifications? a. SNMP b. UPS c. HTTPS d. SMTP

SNMP

Put the TCP/IP layers in order from 1 to 4, with 1 being the physical or lowest layer: Transport Application Internet work Network access

1.Network Access 2.Internet work 3.Transport 4.Application

What is the bit-strength of an IPv6 address? a. 16 b. 128 c. 64 d. 32 e. 256

128

Select the appropriate 1st octet associated with an IPV4 Class B address. a. 10 b. 172 c. 192 d. 255

172

Which subnet is 172.168.33.20/20 on? a. 172.168.16.0 b. 172.168.8.0 c. 172.168.0.0 d. 172.168.32.0

172.168.32.0

How many host addresses can the following network IP and subnet mask support: 192.168.1.0 /24 a. 1,022 b. 254 c. 256 d. 512 e. 510 f. 1,024

254

Select the subnet mask for a class A address. a. 255.255.255.255 b. 255.0.0.0 c. 255.255.0.0 d. 255.255.255.0

255.0.0.0

What is the bit-strength of an IPv4 address? a. 16 b. 128 c. 64 d. 32 e. 256

32

Which of the following are examples of an 'endpoint'? a. Desktop b. Website c. Mainframe Server d. Point of Sale (Terminal) e. Chat Application f. Mobile Phone

A D F

Platform as a Service - PaaS - is best described as: a.A licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted. b. An online space where customers can develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app. c.An underlying network infrastructure that virtualizes physical computing resources, data partitioning, scaling, security, backup

An online space where customers can develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app.

Which Palo Alto Networks NGFW logs display entries for the security rules that help prevent sensitive information such as credit card numbers from leaving the area that the firewall protects? a. Data Filtering logs. b. Threat logs. c. URL Filtering logs. d. Correlation logs.

Data filtering logs

Which of the following features are found in the OSI Transport layer? a. Flow Control b. Frame Sequencing c. Addressing d. MAC to IP mappings e. ACK - acknowledgements f. Encryption

Flow Control, ACK - acknowledgements, Frame Sequencing

Which Wildfire verdict indicates no security risk but might display obtrusive behavior (for example, adware, spyware, and browser helper objects)? a. Malware b. Phishing c. Grayware d. Benign

Grayware

Which Traps capability enables organizations to identify non-malicious but otherwise undesirable software, such as adware, and prevent it from running in their environment? a. Execution Restrictions b. Behavior-based ransomware protection c. Granular child process protection d. Grayware Classification

Grayware classification

Which of the following is not a benefit of implementing a Zero-Trust network? a. Clearly improved effectiveness in mitigating data loss with visibility and safe enablement of applications. b. Higher total cost of ownership (TCO) with a consolidated and fully integrated security operating platform. c. Improved ability to securely enable transformative IT initiatives. d. Greater efficiency for achieving and maintaining compliance with security and privacy mandates.

Higher total cost of ownership (TCO) with a consolidated and fully integrated security operating platform.

Why would you use a Time Domain Reflectometer? a. Simulate load on a network segment b. Identify bottlenecks in the network architecture c. Identify the location of a break in the network cable

Identify the location of a break in the network cable

Windows Directory Services uses which certificate / authentication method? a. PEAP b. Kerberos c. MS-CHAP v2 d. AES

Kerberos

Which tool is used to probe for open TCP and UDP ports? a. Port Scanner b. Web Application Scanner c. Network Analyzer d. Password Cracker

Port scanner

Which Security Operating Platform capability supports a coordinated security platform that accounts for the full scope of an attack, across the various security controls that compose the security posture. This allows organizations to quickly identify and block known threats. a. Reduce the attack surface. b. Full Visibility. c. Detect and prevent new, unknown threats with automation. d. Prevent all known threats, fast.

Prevent all known threats, fast

Which VPN technology is currently considered the preferred method for securely connecting a remote endpoint device back to an enterprise network? PPTP SSL IPSEC SSTP

SSL

Which of the following describes a cooling problem often found in server rooms? a. Ground Loops b. Cache Depletion c. Traffic Bottlenecks d. Server Creep

Server Creep

Which of the following are enhancements of Wi-Fi 802.11ac compared to WiFi 802.11n? Select more than one. a. Integrity b. Speed c. Beamforming Transmissions d. Support for WEP

Speed, beamforming transmissions

A default gateway is a network device, such as a router or switch, to which an endpoint sends network traffic when a specific destination IP address is not specified by an application or service, or when the endpoint does not know how to reach a specified destination.

True

Content-ID is an Intrusion Prevention feature that protects networks from all types of vulnerability exploits, buffer overflows, DoS attacks, and port scans that lead to the compromise of confidential and sensitive enterprise information.

True

The single pass architecture of the NGFW integrates multiple threat prevention disciplines (IPS, anti-malware, URL filtering, etc.) into a single stream-based engine with a uniform signature format.

True