Cybersecurity Practitioner Free Sample Questions

A security architect is designing a Zero Trust architecture for a financial institution. The organization requires that all internal east-west traffic between the 'HR-VLAN' and 'Finance-VLAN' be inspected for threats, specifically looking for lateral movement and exploit attempts. Currently, these VLANs are routed via a core switch with ACLs. Which deployment mode should the architect implement on a Palo Alto Networks NGFW to achieve deep packet inspection without re-architecting the entire Layer 3 routing topology?

During a security audit, an administrator notices that a specific Security Policy rule is effectively allowing traffic that should be blocked. The rule is configured with 'Application: any' and 'Service: application-default'. The traffic in question is SSH traffic running on port 8022. Why is this traffic being blocked by the default deny rule instead of matching the allow rule, or vice versa, based on the configuration provided?

A manufacturing company uses Cortex XDR to protect its industrial control systems (ICS). The SOC team observes a series of alerts indicating a 'Generic.Malware' verdict from the Local Analysis engine on an isolated endpoint that has no internet connectivity. Which component of the Cortex XDR agent is primarily responsible for this detection in the absence of cloud connectivity?

An organization is deploying Prisma Access to secure its mobile workforce. They need to ensure that internet-bound traffic from mobile users in Germany exits to the internet from a German IP address to comply with data residency regulations, while users in France exit from France. Which Prisma Access configuration object must be defined to achieve this localized internet breakout?

Which TWO actions are required to successfully configure an Active/Passive High Availability (HA) pair of Palo Alto Networks firewalls? (Select TWO)

A security analyst is reviewing the Automated Correlation Engine (ACE) logs in Panorama. They notice a 'Correlated Event' that groups together a port scan, a brute force attempt, and a subsequent data exfiltration event from the same source IP. What is the primary function of the Correlation Object in this context?