Free Palo Alto Networks Cloud Security Professional Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks Cloud Security Professional practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1During an incident investigation, an analyst documents the detailed sequence of actions an adversary used to carry out a particular technique. Which threat-intelligence term describes that level of behavior?

   1. A.Tactic
   2. B.Technique
   3. C.ProcedureCorrect answer: C
   4. D.Indicator

   Explanation: NIST states, "A tactic is the highest-level description of this behavior, while techniques give a more detailed description of behavior in the context of a tactic, and procedures an even lower-level, highly detailed description in the context of a technique." The detailed execution of a technique is a procedure.

   Reference: NIST CSRC Glossary: Tactics, Techniques, and Procedures — Definitions, first definition

2. 2A cloud security administrator wants to discover and assess sensitive information stored in cloud resources. Which security capability is primarily concerned with data at rest?

   1. A.Data detection and response
   2. B.Data security posture managementCorrect answer: B
   3. C.Data access governance
   4. D.Data lifecycle management

   Explanation: The platform documentation lists "Data Security Posture Management (DSPM) to discover and assess your data at rest." This capability addresses discovery and assessment of stored data.

   Reference: What Is Cortex Data Security? — Data Security capabilities

3. 3A cloud service account lists a storage bucket, reads input objects, and writes reports. It never deletes objects, and another service manages retention. Which permission should the administrator remove to reduce unnecessary privilege?

   1. A.List bucket contents
   2. B.Read input objects
   3. C.Write report objects
   4. D.Delete stored objectsCorrect answer: D

   Explanation: NIST defines least privilege as "A security principle that a system should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks." The delete permission is not needed for this account’s assigned tasks.

   Reference: NIST CSRC Glossary: Least Privilege — Definitions, first definition

4. 4A defender wants to detect an unexpected malicious process executing inside a cloud container. Which capability provides the most direct runtime evidence?

   1. A.Container-aware process monitoringCorrect answer: A
   2. B.Container image inventory
   3. C.Registry image signing
   4. D.Infrastructure template scanning

   Explanation: NIST states: "Container-aware process monitoring and malware detection would detect the running of invalid or unexpected malicious processes." Process monitoring observes executing activity rather than relying on a static artifact alone.

   Reference: NIST SP 800-190: Application Container Security Guide — Section 5.1, Scenario 1, countermeasure 3

5. 5An application team needs to identify third-party packages in a project and check them against publicly disclosed vulnerabilities. Which analysis capability fits that need?

   1. A.Dynamic application security testing
   2. B.Software composition analysisCorrect answer: B
   3. C.Static application security testing
   4. D.Infrastructure-as-code security scanning

   Explanation: The project description says software composition analysis "identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities." That is the team's dependency-checking need.

   Reference: OWASP Dependency-Check — Project overview

6. 6A SOC analyst confirms that a cloud workload was attacked, but the detection rule designed for that attack generated no alert. How should the analyst classify the detection result?

   1. A.True positive
   2. B.False negativeCorrect answer: B
   3. C.False positive
   4. D.True negative

   Explanation: NIST defines a false negative as "An instance in which a security tool intended to detect a particular threat fails to do so." The attack occurred, but the tool intended to detect it did not alert.

   Reference: NIST Computer Security Resource Center: False Negative — Definitions

7. 7A cloud security administrator needs a consolidated view of discovered infrastructure and platform resources across cloud accounts. Which view is designed for this purpose?

   1. A.A vulnerability findings list
   2. B.A cloud asset inventoryCorrect answer: B
   3. C.A threat indicator feed
   4. D.A security incident queue

   Explanation: The examination owner describes a unified multicloud asset inventory: "Automatically discover every IaaS and PaaS resource. Understand your global footprint and monitor configuration changes across your entire cloud stack." The inventory brings the discovered cloud resources into one view.

   Reference: Cloud Security Posture Management — Use cases, Unified multicloud asset inventory

8. 8An analyst uses an EPSS score while prioritizing a cloud software vulnerability. What future period does the score's exploitation forecast cover?

   1. A.The next 7 days
   2. B.The next 30 daysCorrect answer: B
   3. C.The next 60 days
   4. D.The next 90 days

   Explanation: FIRST explains: "EPSS (Exploit Prediction Scoring System) is a data-driven model that estimates the probability a vulnerability will be exploited in the wild within the next 30 days." The forecast concerns the next 30 days, not the remaining life of the asset.

   Reference: EPSS Frequently Asked Questions — The basics, What is EPSS?

9. 9An analyst finds a running container that was deployed outside the organization's authorized deployment process. Which term describes this workload?

   1. A.A sidecar container
   2. B.A rogue containerCorrect answer: B
   3. C.A privileged container
   4. D.A replica container

   Explanation: NIST defines the term: "Rogue containers are unplanned or unsanctioned containers in an environment." The workload was not sanctioned through the authorized process.

   Reference: NIST SP 800-190: Application Container Security Guide — Section 3.4.5, Rogue containers

10. 10Developers want to analyze source or compiled code for security flaws before executing the application. Which type of security testing should they select?

    1. A.Dynamic application security testing
    2. B.Interactive application security testing
    3. C.Static application security testingCorrect answer: C
    4. D.Software composition analysis

    Explanation: The source-code analysis guide says static testing tools "analyze source code or compiled versions of code to help find security flaws." That matches analysis before execution.

    Reference: OWASP Source Code Analysis Tools — Introduction