Free Palo Alto Networks Cybersecurity Practitioner Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks Cybersecurity Practitioner practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1When a user requests access to a database, an AAA server evaluates the user's privileges and decides whether to allow the request. Which AAA function makes this decision?

   1. A.Authentication
   2. B.AuthorizationCorrect answer: B
   3. C.Accounting
   4. D.Identification

   Explanation: RFC 2903 describes authorization as making an authorization decision to "grant or deny a User's request for services or resources." The database access decision is therefore authorization, rather than identity verification or recording resource use.

   Reference: RFC 2903: Generic AAA Architecture — Section 3.4, AAA Transaction/Session Management Service Layer

2. 2An administrator needs to characterize a firewall that applies packet-header rules without keeping track of the state of traffic flows. Which type of firewall is being described?

   1. A.Stateful inspection firewall
   2. B.Application-proxy gateway
   3. C.Stateless inspection firewallCorrect answer: C
   4. D.Stateful protocol-analysis firewall

   Explanation: NIST describes "stateless inspection firewalls" as devices that "do not keep track of the state of each flow of traffic" passing through them. Such a firewall applies packet-filter rules without associating packets through connection state.

   Reference: NIST SP 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy — Section 2.1.1, Packet Filtering, page 2-2

3. 3A network team is comparing two cloud-delivered architectures. Which networking capability is included in SASE in addition to the security capabilities associated with SSE?

   1. A.Software-defined wide area networkingCorrect answer: A
   2. B.Cloud access security broker
   3. C.Secure web gateway
   4. D.Zero trust network access

   Explanation: CISA describes SASE as combining network and security services, "including software-defined wide area networking." The same guide identifies the other options as SSE security capabilities.

   Reference: Modern Approaches to Network Access Security — Secure Service Edge, page 6; Secure Access Service Edge, page 7

4. 4A cloud infrastructure is provisioned for the exclusive use of one organization and its business units. Which cloud deployment model does this describe?

   1. A.Public cloud
   2. B.Community cloud
   3. C.Hybrid cloud
   4. D.Private cloudCorrect answer: D

   Explanation: NIST defines private cloud infrastructure as "provisioned for exclusive use by a single organization" comprising multiple consumers. Ownership and operation may involve the organization, a third party, or both.

   Reference: NIST SP 800-145: The NIST Definition of Cloud Computing — Section 2, Deployment Models, Private cloud, page 3

5. 5An analyst compares file hashes found on endpoints with a list of hashes associated with known malicious files. Which threat-hunting approach is the analyst using?

   1. A.Frequency analysis
   2. B.Pattern analysis
   3. C.Indicator of compromise searchCorrect answer: C
   4. D.Anomaly detection

   Explanation: CISA recommends collecting "known-bad indicators of compromise" and searching for them in network and host artifacts. Comparing known malicious hashes to endpoint artifacts follows that approach; a match should still be assessed for false positives.

   Reference: Technical Approaches to Uncovering Malicious Activity — Description, Indicators of Compromise Search, page 3

6. 6During an incident, responders transfer a compromised workstation to an isolated remediation network to prevent the incident from spreading. Which incident-response objective does this action primarily support?

   1. A.Detection
   2. B.ContainmentCorrect answer: B
   3. C.Eradication
   4. D.Recovery

   Explanation: NIST states that "Containment refers to preventing the expansion of an incident" and gives transferring a compromised endpoint to an isolated remediation network as a containment action.

   Reference: NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — CSF Element RS.MI-01, page 32

7. 7An analyst sees login attempts using the same common password against many different employee accounts. Which credential-access method best describes this behavior?

   1. A.Password cracking
   2. B.Credential stuffing
   3. C.Password sprayingCorrect answer: C
   4. D.OS credential dumping

   Explanation: The ATT&CK description states that adversaries may use "a single or small list of commonly used passwords against many different accounts." That pattern matches the observed attempts.

   Reference: Brute Force: Password Spraying — Description, sub-technique T1110.003

8. 8An organization wants to reduce an attacker's ability to move between workloads that share the same network zone. What is the purpose of applying microsegmentation to these workloads?

   1. A.Restrict workload-to-workload interactions through granular policiesCorrect answer: A
   2. B.Encrypt workload-to-workload traffic through shared transport keys
   3. C.Route workload-to-workload traffic through centralized gateways
   4. D.Record workload-to-workload traffic through centralized logging

   Explanation: NIST explains that microsegmentation provides a "fine-grained approach to isolation" where selected interactions are allowed. Restricting workload interactions limits paths available for lateral movement within the zone.

   Reference: NIST SP 1800-24B: Securing Picture Archiving and Communication System — Section 4.1.6.3, Microsegmentation

9. 9An attacker silently changes records in a private application while authorized users can still access them. Which information-security property is directly compromised by the unauthorized change?

   1. A.Availability
   2. B.Accountability
   3. C.Confidentiality
   4. D.IntegrityCorrect answer: D

   Explanation: NIST defines integrity as "guarding against improper information modification or destruction." Unauthorized alteration of application records is therefore an integrity loss.

   Reference: NIST SP 1800-26A: Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events — Executive Summary, CIA triad

10. 10A security engineer is assigning responsibilities for a workload deployed using infrastructure as a service. Which layer can the cloud consumer control under the NIST service model?

    1. A.The guest operating systemCorrect answer: A
    2. B.The physical facility infrastructure
    3. C.The host hypervisor platform
    4. D.The underlying physical network

    Explanation: NIST states that the consumer "has control over operating systems, storage, and deployed applications" but does not control the underlying cloud infrastructure. The workload operating system is therefore within the consumer's control.

    Reference: NIST SP 800-145: The NIST Definition of Cloud Computing — Section 2, Service Models, Infrastructure as a Service, page 3