Cybersecurity-Practitioner Exam Questions and Answers

QUESTION: 25

Which of the Cloud-Delivered Security Services (CDSS) will detect zero-day malware by using inline cloud machine learning (ML) and sandboxing?

DNS security
Advanced WildFire
loT security
Advanced Threat Prevention

Answer(s): B

Explanation:

Advanced WildFire is a Cloud-Delivered Security Service (CDSS) that detects zero-day malware using inline cloud machine learning (ML) and sandboxing techniques. It analyzes unknown files in real-time to identify and block new threats before they can cause harm.

Reveal Solution Next Question

QUESTION: 26

What are two characteristics of an advanced persistent threat (APT)? (Choose two.)

Multiple attack vectors
Repeated pursuit of objective
Reduced interaction time
Tendency to isolate hosts

Answer(s): A,B

Explanation:

Multiple attack vectors APTs often use various methods (phishing, malware, lateral movement) to infiltrate and maintain access to a target.

Repeated pursuit of objective APTs are known for their persistent nature, involving continuous efforts over time to achieve their goals, such as data theft or surveillance.

Reveal Solution Next Question

QUESTION: 27

Which product functions as part of a SASE solution?

Cortex
Prisma Cloud
Kubernetes
Prisma SD-WAN

Answer(s): D

Explanation:

Prisma SD-WAN is a key component of a SASE (Secure Access Service Edge) solution. It provides intelligent routing, traffic optimization, and secure connectivity between users and applications, supporting the networking part of SASE alongside security services like those in Prisma Access.

Reveal Solution Next Question

QUESTION: 28

Which statement describes a host-based intrusion prevention system (HIPS)?

It analyzes network traffic to detect unusual traffic flows and new malware.
It scans a Wi-Fi network for unauthorized access and removes unauthorized devices.
It is placed as a sensor to monitor all network traffic and scan for threats.
It is installed on an endpoint and inspects the device.

Answer(s): D

Explanation:

A Host-Based Intrusion Prevention System (HIPS) is installed directly on an endpoint device (such as a server or workstation) and monitors local system activity, including processes, file access, and system calls, to detect and prevent malicious behavior.

Reveal Solution Next Question

QUESTION: 29

Which MITRE ATT&CK tactic grants increased permissions to a user account for internal servers of a corporate network?

Impact
Privilege escalation
Data exfiltration
Persistence

Answer(s): B

Explanation:

The Privilege Escalation tactic in the MITRE ATT&CK framework involves techniques used by attackers to gain higher-level permissions on a system or network, allowing greater access to internal servers and sensitive data.

Reveal Solution Next Question

QUESTION: 30

Which type of portable architecture can package software with dependencies in an isolated unit?

Containerized
Serverless
Air-gapped
SaaS

Answer(s): A

Explanation:

A containerized architecture packages software along with its dependencies, libraries, and configuration into an isolated unit called a container. This ensures consistent behavior across environments and simplifies deployment and scaling.

Reveal Solution Next Question

QUESTION: 31

Which action is unique to the security orchestration, automation, and response (SOAR) platforms?

Prioritizing alerts
Enhancing data collection
Using predefined workflows
Correlating incident data

Answer(s): C

Explanation:

SOAR platforms are unique in their ability to automate incident response through the use of predefined workflows. These workflows allow repetitive security tasks to be executed automatically,

improving response speed and efficiency.

Reveal Solution Next Question

QUESTION: 32

Which two processes are critical to a security information and event management (SIEM) platform? (Choose two.)

Detection of threats using data analysis
Automation of security deployments
Ingestion of log data
Prevention of cvbersecurity attacks

Answer(s): A,C

Explanation:

Detection of threats using data analysis SIEM platforms analyze collected data to identify suspicious patterns and detect threats.

Ingestion of log data SIEM systems collect and centralize log data from various sources, which is essential for analysis, correlation, and alerting.

Automation and prevention are more aligned with SOAR and firewall/EDR functionalities, not the core operations of SIEM.

Reveal Solution Next Question

Palo Alto Networks Cybersecurity-Practitioner Exam (page: 4) Palo Alto Networks Cybersecurity Practitioner Updated on: 12-Feb-2026

QUESTION: 25

Explanation:

QUESTION: 26

Explanation:

QUESTION: 27

Explanation:

QUESTION: 28

Explanation:

QUESTION: 29

Explanation:

QUESTION: 30

Explanation:

QUESTION: 31

Explanation:

QUESTION: 32

Explanation:

Palo Alto Networks Cybersecurity-Practitioner Exam (page: 4)
Palo Alto Networks Cybersecurity Practitioner
Updated on: 12-Feb-2026