Palo Alto Networks Security Operations Generalist Sample Questions:

1. A branch office is configured with a Prisma SD-WAN ION device and has two internet links: a primary broadband connection and a secondary LTE link. The organization prioritizes VoIP traffic for business continuity and needs to ensure it uses the best available path based on real-time quality metrics, falling over to the LTE link if the broadband link deteriorates. Which type of Prisma SD-WAN policy is primarily used to define this behavior for VoIP traffic?

A) Security Policy
B) Qos Policy
C) NAT Policy
D) Path Policy
E) Application Override Policy

2. A security team is observing suspicious command-and-control (C2) communication originating from an infected internal host, bypassing traditional signature-based detection. The C2 traffic is using a custom port and appears to be masquerading as legitimate application traffic. Assuming the traffic is flowing through a Palo Alto Networks NGFW managed by Panorama and subscribed to relevant CDSS, which combination of CDSS and configuration elements is MOST likely to detect and block this sophisticated C2 activity?

A) App-ID successfully identifying the C2 communication as a known malicious or evasive application, followed by a Security Policy rule with a 'deny' action for that specific App-ID.
B) Blocking the custom port used by the C2 traffic in a Security Policy rule based solely on the Service object.
C) URL Filtering profile leveraging cloud-based URL categories and malicious URL feeds, applied to the Security Policy rule, assuming the C2 destination is a known malicious URL.
D) WildFire cloud analysis detecting the C2 beaconing behavior or malicious payload within the traffic stream, resulting in a WildFire verdict that triggers a 'block' action in the WildFire Analysis profile attached to the policy.
E) Threat Prevention profile with an advanced Antispyware signature feed (leveraging cloud intelligence) configured with a 'block' action for critical severity, applied to the Security Policy rule allowing the initial connection.

3. An alert is triggered in Cortex XDR indicating that PowerShell is being used to execute commands remotely. The analyst investigates and confirms that the activity is expected administrator behavior. What type of alert classification is this?
Response:

A) Benign Positive
B) True Positive
C) False Negative
D) False Positive

4. Which of the following statements accurately describes the relationship between Cloud-Delivered Security Services (CDSS) and Security Profiles on Palo Alto Networks NGFWs and Prisma SASE?

A) CDSS are physical or virtual appliances deployed alongside the firewall to perform security inspection.
B) CDSS are entirely separate cloud services that operate independently of the security profiles configured on the firewall/Prisma Access.
C) Security Profiles are configuration objects on the firewall/Prisma Access where administrators define the desired security actions, and these profiles leverage the intelligence and capabilities provided by the CDSS subscriptions.
D) CDSS subscriptions automatically apply security actions globally without requiring Security Policy or profile configuration.
E) Security Profiles are only used for basic Layer 4 filtering (port/protocol), while CDSS provide advanced inspection.

5. An administrator is reviewing Data Filtering logs and observes a large number of 'alert' actions triggered for sensitive data patterns being detected in traffic to a sanctioned cloud storage service. They want to understand if the sensitive data was actually uploaded successfully despite the alert. Which other log type is essential to correlate with the Data Filtering logs to confirm if the upload session was allowed by the security policy?

A) URL Filtering logs
B) Threat logs
C) Decryption logs
D) System logs
E) Traffic logs

Solutions: