Cybersecurity Practitioner

Last checked October 22, 2026 against the official Palo Alto Networks exam page.

1. Question 1Security Operations and Endpoint Protection

   Which tool collects endpoint telemetry and detects and responds to threats on endpoints, such as Cortex XDR does?

   1. AAn endpoint detection and response (EDR) tool, which collects telemetry and detects and responds to threats on endpoints
   2. BA print spooler, which queues the print jobs sent by users to the shared printers in the office on each floor of the building
   3. CA certificate authority, which issues certificates that bind public keys to the identities of servers and users on the network
   4. DA backup scheduler, which copies the files on each endpoint to a central server each night for recovery after a failure
   Show answer and explanationHide answer

   Correct answer: A

   EDR collects endpoint telemetry and detects and responds to threats, which is the function described. Print spoolers, certificate authorities and backup schedulers do not detect threats on endpoints.

2. Question 2Cybersecurity Fundamentals

   Which security model assumes that no user, device or network is trusted by default, and verifies each request before access is granted?

   1. AZero trust, which verifies every request against identity, device and context before granting access to resources
   2. BPerimeter security, which trusts all traffic inside the firewall and concentrates protection on the outer boundary only
   3. CAir-gapping, which keeps a network physically disconnected from others, but does not verify individual requests at all
   4. DHoneynet deployment, which places decoy systems in the network so that attacker activity can be observed and studied later
   Show answer and explanationHide answer

   Correct answer: A

   Zero trust verifies each request against identity, device and context rather than trusting network location. Perimeter security trusts traffic inside the boundary, air-gapping isolates a network without verifying requests, and honeynets observe attackers rather than granting access.

3. Question 3Network Security

   Which firewall capability identifies the application in traffic regardless of the port or protocol it uses?

   1. AUser-ID, which maps IP addresses to user identities so that policies can be applied to the people who are using the network
   2. BApp-ID, which identifies the application in traffic regardless of the port or protocol that the application uses
   3. CContent-ID, which inspects content for threats and sensitive data once the application has been identified by the firewall
   4. DPort-based rules, which allow traffic according to the port number alone, without being able to see which application it is
   Show answer and explanationHide answer

   Correct answer: B

   App-ID identifies applications by their traffic characteristics, not just their port numbers, so policies can target the application itself. User-ID and Content-ID do different jobs, and port rules cannot see the application.

4. Question 4Cloud Security

   In a SaaS application, which responsibility stays with the customer?

   1. AThe provider is responsible for every security decision, including the customer's user accounts and the sharing settings used
   2. BThe customer remains responsible for its data, identities and access settings, while the provider secures the application platform
   3. CThe customer is responsible only for the physical security of the data centre that hosts the SaaS application for the customer
   4. DResponsibility is split equally and is never clearly assigned, so no party needs to act on the security settings of the service
   Show answer and explanationHide answer

   Correct answer: B

   In SaaS, the customer keeps control of its data, identities and access settings, while the provider secures the platform. The other options assign responsibilities incorrectly or leave them unassigned.

5. Question 5Security Operations and Endpoint Protection

   What does a SIEM primarily do?

   1. ABlocks web requests from unauthorised countries at the network edge, using an allowlist of addresses maintained by the team
   2. BEncrypts data on the disks of the company's laptops, so that a stolen device cannot be read by an unauthorised person
   3. CCollects and correlates log and security event data from many sources, to detect and investigate incidents
   4. DAssigns IP addresses to devices as they join the network, and manages the address pool for the site during the working day
   Show answer and explanationHide answer

   Correct answer: C

   A SIEM collects and correlates events from many sources to support detection and investigation. Disk encryption, geographic blocking and address management are different controls.