CertArea
All Palo Alto Networks exams

Free Cybersecurity Practitioner practice test: 30 questions with answers

30 original questions for Cybersecurity Practitioner, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Cybersecurity Practitioner exam guide: topics, cost and format

All 30 Cybersecurity Practitioner questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Operations and Endpoint Protection (8 questions)

  1. Question 1

    Which tool collects endpoint telemetry and detects and responds to threats on endpoints, such as Cortex XDR does?

    1. AAn endpoint detection and response (EDR) tool, which collects telemetry and detects and responds to threats on endpoints
    2. BA print spooler, which queues the print jobs sent by users to the shared printers in the office on each floor of the building
    3. CA certificate authority, which issues certificates that bind public keys to the identities of servers and users on the network
    4. DA backup scheduler, which copies the files on each endpoint to a central server each night for recovery after a failure
    Show answer and explanation
    Correct answer: A

    EDR collects endpoint telemetry and detects and responds to threats, which is the function described. Print spoolers, certificate authorities and backup schedulers do not detect threats on endpoints.

  2. Question 2

    What does a SIEM primarily do?

    1. ABlocks web requests from unauthorised countries at the network edge, using an allowlist of addresses maintained by the team
    2. BEncrypts data on the disks of the company's laptops, so that a stolen device cannot be read by an unauthorised person
    3. CCollects and correlates log and security event data from many sources, to detect and investigate incidents
    4. DAssigns IP addresses to devices as they join the network, and manages the address pool for the site during the working day
    Show answer and explanation
    Correct answer: C

    A SIEM collects and correlates events from many sources to support detection and investigation. Disk encryption, geographic blocking and address management are different controls.

  3. Question 3

    Which incident response phase comes right after detection, with the aim of limiting the damage?

    1. AEradication only, which removes malware without first limiting the spread of the incident across other hosts in the network
    2. BPreparation, which creates the plans and tools before any incident occurs in the environment at all for the team
    3. CLessons learned, which reviews the incident after it has been closed in order to improve future responses by the team
    4. DContainment, which limits the spread of the incident and reduces its impact on the systems and data involved
    Show answer and explanation
    Correct answer: D

    Containment follows detection and aims to limit the incident's spread and impact. Preparation comes before detection, lessons learned come after closure, and eradication before containment risks spread.

  4. Question 4

    Which tool automates repetitive response tasks by running playbooks that coordinate actions across other security tools, such as Cortex XSOAR does?

    1. AA password manager that stores staff members' personal passwords for use on their own personal devices outside the company
    2. BA monitoring dashboard that displays the uptime of the company's public websites on a wall screen in the operations room
    3. CA security orchestration, automation and response (SOAR) platform, which runs playbooks that coordinate actions across tools
    4. DA video conferencing tool used by the team to hold its weekly security meetings with remote colleagues in other offices
    Show answer and explanation
    Correct answer: C

    A SOAR platform runs playbooks that automate and coordinate response actions across tools, which is what the description covers. Dashboards, password managers and video tools do not automate response.

  5. Question 5

    Which practice helps analysts prioritise a large queue of security alerts?

    1. AInvestigating alerts in the order they were first generated, regardless of their severity or the importance of the assets involved
    2. BTriaging by severity, asset criticality and context, so that the most important alerts are investigated first
    3. CClosing all alerts older than one day without review, to keep the queue short for the analysts at the start of each day
    4. DIgnoring alerts from internal systems, since internal systems are assumed to be trustworthy by the team's own policy
    Show answer and explanation
    Correct answer: B

    Triage by severity, asset criticality and context focuses effort where the risk is greatest. Ordering by arrival, closing old alerts unreviewed and ignoring internal systems each allow real threats to be missed.

  6. Question 6

    Which malware analysis approach runs an unknown file in an isolated environment to observe its behaviour, as WildFire does?

    1. AStatic reading of the file name only, which assumes that the names of the files reveal the intent of each file in the company
    2. BDynamic analysis in a sandbox, which runs the file safely and observes its behaviour, such as network calls and file changes
    3. CRunning the file on the production server to see whether it works before it is shared with the other users of the system
    4. DDeleting every unknown file without analysis, since the cost of analysis is always greater than the cost of the risk it addresses
    Show answer and explanation
    Correct answer: B

    Dynamic sandbox analysis observes what an unknown file does when it runs in isolation, which reveals malicious behaviour. Name reading, production testing and blanket deletion each skip or endanger the analysis.

  7. Question 7

    What should follow the discovery of a compromised endpoint?

    1. AGive the endpoint extra rights so that the team can investigate the malware without being blocked by any of the permissions
    2. BReboot the endpoint immediately and restore the files from last night's backup, without any investigation of the attack at all
    3. CShare the endpoint's hostname on a public forum so that others can help identify the source of the attack more quickly
    4. DIsolate the endpoint from the network to contain the threat, and then preserve evidence for the investigation
    Show answer and explanation
    Correct answer: D

    Isolation contains the threat, and preserving evidence supports the investigation and any later recovery. Rebooting without investigation, public posting and granting extra rights each damage containment or evidence.

  8. Question 8

    Which two activities are part of the detection and monitoring phase of a security operations workflow? (Choose two.)

    1. ACollecting and correlating logs and alerts from endpoints, networks and cloud services into one place for analysis
    2. BWriting the security policy each quarter and getting it approved by the board of directors at its meeting
    3. CReviewing alerts and deciding which ones need investigation, based on their context and their severity
    4. DSetting the office's wireless password once a year on the day the team receives the new access list from management
    5. EPrinting the monthly security report for the executives to read in the boardroom each Monday morning before the meeting
    Show answer and explanation
    Correct answer: A, C

    Collecting and correlating telemetry, and triaging alerts for investigation, are core detection and monitoring work. Policy writing, password setting and printing reports belong to other activities.

Cybersecurity Fundamentals (8 questions)

  1. Question 9

    Which security model assumes that no user, device or network is trusted by default, and verifies each request before access is granted?

    1. AZero trust, which verifies every request against identity, device and context before granting access to resources
    2. BPerimeter security, which trusts all traffic inside the firewall and concentrates protection on the outer boundary only
    3. CAir-gapping, which keeps a network physically disconnected from others, but does not verify individual requests at all
    4. DHoneynet deployment, which places decoy systems in the network so that attacker activity can be observed and studied later
    Show answer and explanation
    Correct answer: A

    Zero trust verifies each request against identity, device and context rather than trusting network location. Perimeter security trusts traffic inside the boundary, air-gapping isolates a network without verifying requests, and honeynets observe attackers rather than granting access.

  2. Question 10

    Which control requires a user to present two different kinds of factor before a login succeeds?

    1. ARole-based access, which assigns permissions by job role, regardless of how the user authenticated when signing in to the system
    2. BSingle sign-on, which lets one login reach several applications without additional verification being requested at each one
    3. CMulti-factor authentication, which combines factors such as something known, something owned and something inherent to the user
    4. DEncryption at rest, which protects stored data from being read without the decryption key held by the authorised system
    Show answer and explanation
    Correct answer: C

    Multi-factor authentication requires factors from different categories, such as a password and a device-generated code. Single sign-on, role-based access and encryption at rest do not require a second factor at sign-in.

  3. Question 11

    In the CIA triad, what does integrity mean?

    1. ASystems and data are available to authorised users at the times when they need to use them for their work
    2. BData is accurate and unaltered, except through authorised changes made by approved processes
    3. CInformation is seen only by parties that are authorised to see it, and is protected from disclosure to others
    4. DActions can be traced to the identity that performed them, through records that cannot be disputed by the user
    Show answer and explanation
    Correct answer: B

    Integrity means data stays accurate and is changed only through authorised processes. Availability, confidentiality and accountability are the other elements of the triad and the broader framework respectively.

  4. Question 12

    Which type of malware disguises itself as legitimate software to trick a user into installing it?

    1. AA logic bomb that triggers on a specific date after the attacker has already left the environment and removed its tools
    2. BA worm, which spreads automatically across networks without needing a user to open or run any file at all on each host
    3. CA rootkit that hides from the operating system's process list after it has been installed on a host by an attacker
    4. DA Trojan, which appears to be a useful program but carries a hidden malicious payload that runs after installation
    Show answer and explanation
    Correct answer: D

    A Trojan depends on deception, presenting as useful software to get installed. Worms spread without user action, rootkits conceal themselves after installation, and logic bombs trigger on conditions rather than disguise.

  5. Question 13

    Which social engineering technique uses a message that impersonates a trusted sender to obtain login credentials?

    1. APhishing, which uses a message that impersonates a trusted sender to trick the recipient into revealing credentials
    2. BPort scanning, which probes systems for open services without any interaction with the user at all during the probe
    3. CBuffer overflow, which writes data beyond a memory boundary so that it alters the execution flow of a program on a host
    4. DDenial of service, which floods a service with traffic so that legitimate users cannot reach it during the attack period
    Show answer and explanation
    Correct answer: A

    Phishing relies on impersonation to get the recipient to disclose credentials, which is the social engineering element. Port scanning, buffer overflows and denial of service are technical attacks that do not depend on impersonating a trusted sender.

  6. Question 14

    Which control limits the damage when a phishing attack has captured a user's password?

    1. AShared accounts, which hide individual activity so that an attacker is harder to trace back to any single identity afterwards
    2. BLonger session timeouts, which keep an attacker's session open for longer so that the security team can observe its activity
    3. CMulti-factor authentication, which means a stolen password alone is not enough to access the account
    4. DDisabling logging, which reduces the volume of records the attacker can read during the intrusion on the affected systems
    Show answer and explanation
    Correct answer: C

    Multi-factor authentication stops a captured password from being sufficient on its own. Longer sessions, shared accounts and disabled logging each increase the attacker's opportunity or reduce visibility.

  7. Question 15

    Which two items are typical components of a defence-in-depth strategy? (Choose two.)

    1. ALayered controls across network, endpoint, identity and data, so that the failure of one layer is contained by another
    2. BA single very large firewall protecting all assets, with no other controls in place at any layer of the environment
    3. CSecurity awareness training for staff, combined with technical controls that address the same risks from a second direction
    4. DDisabling all security tools during each release, to reduce complexity for the operations team during the deployment window
    5. ETrusting internal traffic completely, so that the firewall only needs to inspect traffic that arrives from the internet
    Show answer and explanation
    Correct answer: A, C

    Layering controls across domains, and combining people-focused and technical controls against the same risks, is the essence of defence in depth. One large firewall, disabled tools and implicit internal trust each leave a single point of failure.

  8. Question 16

    Which principle gives users only the access they need to do their job?

    1. AMaximum privilege, which gives users broad access so that their work is never blocked by a missing permission at any time
    2. BLeast privilege, which gives each user only the access required to perform the tasks assigned to their role
    3. CShared privilege, which lets groups of users share one account so that access is simpler to administer across the team
    4. DDelegated privilege, which lets managers grant any access they wish to their staff members without any review by others
    Show answer and explanation
    Correct answer: B

    Least privilege limits each user to the access their role requires, which limits the damage a compromised account can do. Maximum, shared and unreviewed delegated privilege all widen access beyond what is needed.

Network Security (7 questions)

  1. Question 17

    Which firewall capability identifies the application in traffic regardless of the port or protocol it uses?

    1. AUser-ID, which maps IP addresses to user identities so that policies can be applied to the people who are using the network
    2. BApp-ID, which identifies the application in traffic regardless of the port or protocol that the application uses
    3. CContent-ID, which inspects content for threats and sensitive data once the application has been identified by the firewall
    4. DPort-based rules, which allow traffic according to the port number alone, without being able to see which application it is
    Show answer and explanation
    Correct answer: B

    App-ID identifies applications by their traffic characteristics, not just their port numbers, so policies can target the application itself. User-ID and Content-ID do different jobs, and port rules cannot see the application.

  2. Question 18

    Which network security element restricts traffic between network zones according to a policy?

    1. AA firewall security policy between zones, which allows or denies traffic based on source, destination and application
    2. BA load balancer, which spreads incoming requests across a group of servers in order to maintain the availability of the service
    3. CA DNS server, which translates domain names into IP addresses for the clients that request the translation from it
    4. DA DHCP server, which assigns IP addresses to clients automatically when they connect to the network for the first time
    Show answer and explanation
    Correct answer: A

    A firewall security policy between zones is what controls movement between them, based on source, destination and application. Load balancers, DNS and DHCP provide other network services rather than zone policy enforcement.

  3. Question 19

    What is the purpose of a VPN in a network security design?

    1. ATo encrypt traffic over an untrusted network between two endpoints or two sites, so that it cannot be read in transit
    2. BTo increase the speed of local file transfers between the servers in one data centre by compressing the traffic each time
    3. CTo assign IP addresses to devices as they join the network, without any manual configuration needed by the operations team
    4. DTo block all outbound internet traffic from the office, so that staff cannot browse the web during their working day
    Show answer and explanation
    Correct answer: A

    A VPN encrypts traffic across an untrusted network between endpoints or sites. Speed, address assignment and blocking browsing are other functions that a VPN is not designed to provide.

  4. Question 20

    Which technology lets remote users connect securely to corporate resources, for example through the GlobalProtect client?

    1. AA web proxy that caches pages for staff browsing on the office network each morning before the working day begins
    2. BA remote access VPN client that establishes an encrypted tunnel to the corporate gateway on behalf of the user
    3. CA network time server that keeps device clocks synchronised with the central reference time source for the network
    4. DA printer driver that sends print jobs to the office printers across the wide area network connection of the company
    Show answer and explanation
    Correct answer: B

    A remote access VPN client creates an encrypted tunnel to the corporate gateway, which is how remote users reach internal resources securely. Caching proxies, time servers and printer drivers serve different purposes.

  5. Question 21

    Which element inspects traffic for known exploit signatures and blocks the matching traffic?

    1. AQuality of service, which prioritises voice and video traffic so that calls remain clear during busy periods on the network
    2. BRoute summarisation, which combines several routes into one entry in order to reduce the size of the routing table on the device
    3. CLink aggregation, which combines several physical links into one logical link in order to provide higher total throughput
    4. DThreat prevention, which uses signatures and other techniques to detect and block known exploits within the traffic it inspects
    Show answer and explanation
    Correct answer: D

    Threat prevention inspects traffic for exploits and blocks matches, which is the function described. Route summarisation, link aggregation and quality of service handle routing, throughput and prioritisation rather than threat inspection.

  6. Question 22

    Which two practices reduce the risk of lateral movement inside a network? (Choose two.)

    1. ASegmenting the network into zones, with policies that allow only the traffic each zone needs to function correctly
    2. BAllowing all internal hosts to communicate freely, so that troubleshooting is simpler for the operations team to carry out
    3. CEnforcing least-privilege access between zones, and monitoring east-west traffic for unusual flows between internal hosts
    4. DPlacing every server in the same flat subnet, so that the servers can reach each other without any routing involved
    5. EUsing the same credentials for every server, so that administrators can move between the servers more quickly each day
    Show answer and explanation
    Correct answer: A, C

    Zoning, least-privilege access between zones and monitoring east-west flows limit an attacker's movement. Free internal communication, flat subnets and shared credentials make lateral movement easy.

  7. Question 23

    Which firewall feature associates network traffic with the user who generated it?

    1. AContent-ID, which inspects content for threats and sensitive data, but does not map the traffic to any user identity itself
    2. BApp-ID, which identifies the application in the traffic regardless of the port number that the application happens to use
    3. CUser-ID, which maps IP addresses to user identities so that policies can apply to the people generating the traffic
    4. DPort-based rules, which record the port number of each connection but do not identify the user generating the connection
    Show answer and explanation
    Correct answer: C

    User-ID maps IP addresses to user identities so that policy can follow the person. App-ID and Content-ID do other jobs, and port-based rules do not identify users.

Cloud Security (7 questions)

  1. Question 24

    In a SaaS application, which responsibility stays with the customer?

    1. AThe provider is responsible for every security decision, including the customer's user accounts and the sharing settings used
    2. BThe customer remains responsible for its data, identities and access settings, while the provider secures the application platform
    3. CThe customer is responsible only for the physical security of the data centre that hosts the SaaS application for the customer
    4. DResponsibility is split equally and is never clearly assigned, so no party needs to act on the security settings of the service
    Show answer and explanation
    Correct answer: B

    In SaaS, the customer keeps control of its data, identities and access settings, while the provider secures the platform. The other options assign responsibilities incorrectly or leave them unassigned.

  2. Question 25

    Which cloud security tool continuously assesses cloud configurations against best-practice policies?

    1. AA cloud security posture management tool, which checks cloud configurations against policies and reports misconfigurations
    2. BA network packet broker, which copies traffic from switch ports to analysis tools for packet capture purposes on the network
    3. CA print management server, which manages the queues and the drivers for the office printers across the sites of the company
    4. DA word processor with a spell checker, which corrects mistakes in the text of the security policy documents held by the team
    Show answer and explanation
    Correct answer: A

    Cloud security posture management tools continuously check configurations against policies and report misconfigurations. Packet brokers, print servers and word processors do not assess cloud configuration.

  3. Question 26

    Which control determines who can access a cloud storage bucket and what they can do with it?

    1. AThe bucket's region setting, which controls the colour of the console page that the team uses when managing the bucket
    2. BA decorative label on the bucket that shows the purpose of the storage to the team when they view it in the console
    3. CIdentity and access management policies that grant specific roles to identities for that bucket
    4. DThe bucket's creation date, which determines how long the data can be kept before it is deleted automatically by the platform
    Show answer and explanation
    Correct answer: C

    IAM policies grant roles to identities for specific resources, which is how bucket access is controlled. Labels, region settings and creation dates do not determine access.

  4. Question 27

    Which practice reduces the risk that a container image with known vulnerabilities reaches production?

    1. AUsing the newest image tag without checking its contents, on the assumption that a new tag is always secure to deploy
    2. BDeploying every image without scanning, so that the release is never delayed by the security checks applied to the image
    3. CScanning images for vulnerabilities in the build pipeline, and blocking deployment of any image that fails the policy
    4. DRunning containers as root on every host, which the team believes makes troubleshooting faster for the engineers on call
    Show answer and explanation
    Correct answer: C

    Scanning in the pipeline and blocking failing images stops known-vulnerable images before they reach production. Skipping scans, trusting new tags and running as root each increase the risk.

  5. Question 28

    What is a common cause of cloud data exposure?

    1. AUsing least-privilege roles for the workloads that need to read the data stored in the buckets of the environment
    2. BUsing encryption for data in transit between the application and the users of the service, as the policy requires for all data
    3. CEnabling multi-factor authentication for administrators of the cloud accounts that the team uses to manage the workloads
    4. DMisconfigured storage permissions that make the data reachable by anyone on the internet without authentication
    Show answer and explanation
    Correct answer: D

    Misconfigured permissions are among the most common causes of cloud data exposure. Encryption in transit, multi-factor authentication and least privilege all reduce exposure rather than cause it.

  6. Question 29

    Which two actions help secure a multi-cloud environment? (Choose two.)

    1. AApplying consistent security policies across providers, with a single view of security posture across all of them
    2. BGiving each team separate, unmanaged accounts in each cloud, so that each team can choose its own settings freely
    3. CCentralising logging from each cloud into one place, so that detection and investigation work across all providers
    4. DDisabling audit logs in one cloud to reduce the cost of storing the logs that come from that particular provider
    5. ESharing root account credentials across providers, so that the team can recover access quickly in an emergency at any time
    Show answer and explanation
    Correct answer: A, C

    Consistent policy and centralised logging give visibility and control across providers. Unmanaged accounts, disabled logs and shared root credentials each add risk and blind spots.

  7. Question 30

    Which cloud service model gives the customer control over the operating system and applications, while the provider runs the underlying infrastructure?

    1. AInfrastructure as a Service (IaaS), where the customer manages the operating system and applications on virtual machines
    2. BSoftware as a Service (SaaS), where the provider runs the entire application and the customer only uses it through a browser
    3. CFunction as a Service only, where the provider runs the code and the customer manages none of the underlying infrastructure
    4. DBackup as a Service only, which stores copies of data offsite for the customer without giving control of any operating system
    Show answer and explanation
    Correct answer: A

    IaaS gives the customer control of the operating system and applications on virtual machines, while the provider runs the infrastructure. SaaS gives the least control, while FaaS and backup services do not give control of an operating system.