16 free Palo Alto Networks Cybersecurity Practitioner practice questions from the CertStash pack of 113, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 16 free here, all 113 in the pack, and each step includes the one before it.
Get all 113 questions (US$39) · Download the first 10 as a PDF
Question 1
Which product functions as part of a SASE solution?
Show answer and explanation
Correct answer: D. Prisma SD-WAN
A SASE solution combines network and security functions delivered from the cloud, and SD-WAN is one of its core components alongside secure web gateway, firewall as a service, cloud access security broker and Zero Trust network access. Prisma SD-WAN supplies that wide area networking piece, and it sits with Prisma Access under the Prisma SASE offering. Among the choices, it is the product that functions as part of a SASE solution.
Why the other options are wrong
- A. Cortex is Palo Alto Networks' security operations and detection platform family, not a component of SASE.
- B. Prisma Cloud secures cloud workloads and infrastructure, and it is not part of the SASE solution.
- C. Kubernetes is an open source container orchestration system, not a SASE product.
Question 2
Which type of system collects data and uses correlation rules to trigger alarms?
Show answer and explanation
Correct answer: B. SIEM
A security information and event management (SIEM) system gathers data from firewalls, servers, cloud platforms, network devices and other tools, centralizes it and normalizes it into a common format. It then applies predefined correlation rules and algorithms to find relationships between events, such as repeated failed logins combined with suspicious IP activity. When a correlated pattern matches a rule, the SIEM generates an alert and can prioritize it by risk score, so analysts see meaningful signals instead of isolated log entries.
Why the other options are wrong
- A. SIM is an older log management and storage concept and is not the system defined by collecting data and triggering alarms through correlation rules.
- C. UEBA focuses on baselining user and entity behavior to spot anomalies, not on correlation rules across collected event data.
- D. SOAR automates response through playbooks and workflows after alerts exist, rather than collecting data and correlating it to trigger alarms.
Question 3
Which technology grants enhanced visibility and threat prevention locally on a device?
Show answer and explanation
Correct answer: A. EDR
Endpoint detection and response (EDR) runs on the device itself and gives visibility into endpoint activity such as process execution, file changes, network connections and user actions. It pairs that visibility with prevention capabilities, including blocking exploits by technique and stopping malicious behavior, so threats are caught and contained locally on the endpoint rather than only after data reaches a central system.
Why the other options are wrong
- B. An IDS monitors traffic and generates alerts but does not provide endpoint-level visibility or prevent threats on the device.
- C. A SIEM collects and correlates logs centrally and is not a local on-device protection technology.
- D. DLP targets the leakage of sensitive data and does not provide broad threat visibility and prevention on a device.
Question 4
Which type of system is a user entity behavior analysis (UEBA) tool?
Show answer and explanation
Correct answer: B. Active monitoring
UEBA is a behavioral analytics system. It continuously gathers data such as user activity, network traffic, and access logs, builds a profile of normal behavior for each user and entity, and compares current activity against that baseline. Deviations are flagged as possible insider threats, compromised accounts, or data exfiltration. Because it watches behavior on an ongoing basis, it functions as an active monitoring system rather than a store of records or an isolated analysis environment.
Why the other options are wrong
- A. Correlating describes how a SIEM links events from many sources, not the baseline-driven behavior monitoring of UEBA.
- C. UEBA analyzes behavior as it happens and is not a system for archiving data.
- D. Sandboxing detonates suspicious files in an isolated environment, which UEBA does not do.
Question 5
Which architecture model uses virtual machines (VMs) in a public cloud environment?
Show answer and explanation
Correct answer: D. Host-based
A host-based architecture runs workloads on virtual machines in a public cloud environment. Each VM carries its own operating system, so the customer remains responsible for securing that operating system and the data on it under the shared responsibility model. Protection typically combines configuration checks against approved baselines with runtime monitoring of the workload. Kubernetes and Docker are container technologies, and serverless removes server management from the customer entirely, so host-based is the VM model.
Why the other options are wrong
- A. Kubernetes orchestrates containers rather than being the architecture that uses VMs.
- B. Serverless runs event-driven functions on infrastructure the provider manages, with no VMs for the customer to run.
- C. Docker is a container platform, which is a different model from running full VMs.
Question 6
What is an event-driven snippet of code that runs on managed infrastructure?
Show answer and explanation
Correct answer: B. Serverless function
A serverless function is a small piece of code that runs in response to an event, such as an HTTP call, a storage change, or a database update. The cloud provider manages the servers underneath, which is why this model is called serverless. Functions may run for only a few seconds, so security relies on least-privilege permissions and continuous monitoring. An API, a hypervisor, and a Docker container are different technologies that are not defined as event-driven code on managed infrastructure.
Why the other options are wrong
- A. An API is an interface for communication between software and is not event-driven code on managed infrastructure.
- C. A hypervisor creates and manages virtual machines and is not a snippet of code.
- D. A Docker container packages an application and its dependencies and is not defined by event-driven execution on managed infrastructure.
Question 7
What type of attack redirects the traffic of a legitimate website to a fake website?
Show answer and explanation
Correct answer: B. Pharming
Pharming is an attack that uses technical means to send users to a fake website masquerading as a legitimate one, where they may disclose credentials or personal information. NIST notes that attackers can accomplish this by compromising infrastructure such as DNS or the user's endpoint, so a victim who types the correct address still lands on the fraudulent site. That redirection of traffic from a genuine site to a counterfeit one is what distinguishes pharming from attacks that rely on deceptive messages or on targeting people directly.
Why the other options are wrong
- A. A watering hole attack compromises a legitimate site that a targeted group visits, rather than redirecting traffic to a fake site.
- C. Spear phishing uses a targeted, personalized message to trick a specific person, and it does not redirect a website's traffic.
- D. Whaling is phishing aimed at senior executives, relying on deceptive messages rather than redirecting site traffic.
Question 8
Which technology helps Security Operations Center (SOC) teams identify heap spray attacks on company-owned laptops?
Show answer and explanation
Correct answer: C. EDR
Heap spraying is a memory-based exploitation technique that runs on the endpoint, so detecting it requires visibility into what happens on the laptop itself. Endpoint detection and response monitors process and memory behavior on the device and can block exploits by technique, which lets a SOC team identify, investigate and respond to this kind of activity on company-owned laptops.
Why the other options are wrong
- A. CSPM assesses cloud configuration posture and has no view into memory behavior on a laptop.
- B. ASM discovers and monitors the external attack surface and does not inspect exploit techniques on endpoints.
- D. CWP protects cloud workloads and is not the tool for company-owned laptops.
Question 9
Which methodology does Identity Threat Detection and Response (ITDR) use?
Show answer and explanation
Correct answer: A. Behavior analysis
Identity Threat Detection and Response focuses on how identities behave. It builds a baseline of normal activity for users, service accounts and privileged accounts, then uses behavior analysis to flag deviations such as unusual logins, abnormal access to resources, credential misuse, or privilege escalation. Because identity-based attacks often use valid credentials, there is no malicious file or known pattern to match, so spotting out-of-pattern behavior is what exposes them.
Why the other options are wrong
- B. Signature comparison only finds known patterns, and attacks that use stolen but valid credentials produce no known signature.
- C. Manual inspection of user activities does not scale and is not how ITDR works, which relies on automated analytics.
- D. Rule-based prioritization only ranks alerts that already exist and does not detect anomalous identity behavior.
Question 10
An administrator finds multiple gambling websites in the network traffic log.
What can be created to dynamically block these websites?
Show answer and explanation
Correct answer: A. URL category
Every site in a URL filtering database is assigned to a URL category. An administrator creates a URL Filtering profile that sets an action, such as block, for each category, including gambling, and attaches the profile to a security policy rule. Because the category is maintained by the database, newly categorized gambling sites are blocked dynamically without the administrator listing each address by hand. A custom URL category can also be created to cover sites the predefined categories miss.
Why the other options are wrong
- B. Custom signatures match specific threat or application patterns and are not used to categorize and block websites.
- C. A decryption policy controls which traffic is decrypted for inspection and does not by itself block sites.
- D. An application group bundles applications for policy convenience and does not classify websites by content category.
Question 11
Which two services does a managed detection and response (MDR) solution provide? (Choose two.)
Show answer and explanation
Correct answer: B, D. Incident impact analysis; Proactive threat hunting
A managed detection and response service extends an organization's security team with outside analysts. Those analysts hunt proactively for hidden and emerging threats using threat intelligence, before they cause damage. They also analyze incidents by reviewing endpoint, network, cloud and identity data to determine how far an attack reached and what caused it, and then help contain the threat and remove malicious activity.
Why the other options are wrong
- A. Improving application development is a software engineering function and is not part of a security monitoring and response service.
- C. Periodic firewall updates are routine device maintenance and are not what an MDR service delivers.
Question 12
Which security function enables a firewall to validate the operating system version of a device before granting it network access?
Show answer and explanation
Correct answer: C. Host intrusion prevention system (HIPS)
Host-based protection evaluates the state of the device itself. Host intrusion prevention operates on the endpoint, so it can examine host attributes such as the operating system version and patch level and apply host-based policy to them. Access to the network can then be limited to devices that meet the required security posture, which reduces risk from outdated or noncompliant systems before they connect.
Why the other options are wrong
- A. Sandboxing detonates unknown files to observe malicious behavior and does not check a device's operating system version.
- B. Stateless packet inspection examines individual packets against basic header rules and has no knowledge of host posture.
- D. ITDR detects anomalous identity activity and does not validate the operating system version of a device.
Question 13
Which statement describes advanced malware?
Show answer and explanation
Correct answer: C. It is designed to avoid detection and adapt.
Advanced malware is built to avoid detection and to adapt. Examples include fileless malware that runs in memory and abuses built-in tools such as PowerShell, rootkits that embed deep in the operating system and hide attacker activity, and AI-driven malware that adapts faster to evade defenses. These traits let it evade traditional antivirus and maintain long-term access, which is why catching it requires behavior-based and cloud-delivered analysis.
Why the other options are wrong
- A. Malware that operates openly and is caught by traditional antivirus is basic malware, not advanced malware.
- B. Advanced malware typically can exfiltrate data and persist, so lacking those abilities does not describe it.
- D. All running malware consumes system resources, so operating without consuming any is not a realistic characteristic.
Question 14
What role do containers play in cloud migration and application management strategies?
Show answer and explanation
Correct answer: A. They enable companies to use cloud-native tools and methodologies.
Containers bundle an application with its dependencies into a portable unit. That makes legacy applications easier to move, easier to maintain and better suited to cloud-native environments, without needing modifications in the target environment. They also support microservices, consistent CI/CD pipelines, and deployment across multiple cloud providers or a mix of on-premises and cloud resources, which is how they let companies adopt cloud-native tools and methodologies.
Why the other options are wrong
- B. Containers package and run applications and are not a storage service for cloud data.
- C. A template manager describes a provisioning or catalog tool, not the role containers play in migration and application management.
- D. Orchestrating VMs is the job of hypervisor and virtualization management platforms, whereas containers package applications.
Question 15
Which scenario highlights how a malicious Portable Executable (PE) file is leveraged as an attack?
Show answer and explanation
Correct answer: C. Embedding the file inside a .pdf to be downloaded and installed
A Portable Executable file is a Windows executable, so it only does harm once it runs on a victim's system. Embedding it inside a document such as a PDF disguises it as a harmless file, and when the user downloads, opens and installs the content the executable runs and delivers its payload. This is a typical delivery pattern in which a malicious file is hidden inside a trusted-looking file type to get past defenses and the user.
Why the other options are wrong
- A. A credential-harvesting web page is a phishing technique and does not involve a malicious executable file.
- B. Moving a file laterally after access has been granted describes a post-compromise stage rather than how the executable is used as the attack itself.
- D. Corrupting security device memory in transit describes an exploit against the device and is not how a malicious executable is leveraged.
Question 16
What are two examples of an attacker using social engineering? (Choose two.)
Show answer and explanation
Correct answer: A, C. Convincing an employee that they are also an employee; Acting as a company representative and asking for personal information not relevant to the reason for their call
Social engineering manipulates human psychology rather than exploiting technical flaws, and impersonation and pretexting are its classic forms. Convincing an employee that you are a fellow employee uses a false identity to earn trust and gain access or information. Posing as a company representative and asking for personal details unrelated to the call is a pretext that tricks the victim into disclosing information they should protect. Both depend on deceiving a person into acting against security interests.
Why the other options are wrong
- B. Gathering open-source intelligence is passive research that prepares an attack but involves no manipulation of a victim.
- D. Configuring a compromised website to install malware automatically is a technical drive-by exploit that does not rely on deceiving a person.
That was 16 of 113.
The full Palo Alto Networks Cybersecurity Practitioner pack has all 113 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 45 free as one PDF by email. Get the Half Pack →