Palo Alto Networks (PANW) Certified Cybersecurity Entry-level Technician (PCCET) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which group is primarily motivated by money?
• Which device is M2M (machine to machine)?
• What term refers to software versions, OS settings, and configuration file settings collectively?
• DLP works in which layer of the ISO model?
• Which of the following is a characteristic of a switch?
• What is the primary role of a Security Information and Event Management (SIEM) system?
• Which type of attack utilizes many endpoints as bots or attackers in a coordinated effort, and can be extremely effective in taking down a website or some other publicly accessible service?
• Which technology is primarily used to protect data stored on endpoints?
• What type of malware can have multiple control servers distributed all over the world with multiple fallback options?
• Which kind of security is always the responsibility of the cloud customer?
• What role does automation play in a SOC?
• Which phased approach of hybrid cloud security requires networking and security solutions that are virtualization-aware and can dynamically adjust?
• Who is responsible for the security settings of a sanctioned SaaS application?
• What does the acronym DDoS stand for in cybersecurity?
• An analysis tool raised an alert, but the security analyst who researched it discovered it wasn't a problem. Which type of finding is this?
• Which technology or technique can be implemented to detect, deflect, and counteract malicious activities?
• Which DevOps CI/CD pipeline feature requires developers to integrate code into a repository several times per day for automated testing?
• Which SASE security-as-a-service layer capability understands where sensitive data resides and enforces company policies for user access?
• Which element refers to technologies that enable organizations to collect inputs monitored by the Security Operations team?
• What is the purpose of NDP?
• Which Palo Alto Networks product suite is used to secure the data center?
• What does it mean when a SaaS application is advertised as HIPAA compliant?
• Which MDM capability requires passcodes, enables encryption, locks down security settings, and prevents jailbreaking or rooting?
• To ensure compliance with security standards, which systems must be secured?
• What is the primary purpose of the information exchanged by routing protocols?
• Which VPN technology has become the standard method of connecting remote endpoint devices back to the enterprise network?
• What is the primary function of WildFire in NGFW?
• What type of service is typically provided by a company like AWS for scalable storage?
• Which behavior does an advanced persistent threat use to elude detection?
• Which team is responsible for developing, implementing, and maintaining the network security policies?
• Which type of system does not perform any preventive action to stop an attack?
• Activity gathered by a SOC team electronically and in real-time from a given source is called?
• WPA2 includes a function that generates a 256-bit key based on a much shorter passphrase created by the administrator of the Wi-Fi network and the service set identifier (SSID) of the AP is used as a salt (random data) for the one-way hash function. Is this statement true or false?
• What type of attack focuses on gathering sensitive data from the applications of a specific target?
• What does SASE stand for?
• Which network device transmits an electronic signal allowing wireless devices to connect to a network?
• Which security issue can cause a long patched vulnerability to resurface?
• Which cloud native security platform function remediates vulnerabilities and misconfigurations across the entire lifecycle?
• What is the difference between CVE and CVSS?
• Which type of network firewall provides client address translation by default?
• Which cloud deployment model allows multiple organizations to share resources while maintaining individual privacy?
• Which record specifies authoritative information about a DNS zone?
• Which team identifies potential risks to the organization that have not yet been observed in the network?
• Which type of malware protection can be bypassed by mutating malware?
• When is it impossible to secure SaaS data?
• Which option is a type 2 hypervisor?
• Which option is an example of a logical address?
• What does Zero Trust mean?
• An attacker needs to succeed in executing only one step of the cyberattack lifecycle to infiltrate a network, whereas a defender must "be right every time". What is the correct response?
• The spread of unsolicited content to targeted endpoints is known as what?
• The key to breaking the cyberattack lifecycle during the Installation phase is to implement which of the following?
• A SOC manager is concerned that some alerts may be critical and the team will need help mitigating all of them. What should be done?
• Which WildFire verdict is given for a submission that is malicious in nature and intent and can pose security threats such as viruses, worms, and rootkits?
• What is a primary characteristic of a stateful firewall?
• Which NGFW feature can differentiate between reading and commenting on Facebook?
• Which type of attack would include an e-mail with your name that claims to be from your bank and tells you to click the link https://chase.bankofamerica.mysite.ru?
• Which team is responsible for identifying and escalating vulnerabilities in an organization's assets?
• Which NIST cloud deployment model would you recommend for a startup that does not have much money to pay for hosting or a data center and needs a 24x7 server?
• Who is responsible for the software of a sanctioned SaaS application?
• Which type of traffic can stay contained in a single physical server?
• Which cloud security best practice ensures persons accessing data have only necessary privileges?
• Which NGFW core subscription allows your firewall to block known malware?
• Which type of traffic can be secured by a physical appliance?
• What primary advantage does a container technology provide in a virtualized environment?
• Which type of attack would include an email advertisement for a dry cleaning service?
• You downloaded a confidential file to your phone, but it’s no longer there. Which MDM feature could be the reason?
• Which Panorama object is used to manage network settings?
• Which sanctioned SaaS use control prevents known and unknown malware from residing in sanctioned SaaS applications?
• Which cloud service model provides the most control to the customers over their applications and data?
• Which stage of the cyberattack lifecycle involves querying public databases and testing exploits in the attacker's internal network?
• Which port is used for encrypted communication?
• Which of the following is a primary function of a Security Operations Center (SOC)?
• Which NGFW core subscription allows your firewall to identify zero-day malware?
• How often should tabletop exercises be performed?
• Is signature-based anti-malware software considered a reactive countermeasure?
• Of the endpoint checks, which one is bypassed for known programs?
• What is the primary purpose of using a WildFire query in endpoint checks?
• A zero-day exploit uses which type of vulnerability?
• Which value can be achieved by the ability to pool resources in cloud computing?
• What tool or technology can provide a SOC team with control of the provisioning, maintenance, and operation of user identities?
• The internet is an example of a wide-area network (WAN). True or False?
• Which type of endpoint protection wraps a protective virtual barrier around vulnerable processes while they are running?
• In the context of cybersecurity, what does a vulnerability in the CVSS scoring system signify?
• A news company can serve all requests from their data center 95% of the time. However, some days there is a huge demand for news updates. Which NIST deployment model would you recommend to them?
• Introducing security checks early in the software development process is part of which development model?
• What is the standard protocol commonly used for accessing directories?
• Which feature can mitigate or block malicious behavior and is considered a proactive control?
• Which stage of the cyberattack lifecycle can be identified by port scans from external sources?
• Which wireless security protocol offers enhanced security for IoT devices and smart appliances?
• Organizations are using which resource to expand their on-premises private cloud compute capacity?
• Which cloud infrastructure comprises two or more cloud deployment models, bound by standardized or proprietary technology that enables data and application portability?
• Which framework provides best practices for information security management?
• Which element is a tool to assist organizations in aggregating, correlating, and analyzing threat data from multiple sources?
• Which type of analysis focuses on examining the network for the latest threats and vulnerabilities?
• Which standard is often used to secure wireless networks?
• Business intelligence (BI) software consists of tools and techniques used to surface large amounts of raw unstructured data to perform a variety of tasks, including data mining, event processing, and predictive analytics. Is this statement true or false?
• Which Wi-Fi attack intercepts the victim's web traffic, redirects the victim's browser to a web server that it controls, and serves up whatever content the attacker desires?
• Which endpoint protection technique is commonly used to prevent end users from running unauthorized applications, including malware, on their endpoints?
• Which element is a security technology that detects malicious activity by identifying anomalous behavior indicative of attacks?
• Which zero trust deployment method obtains a detailed picture of traffic flows throughout the network?
• Which SOAR goal enables a SOC team to use playbook orchestration to extract more value through task automation and coordination?
• What type of server is a master server that is designed to listen to individual compromised endpoints and respond with appropriate attack commands?
• Which NGFW core subscription alerts the firewall of a potential attack from a suspicious domain?
• Which type of malware protection is vulnerable to a low and slow approach?
• What is the subnet mask for the network 10.2.0.0/20?
• Which device type uses routing protocols to exchange information?
• Which Zero Trust capability combines anti-malware and intrusion prevention technologies for comprehensive protection?
• A robust data loss prevention (DLP) solution can detect data patterns even if the data is encrypted. Is this statement True or False?
• Which Panorama object is used to manage the security policy?
• Which team is responsible for managing, monitoring, and responding to alerts that may impact the availability and performance of the IT infrastructure?
• Which statement is correct regarding the relationship between vulnerabilities and exploits?
• Which Palo Alto Networks product suite is used to manage alerts, obtain additional information, and orchestrate responses?
• Which type of firewall operates up to Layer 4 (transport layer) of the OSI model and inspects individual packet headers to determine source and destination IP address, protocol (TCP, UDP, ICMP), and port number?
• Which device processes logical addresses?
• Which software development concept describes anticipated additional future costs for rework due to an earlier decision necessary for agility?
• Prisma Access consistently protects all traffic, on all ports and from all applications. (True or False)
• What is the purpose of the shared responsibility model?
• Gmail is associated with which cloud computing model?
• Which malware type can change code and signature patterns with each iteration?
• What is the most common business to consumer (B2C) VPN?
• Which component of a security operating platform can identify a trojan horse that does not use the network?
• Which type of algorithm does Prisma SaaS use for document classification and categorization?
• Which business objective includes details about how the Security Operations organization will achieve its goals?
• Which of the following actions cannot be performed by Cortex XSOAR?
• Which type of firewall requires the least amount of RAM per connection?
• Which core component of Cortex combines security orchestration, incident management, and interactive investigation?
• What tool or technology can a SOC team use to detect and prevent accidental or malicious release of proprietary or sensitive information?
• In cybersecurity, what does RBAC stand for?
• How many OS instances are being run when ten containers are spread between five virtual machines on two type 1 hypervisors?
• Which NIST cloud service model requires the customer to keep the operating system up to date?
• What is the primary function of an application firewall?
• Which cloud use model runs just one container per virtual machine?
• Which type of technology does Cortex XDR use to improve threat detection?
• An analysis tool's machine learning identified, correctly, that the network is infected by a worm. Which type of finding is this?
• What is the main objective of an Incident Response Plan?
• Which type of attack would include an email with an attachment named not-a-trojan.exe?
• Which business objective dictates how to measure "performance" against the defined and socialized mission statement?