PCCET Paloalto Networks Palo Alto Networks Certified Cybersecurity Entry-level Technician Free Practice Exam Questions (2025 Updated)

List three advantages of serverless computing over

CaaS: - Reduce costs - Increase agility - Reduce operational overhead

Identity and access management (IAM) is a software service or framework that allows organizations to define user or group identities within software environments, then associate permissions with them. The identities and permissions are usually spelled out in a text file, which is referred to as an IAM policy.

A botnet is a network of computers or devices that are infected by malware and controlled by a malicious actor, known as the botmaster or bot-herder. The botmaster uses a command and control (C2) server or channel to send instructions to the bots and receive information from them. The C2 communication is essential for the botmaster to maintain control over the botnet and use it for various malicious purposes, such as launching distributed denial-of-service (DDoS) attacks, stealing data, sending spam, or mining cryptocurrency. Therefore, the key to “taking down” a botnet is to prevent the bots from communicating with the C2 server or channel. This can be done by disrupting, blocking, or hijacking the C2 communication, which can render the botnet ineffective, unstable, or inaccessible. For example, security researchers or law enforcement agencies can use techniques such as sinkholing, domain name system (DNS) poisoning, or domain seizure to redirect the bot traffic to a benign server or a dead end, cutting off the connection between the bots and the botmaster. Alternatively, they can use techniques such as reverse engineering, decryption, or impersonation to infiltrate the C2 server or channel and take over the botnet, either to disable it, monitor it, or use it for good purposes. References:

What is a Botnet? - Palo Alto Networks

Botnet Detection and Prevention Techniques | A Quick Guide - XenonStack

Botnet Mitigation: How to Prevent Botnet Attacks in 2024 - DataDome

What is a Botnet? Definition and Prevention | Varonis

Selective network security virtualization: Intra-host communications and live migrations are architected at this phase. All intra-host communication paths are strictly controlled to ensure that traffic between VMs at different trust levels is intermediated either by an on-box, virtual security appliance or by an off-box, physical security appliance.

Micro-segmentation is a VM-Series virtual firewall cloud deployment use case that reduces your environment’s attack surface. Micro-segmentation is the process of dividing a network into smaller segments, each with its own security policies and controls. This helps to isolate and protect workloads from lateral movement and unauthorized access, as well as to enforce granular trust zones and application dependencies. Micro-segmentation can be applied to virtualized data centers, private clouds, and public clouds, using software-defined solutions such as VMware NSX, Cisco ACI, and Azure Virtual WAN. References: Micro-Segmentation - Palo Alto Networks, VM-Series Deployment Guide - Palo Alto Networks, VM-Series on VMware NSX - Palo Alto Networks, VM-Series on Cisco ACI - Palo Alto Networks, VM-Series on Azure Virtual WAN - Palo Alto Networks

Phishing is a type of attack that involves sending fraudulent emails that appear to be from legitimate sources, such as banks, companies, or individuals, in order to trick recipients into clicking on malicious links, opening malicious attachments, or providing sensitive information12. The link to a malware website in the email is an example of a malicious link, which may lead to the installation of malware, ransomware, spyware, or other malicious software on the user’s device, or the redirection to a fake website that mimics a legitimate one, where the user may be asked to enter their credentials, personal information, or financial details34. Phishing emails often use social engineering techniques, such as creating a sense of urgency, curiosity, or fear, to persuade the user to click on the link or attachment, or to reply to the email5. Phishing emails may also spoof the sender’s address, domain, or logo, to make them look more authentic and trustworthy6.

Whaling, pharming, and spam are not the correct answers for this question. Whaling is a specific type of phishing that targets high-profile individuals, such as executives, celebrities, or politicians, with the aim of stealing their confidential information or influencing their decisions7. Pharming is a type of attack that involves redirecting the user’s web browser to a fake website, even if they enter the correct URL, by modifying the DNS server or the user’s hosts file. Spam is the unsolicited or unwanted electronic messages, such as emails, texts, or instant messages, that are sent in bulk to a large number of recipients, usually for advertising, marketing, or scamming purposes. References:

What is phishing? | Malwarebytes

Phishing - Wikipedia

Don’t Panic! Here’s What To Do If You Clicked On A Phishing Link

How can Malware spread through Email and How to Protect

What is phishing? How this cyber attack works and how to prevent it …

Identifying Illegitimate Email Links | Division of Information Technology

What is whaling? | NortonLifeLock

[What is pharming? | NortonLifeLock]

[What is spam? | NortonLifeLock]

Attack communication traffic is usually hidden with various techniques and

tools, including:

● Encryption with SSL, SSH (Secure Shell), or some other custom or proprietary encryption

● Circumvention via proxies, remote access tools, or tunneling. In some instances, use of

cellular networks enables complete circumvention of the target network for attack C2 traffic.

● Port evasion using network anonymizers or port hopping to traverse over any available open

ports

● Fast Flux (or Dynamic DNS) to proxy through multiple infected endpoints or multiple,

ever-changing C2 servers to reroute traffic and make determination of the true destination

or attack source difficult

● DNS tunneling is used for C2 communications and data infiltration

A directory service is a database that contains information about users, resources, and services in a network.

Command and Control: Attackers establish encrypted communication channels back to command-and-control (C2) servers across the internet so that they can modify their attack objectives and methods as additional targets of opportunity are identified within the victim network, or to evade any new security countermeasures that the organization may attempt to deploy if attack artifacts are discovered.

According to the NIST definition of cloud computing1, there are three service models for cloud computing: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). In the SaaS model, the cloud provider delivers the software applications over the internet, and the users access them from various devices through a web browser or a program interface. The cloud provider manages the underlying infrastructure, including the servers, databases, and code of the applications. The users do not need to install, update, or maintain the software, and they only pay for the service they use. The scenario described in the question is an example of the SaaS model, as the user is provided access over the internet to an application running on a cloud infrastructure, and the vendor hosts and maintains the servers, databases, and code of that application. References:

SP 800-145, The NIST Definition of Cloud Computing | CSRC

Final Version of NIST Cloud Computing Definition Published

NIST Cloud Computing Program - NCCP | NIST

SaaS - User responsible for only the data, vendor responsible for rest

 A rootkit is a type of malware that enables cyber criminals to gain access to and infiltrate data from machines without being detected. It covers software toolboxes designed to infect computers, give the attacker remote control, and remain hidden for a long period of time1 One of the most prominent characteristics of a rootkit is that it cannot be detected by antivirus because of its masking techniques. A rootkit may be able to subvert the software that is intended to find it, such as by hooking system calls, modifying kernel objects, or tampering with the registry2 Another prominent characteristic of a rootkit is that it takes control of the operating system. A rootkit may install itself in the kernel or the firmware of the device, giving it the highest level of privilege and access. A rootkit may also replace the bootloader or the BIOS of the machine, making it difficult to remove. A rootkit can use its control over the operating system to launch other malware, such as ransomware, bots, keyloggers, or trojans34 References:

1: What Is a Rootkit? How to Defend and Stop Them? | Fortinet

2: Rootkit - Wikipedia

3: What Is a Rootkit? – Microsoft 365

4: What is Rootkit? Attack Definition & Examples - CrowdStrike

Stateful packet inspection firewalls Second-generation stateful packet inspection (also known as dynamic packet filtering) firewalls have the following characteristics:

● They operate up to Layer 4 (Transport layer) of the OSI model and maintain state information about the communication sessions that have been established between hosts on the trusted and untrusted networks.

● They inspect individual packet headers to determine source and destination IP address, protocol (TCP, UDP, and ICMP), and port number (during session establishment only) to

determine whether the session should be allowed, blocked, or dropped based on configured

firewall rules.

● After a permitted connection is established between two hosts, the firewall creates and

deletes firewall rules for individual connections as needed, thus effectively creating a tunnel that allows traffic to flow between the two hosts without further inspection of individual packets during the session.

● This type of firewall is very fast, but it is port-based and it is highly dependent on the

trustworthiness of the two hosts because individual packets aren’t inspected after the

connection is established.

A credit card number is an example of PII that you need to prevent from leaving your enterprise network. PII, or personally identifiable information, is any information that can be used to identify an individual, either alone or in combination with other data. PII can be sensitive or non-sensitive, depending on the level of protection required and the potential harm if exposed. Sensitive PII includes data that can directly identify an individual and cause significant harm if leaked or stolen, such as financial information, medical records, or government-issued ID numbers. Non-sensitive PII includes data that is easily accessible from public sources and does not pose a high risk of identity theft, such as zip code, race, or gender. A credit card number is a sensitive PII because it can be used to access the cardholder’s account, make fraudulent transactions, or steal their identity. Therefore, it is important to prevent credit card numbers from leaving the enterprise network, where they could be intercepted by hackers, malicious insiders, or third parties. To protect credit card numbers and other sensitive PII, enterprises should implement data security measures such as encryption, tokenization, masking, access control, auditing, and monitoring. Additionally, enterprises should comply with data privacy laws and standards that regulate the collection, use, and protection of PII, such as the Payment Card Industry Data Security Standard (PCI DSS), the General Data Protection Regulation (GDPR), or the California Consumer Privacy Act (CCPA). References:

What is PII? Examples, laws, and standards | CSO Online

What is Personally Identifiable Information (PII)? | IBM

What Is Personally Identifiable Information (PII)? Types and Examples

What is PII (personally identifiable information)? - Cloudflare

What is Personally Identifiable Information (PII)? - Data Privacy Manager

Tunneling is a method of transporting data across a network using protocols that are not supported by that network. Tunneling works by encapsulating packets: wrapping packets inside of other packets. Tunneling within commonly used services is a technique that uses file sharing or an instant messenger client such as Meebo running over HTTP to bypass firewalls or other network restrictions. The data packets are encapsulated within HTTP packets and sent as normal web traffic. This way, the data packets can reach their destination without being blocked or detected by the network. References: What is tunneling? | Tunneling in networking | Cloudflare, What Is Network Tunneling & How Is It Used? | Traefik Labs, networking - What is HTTP tunneling? - Stack Overflow

"In serverless apps, the developer uploads only the app package itself, without a full container image or any OS components. The platform dynamically packages it into an image, runs the image in a container, and (if needed) instantiates the underlying host OS and VM and the hardware required to run them."

Virtualization improves the availability of IT systems and resources by enabling features such as12:

Resource optimization: Virtualization allows multiple virtual instances to share the same physical infrastructure, reducing hardware costs and increasing resource utilization.

Scalability: Virtualization enables rapid provisioning and deprovisioning of virtual instances, allowing organizations to scale up or down their IT capacity according to demand.

Disaster recovery: Virtualization facilitates backup and replication of virtual instances, allowing organizations to restore their IT systems and data in the event of a disaster or outage.

Fault tolerance: Virtualization supports high availability and load balancing of virtual instances, ensuring that IT systems and services remain operational even if one or more virtual instances fail. References: Virtualization Benefits: How Virtualization Improves Efficiency and Security | VMware, Virtualization Security - A Complete Guide - CyberExperts.com

Prisma SaaS is a cloud access security broker (CASB) solution that helps secure and manage SaaS applications. It provides advanced capabilities in risk discovery, data loss prevention, compliance assurance, data governance, user behavior monitoring, and advanced threat prevention12. The three services that are part of Prisma SaaS are:

Data Loss Prevention: This service helps prevent the leakage or exposure of sensitive data stored in SaaS applications. It allows you to define data patterns, policies, and actions to protect your data from unauthorized access or sharing3.

Data Exposure Control: This service helps identify and remediate data exposure risks in SaaS applications. It scans your data at rest and classifies it based on its sensitivity and exposure level. It also provides recommendations and remediation actions to reduce the risk of data breaches4.

Threat Prevention: This service helps detect and block malicious activities and threats in SaaS applications. It leverages the WildFire and AutoFocus threat intelligence services to analyze user and file activity and identify indicators of compromise. It also provides alerts and response actions to mitigate the impact of threats5.

References:

Prisma SaaS Overview

Prisma SaaS - Palo Alto Networks

Data Loss Prevention

Data Exposure Control

Threat Prevention

Sanctioned SaaS applications are those that are approved and supported by the organization’s IT department. They provide business benefits such as increased productivity, collaboration, and efficiency. They are fast to deploy because they do not require installation or maintenance on the user’s device. They require minimal cost because they are usually paid on a subscription or usage basis, and they do not incur hardware or software expenses. They are infinitely scalable because they can adjust to the changing needs and demands of the organization without affecting performance or availability12. References: 8 Types of SaaS Solutions You Must Know About in 2024, What is SaaS (Software as a Service)? | SaaS Types | CDW, Palo Alto Networks Certified Cybersecurity Entry-level Technician