PALO ALTO EXAM SCRIPT 2026 DETAILED
QUESTIONS GRADED A+
◍ T. Answer: Business intelligence (BI) software consists of tools and
techniques used to surface large amounts of raw unstructured data to
perform a variety of tasks including data mining, event processing,
and predictive analytics. (True or False)
◍ T. Answer: The process in which end users find personal
technology and apps that are more powerful or capable, more
convenient, less expensive, quicker to install, and easier to use than
enterprise IT solutions is known as consumerization. (True or False)
◍ T. Answer: An organization can be compliant with all applicable
security and privacy regulations for its industry, yet still not be secure.
(True or False)
◍ HIPAA. Answer: The U.S. law that establishes national standards
to protect individuals' medical records and other health information is
known as _______.
◍ F. Answer: Most cyberattacks today are perpetrated by internal
threat actors such as malicious employees engaging in corporate
espionage. (True or False)
◍ F. Answer: The Cyber-Attack Lifecycle is a five-step process that
an attacker goes through to attack a network. (True or False)
,◍ Reconnaissance, Weaponization, Delivery, Exploitation,
Installation, Command and Control, Actions on Objectives. Answer:
List the steps of the Cyber-Attack Lifecycle.
◍ F. Answer: An attacker needs to succeed in executing only one step
of the Cyber-Attack Lifecycle to infiltrate a network, whereas a
defender must "be right every time" and break every step of the chain
to prevent an attack. (True or False)
◍ C. Answer: Which technique is not used to break the command-
and-control (C&C) phase of the Cyber-Attack Lifecycle?
A. Blocking outbound traffic to known malicious sites and IP
addresses
B. DNS sinkholing and DNS poisoning
C. Vulnerability and patch management
D. All of the above
◍ T. Answer: The key to breaking the Cyber-Attack Lifecycle during
the Installation phase is to implement network segmentation, a Zero
Trust model, and granular control of applications to limit or restrict an
attacker's lateral movement within the network. (True or False)
◍ T. Answer: Network firewalls cannot completely protect hosts from
zero-day exploits. (True or False)
,◍ Zero-day. Answer: _______________ exploits target unknown
vulnerabilities in operating system and application software on a host
machine.
◍ B. Answer: Which option describes malicious software or code that
typically takes control of, collects information from, or damages an
infected endpoint?
A. Exploit
B. Malware
C. Vulnerability
D. None of the above
◍ D. Answer: Which option is an important characteristic or
capability of advanced malware?
A. Distributed, fault-tolerant architecture
B. Multi-functionality
C. Hiding techniques such as polymorphism, metamorphism, and
obfuscation
D. All of the above
◍ F. Answer: A vulnerability is a small piece of software code, part of
a malformed data file, or a sequence (string) of commands created by
an attacker to cause unintended or unanticipated behavior in a system
or software. (True or False)
, ◍ F. Answer: New exploits can be crafted from any number of more
than a thousand core exploit techniques. (True or False)
◍ F. Answer: Wired Equivalent Privacy (WEP) is an effective
protocol for securing wireless networks. (True or False)
◍ hash. Answer: A _________________ is a mathematical function
that creates a unique representation of a larger set of data in a manner
that is easy to compute in one direction, but not in the reverse
direction.
◍ router. Answer: A _________________ sends data packets to
destination networks along a network path using logical addresses.
◍ C. Answer: Which option is an example of a static routing
protocol?
A. Open Shortest Path First (OSPF)
B. Border Gateway Protocol (BGP)
C. Routing Information Protocol (RIP)
D. Split horizon
◍ ABC. Answer: Which three options are dynamic routing protocols?
(Choose three.)
A. Distance-vector
B. Path-vector
C. Link-state
QUESTIONS GRADED A+
◍ T. Answer: Business intelligence (BI) software consists of tools and
techniques used to surface large amounts of raw unstructured data to
perform a variety of tasks including data mining, event processing,
and predictive analytics. (True or False)
◍ T. Answer: The process in which end users find personal
technology and apps that are more powerful or capable, more
convenient, less expensive, quicker to install, and easier to use than
enterprise IT solutions is known as consumerization. (True or False)
◍ T. Answer: An organization can be compliant with all applicable
security and privacy regulations for its industry, yet still not be secure.
(True or False)
◍ HIPAA. Answer: The U.S. law that establishes national standards
to protect individuals' medical records and other health information is
known as _______.
◍ F. Answer: Most cyberattacks today are perpetrated by internal
threat actors such as malicious employees engaging in corporate
espionage. (True or False)
◍ F. Answer: The Cyber-Attack Lifecycle is a five-step process that
an attacker goes through to attack a network. (True or False)
,◍ Reconnaissance, Weaponization, Delivery, Exploitation,
Installation, Command and Control, Actions on Objectives. Answer:
List the steps of the Cyber-Attack Lifecycle.
◍ F. Answer: An attacker needs to succeed in executing only one step
of the Cyber-Attack Lifecycle to infiltrate a network, whereas a
defender must "be right every time" and break every step of the chain
to prevent an attack. (True or False)
◍ C. Answer: Which technique is not used to break the command-
and-control (C&C) phase of the Cyber-Attack Lifecycle?
A. Blocking outbound traffic to known malicious sites and IP
addresses
B. DNS sinkholing and DNS poisoning
C. Vulnerability and patch management
D. All of the above
◍ T. Answer: The key to breaking the Cyber-Attack Lifecycle during
the Installation phase is to implement network segmentation, a Zero
Trust model, and granular control of applications to limit or restrict an
attacker's lateral movement within the network. (True or False)
◍ T. Answer: Network firewalls cannot completely protect hosts from
zero-day exploits. (True or False)
,◍ Zero-day. Answer: _______________ exploits target unknown
vulnerabilities in operating system and application software on a host
machine.
◍ B. Answer: Which option describes malicious software or code that
typically takes control of, collects information from, or damages an
infected endpoint?
A. Exploit
B. Malware
C. Vulnerability
D. None of the above
◍ D. Answer: Which option is an important characteristic or
capability of advanced malware?
A. Distributed, fault-tolerant architecture
B. Multi-functionality
C. Hiding techniques such as polymorphism, metamorphism, and
obfuscation
D. All of the above
◍ F. Answer: A vulnerability is a small piece of software code, part of
a malformed data file, or a sequence (string) of commands created by
an attacker to cause unintended or unanticipated behavior in a system
or software. (True or False)
, ◍ F. Answer: New exploits can be crafted from any number of more
than a thousand core exploit techniques. (True or False)
◍ F. Answer: Wired Equivalent Privacy (WEP) is an effective
protocol for securing wireless networks. (True or False)
◍ hash. Answer: A _________________ is a mathematical function
that creates a unique representation of a larger set of data in a manner
that is easy to compute in one direction, but not in the reverse
direction.
◍ router. Answer: A _________________ sends data packets to
destination networks along a network path using logical addresses.
◍ C. Answer: Which option is an example of a static routing
protocol?
A. Open Shortest Path First (OSPF)
B. Border Gateway Protocol (BGP)
C. Routing Information Protocol (RIP)
D. Split horizon
◍ ABC. Answer: Which three options are dynamic routing protocols?
(Choose three.)
A. Distance-vector
B. Path-vector
C. Link-state
