PALO ALTO PCCET EXAMS SCRIPT 2026/2027 QUESTIONS
AND SOLUTIONS RATED A+
✔✔Which type of malware disables protection software?
A. anti-AV
B. Trojan horse
C. ransomware
D. worm - ✔✔A
✔✔Another term for a bot is a "zombie". (True or False) - ✔✔T
✔✔The spread of unsolicited content to targeted endpoints is known as what?
A. spamming
B. pharming
C. phishing
D. exploiting - ✔✔A
✔✔Which type of attack utilizes many endpoints as bots or attackers in a coordinated
effort, and can be extremely effective in taking down a website or some other publicly
accessible service?
A. Bluetooth
B. adware
C. distributed denial-of-service
D. man-in-the-middle - ✔✔C
✔✔Which Wi-Fi attack intercepts the victim's web traffic, redirects the victim's browser
to a web server that it controls, and serves up whatever content the attacker desires?
A. Evil Twin
B. SSLstrip
C. Emotet
D. Jasager - ✔✔B
✔✔Which part of APTs indicate that attackers use advanced malware and exploits and
typically also have the skills and resources necessary to develop additional cyberattack
tools and techniques?
A. Secure
B. Persistent
C. Threat
D. Advanced - ✔✔D
✔✔WPA2 includes a function that generates a 256-bit key based on a much shorter
passphrase created by the administrator of the Wi-Fi network and the service set
identifier (SSID) of the AP is used as a salt (random data) for the one-way hash
function. (True or False) - ✔✔T
,✔✔Which component of the zero trust conceptual architecture is called a "platform" to
reflect that it is made up of multiple distinct (and potentially distributed) security
technologies that operate as part of a holistic threat protection framework to reduce the
attack surface and correlate information about discovered threats?
A. Management infrastructure
B. Pocket of trust
C. Trust zone
D. Single component - ✔✔D
✔✔Which zero trust deployment method obtains a detailed picture of traffic flows
throughout the network, including where, when, and to what extent specific users are
using specific applications and data resources?
A. Define trust zones
B. Establish trust zones
C. Implement at major access points
D. Listen-only mode - ✔✔D
✔✔The Prisma suite secures public cloud environments, SaaS applications, internet
access, mobile users, and remote locations through a cloud-delivered architecture.
(True or False) - ✔✔T
✔✔Which network device transmits an electronic signal so that wireless devices can
connect to a network?
A. router
B. access point
C. hub
D. switch - ✔✔B
✔✔Which layer of the OSI model defines routing protocols and specifies how routers
communicate with each other on a network?
A. Network
B. Application
C. Data Link
D. Transport - ✔✔A
✔✔Which record specifies authoritative information about a DNS zone such as primary
name server, email address of the domain administrator, and domain serial number?
A. Canonical Name (CNAME)
B. Mail Exchanger (MX)
C. Pointer (PTR)
D. Start of Authority (SOA) - ✔✔D
✔✔Which 32-bit logical address is the most widely deployed version of IP?
,A. IPv6
B. IPv5
C. IPv4
D. IPv3 - ✔✔C
✔✔Subnetting should not be used to limit network traffic or limit the number of devices
that are visible to, or can connect to, each other. (True or False) - ✔✔F
✔✔What does the acronym CIDR represent?
A. Classful Inter Dependant Routing
B. Classless Inter-Domain Routing
C. Classless Inter Dependant Routing
D. Classful Inter Domain Routing - ✔✔B
✔✔Which IDS/IPS system uses a database of known vulnerabilities and attack profiles
to identify intrusion attempts?
A. knowledge-based
B. behavior-based
C. intuitive-based
D. standards-based - ✔✔A
✔✔Which type of system does not perform any preventive action to stop an attack?
A. data loss prevention
B. Intrusion Prevention
C. Unified Threat Management
D. intrusion detection - ✔✔D
✔✔A robust data loss prevention (DLP) solution can detect data patterns even if the
data is encrypted. (True or False) - ✔✔T
✔✔Which next-generation product replaces UTM appliances to reduce traffic inspection
latency?
A. hub
B. switch
C. firewall
D. router - ✔✔C
✔✔Which malware type can change code and signature patterns with each iteration?
A. polymorphic
B. metamorphic
C. ransomware
D. rooting - ✔✔B
, ✔✔Which security method requires passcodes, enables encryption, locks down security
settings, and prevents jailbreaking or rooting?
A. policy enforcement
B. software distribution
C. data loss prevention
D. malware protection - ✔✔A
✔✔Which endpoint protection technique is commonly used to prevent end users from
running unauthorized applications, including malware, on their endpoints?
A. anomaly detection
B. application allow listing
C. container-based endpoint protection
D. signature-based - ✔✔B
✔✔Palo Alto Networks firewalls are built on which type of architecture?
A. multi-pass
B. ultimate-pass
C. single-pass
D. strict-pass - ✔✔C
✔✔Which PAN-OS Next-Generation Firewall configuration templates are based on
security best practice recommendations instead of extensive how-to documentation?
A. VM-Series
B. IronSkillet
C. PA-5200 Series
D. K2-Series - ✔✔B
✔✔Which option shows the three deployment mode options available for Panorama,
which (if necessary) allows for the separation of management and log collection?
A. Prisma, Panorama, IronSkillet
B. Log Collector, Prisma, Panorama
C. Management, Panorama, Prisma
D. Panorama, Management only, Log Collector - ✔✔D
✔✔Which physical or virtual device sends data packets to destination networks along a
network path using logical addresses?
A. hub
B. switch
C. router
D. access point - ✔✔C
✔✔Which area network separates the control and management processes from the
underlying networking hardware for simplified configuration and deployment?
A. wireless local area network (WLAN)
AND SOLUTIONS RATED A+
✔✔Which type of malware disables protection software?
A. anti-AV
B. Trojan horse
C. ransomware
D. worm - ✔✔A
✔✔Another term for a bot is a "zombie". (True or False) - ✔✔T
✔✔The spread of unsolicited content to targeted endpoints is known as what?
A. spamming
B. pharming
C. phishing
D. exploiting - ✔✔A
✔✔Which type of attack utilizes many endpoints as bots or attackers in a coordinated
effort, and can be extremely effective in taking down a website or some other publicly
accessible service?
A. Bluetooth
B. adware
C. distributed denial-of-service
D. man-in-the-middle - ✔✔C
✔✔Which Wi-Fi attack intercepts the victim's web traffic, redirects the victim's browser
to a web server that it controls, and serves up whatever content the attacker desires?
A. Evil Twin
B. SSLstrip
C. Emotet
D. Jasager - ✔✔B
✔✔Which part of APTs indicate that attackers use advanced malware and exploits and
typically also have the skills and resources necessary to develop additional cyberattack
tools and techniques?
A. Secure
B. Persistent
C. Threat
D. Advanced - ✔✔D
✔✔WPA2 includes a function that generates a 256-bit key based on a much shorter
passphrase created by the administrator of the Wi-Fi network and the service set
identifier (SSID) of the AP is used as a salt (random data) for the one-way hash
function. (True or False) - ✔✔T
,✔✔Which component of the zero trust conceptual architecture is called a "platform" to
reflect that it is made up of multiple distinct (and potentially distributed) security
technologies that operate as part of a holistic threat protection framework to reduce the
attack surface and correlate information about discovered threats?
A. Management infrastructure
B. Pocket of trust
C. Trust zone
D. Single component - ✔✔D
✔✔Which zero trust deployment method obtains a detailed picture of traffic flows
throughout the network, including where, when, and to what extent specific users are
using specific applications and data resources?
A. Define trust zones
B. Establish trust zones
C. Implement at major access points
D. Listen-only mode - ✔✔D
✔✔The Prisma suite secures public cloud environments, SaaS applications, internet
access, mobile users, and remote locations through a cloud-delivered architecture.
(True or False) - ✔✔T
✔✔Which network device transmits an electronic signal so that wireless devices can
connect to a network?
A. router
B. access point
C. hub
D. switch - ✔✔B
✔✔Which layer of the OSI model defines routing protocols and specifies how routers
communicate with each other on a network?
A. Network
B. Application
C. Data Link
D. Transport - ✔✔A
✔✔Which record specifies authoritative information about a DNS zone such as primary
name server, email address of the domain administrator, and domain serial number?
A. Canonical Name (CNAME)
B. Mail Exchanger (MX)
C. Pointer (PTR)
D. Start of Authority (SOA) - ✔✔D
✔✔Which 32-bit logical address is the most widely deployed version of IP?
,A. IPv6
B. IPv5
C. IPv4
D. IPv3 - ✔✔C
✔✔Subnetting should not be used to limit network traffic or limit the number of devices
that are visible to, or can connect to, each other. (True or False) - ✔✔F
✔✔What does the acronym CIDR represent?
A. Classful Inter Dependant Routing
B. Classless Inter-Domain Routing
C. Classless Inter Dependant Routing
D. Classful Inter Domain Routing - ✔✔B
✔✔Which IDS/IPS system uses a database of known vulnerabilities and attack profiles
to identify intrusion attempts?
A. knowledge-based
B. behavior-based
C. intuitive-based
D. standards-based - ✔✔A
✔✔Which type of system does not perform any preventive action to stop an attack?
A. data loss prevention
B. Intrusion Prevention
C. Unified Threat Management
D. intrusion detection - ✔✔D
✔✔A robust data loss prevention (DLP) solution can detect data patterns even if the
data is encrypted. (True or False) - ✔✔T
✔✔Which next-generation product replaces UTM appliances to reduce traffic inspection
latency?
A. hub
B. switch
C. firewall
D. router - ✔✔C
✔✔Which malware type can change code and signature patterns with each iteration?
A. polymorphic
B. metamorphic
C. ransomware
D. rooting - ✔✔B
, ✔✔Which security method requires passcodes, enables encryption, locks down security
settings, and prevents jailbreaking or rooting?
A. policy enforcement
B. software distribution
C. data loss prevention
D. malware protection - ✔✔A
✔✔Which endpoint protection technique is commonly used to prevent end users from
running unauthorized applications, including malware, on their endpoints?
A. anomaly detection
B. application allow listing
C. container-based endpoint protection
D. signature-based - ✔✔B
✔✔Palo Alto Networks firewalls are built on which type of architecture?
A. multi-pass
B. ultimate-pass
C. single-pass
D. strict-pass - ✔✔C
✔✔Which PAN-OS Next-Generation Firewall configuration templates are based on
security best practice recommendations instead of extensive how-to documentation?
A. VM-Series
B. IronSkillet
C. PA-5200 Series
D. K2-Series - ✔✔B
✔✔Which option shows the three deployment mode options available for Panorama,
which (if necessary) allows for the separation of management and log collection?
A. Prisma, Panorama, IronSkillet
B. Log Collector, Prisma, Panorama
C. Management, Panorama, Prisma
D. Panorama, Management only, Log Collector - ✔✔D
✔✔Which physical or virtual device sends data packets to destination networks along a
network path using logical addresses?
A. hub
B. switch
C. router
D. access point - ✔✔C
✔✔Which area network separates the control and management processes from the
underlying networking hardware for simplified configuration and deployment?
A. wireless local area network (WLAN)
