Palo Alto PCCET Practice Test (Legacy – exam retired January 2025)

PCCET practice test: what's covered

• Cybersecurity Entry-Level Technician

Free PCCET sample questions

1. A hospital encrypts patient records so that only authorized clinicians can read them, even if a database backup is stolen. Which element of the CIA triad does this control primarily protect?

   • A. Confidentiality, by preventing unauthorized parties from reading the data
   • B. Integrity, by detecting unauthorized modification of stored records
   • C. Availability, by ensuring records are reachable during an outage
   • D. Non-repudiation, by proving who performed a specific transaction
   Show answer

   Correct: A. Encryption at rest protects confidentiality because it keeps data unreadable to anyone without the key, even after theft. Integrity is incorrect because it concerns detecting tampering (hashing/signing), not secrecy. Availability is wrong because it deals with uptime and access, not disclosure. Non-repudiation is not part of the CIA triad and addresses proof of action, unlike secrecy.

2. Security staff notice that a web server, an internal firewall, host antivirus, and data encryption all had to fail before an attacker could exfiltrate a file. This outcome best demonstrates which security principle?

   • A. Defense in depth, layering independent controls so one failure is not catastrophic
   • B. Least privilege, granting users only the minimum access they require
   • C. Security through obscurity, hiding system details to deter attackers
   • D. Separation of duties, splitting a task across multiple people
   Show answer

   Correct: A. Defense in depth layers multiple independent controls so a single bypass does not compromise the whole system, which matches the scenario where many layers had to fail. Least privilege is incorrect because it limits access scope, not layered redundancy. Security through obscurity relies on secrecy of design and is not what protected here. Separation of duties divides responsibilities among people, unlike the technical layering described.

3. An organization is adopting a Zero Trust strategy after a breach that spread laterally through a flat network. Which principles are core to a Zero Trust model? (Choose TWO)

   • A. Never trust and always verify every access request regardless of network location
   • B. Apply least-privilege access and microsegmentation to limit lateral movement
   • C. Trust all traffic that originates from inside the corporate perimeter
   • D. Rely on a single strong perimeter firewall as the primary defense
   • E. Disable all logging to reduce the performance overhead of inspection
   Show answer

   Correct: A and B. Zero Trust assumes breach and verifies every request continuously while enforcing least privilege and microsegmentation, which directly counters lateral movement. Trusting internal traffic is incorrect because Zero Trust explicitly removes implicit network trust. Relying on one perimeter firewall is wrong because it is the legacy castle-and-moat model Zero Trust replaces. Disabling logging is incorrect because continuous monitoring is essential to verification.

4. A finance employee receives an email that appears to come from the CEO urgently requesting a wire transfer to a new vendor account. The message pressures the user to act quickly and bypass normal approvals. This attack is best classified as which type?

   • A. Spear phishing using social engineering to impersonate a trusted person
   • B. A distributed denial-of-service attack against the mail server
   • C. A SQL injection attack targeting the finance database
   • D. A brute-force attack against the employee password
   Show answer

   Correct: A. Targeted impersonation of a specific executive to trick an individual into a wire transfer is spear phishing driven by social engineering. A DDoS attack is incorrect because it floods services to cause an outage, not deception. SQL injection is wrong because it manipulates database queries, not human trust. Brute force is incorrect because it guesses credentials rather than persuading a person to act.

5. A technician is troubleshooting why a custom application cannot establish a reliable session. The app needs ordered delivery, retransmission of lost packets, and a three-way handshake. Which transport protocol meets these requirements?

   • A. TCP, which is connection-oriented and guarantees ordered, reliable delivery
   • B. UDP, which is connectionless and prioritizes low latency over reliability
   • C. ICMP, which is used for diagnostics and error reporting messages
   • D. ARP, which resolves IP addresses to physical MAC addresses
   Show answer

   Correct: A. TCP provides connection-oriented, reliable, ordered delivery using a SYN, SYN-ACK, ACK handshake and retransmits lost segments, matching the requirements. UDP is incorrect because it is connectionless and does not retransmit or guarantee order. ICMP is wrong because it carries control and diagnostic messages, not application sessions. ARP is incorrect because it maps IP addresses to MAC addresses at layer 2, not transport sessions.

Last updated: 2026-10-19

PCCET practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NetSec-Pro practice test
• Palo Alto Networks NGFW practice test
• Palo Alto Networks PCCSE practice test
• Palo Alto Networks PCDRA practice test