Cybersecurity Fundamentals

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

A security analyst receives an alert from Cortex XDR indicating that a suspicious PowerShell script was executed on an employee workstation. Which underlying security telemetry mechanism enabled Cortex XDR to capture the exact process execution tree and command-line arguments?

What is the primary purpose of deploying a Threat Intelligence platform (TIP) alongside traditional security controls?

Which security concept describes the practice of hiding internal network topology and IP address schemes from external entities using Network Address Translation (NAT)?

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

An enterprise security administrator is designing a comprehensive security posture following Zero Trust principles on a Palo Alto Networks Next-Generation Firewall. Which TWO core concepts must be implemented to satisfy a true Zero Trust data and network architecture? (Choose two)

What is the primary benefit of deploying multi-factor authentication (MFA) for administrative access to security infrastructure?

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?

An organization is deploying a zero-trust network architecture using Palo Alto Networks firewalls. The security team needs to ensure that internal user traffic destined for sensitive database servers is strictly inspected for application-layer threats. Which security mechanism must be enforced to achieve Layer 7 visibility and control?

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

An organization is deploying a comprehensive threat prevention strategy using Palo Alto Networks Security Profiles. Which THREE security profile types are available out-of-the-box to inspect data plane traffic for specific threat vectors? (Choose three)

An enterprise firewall is experiencing high session utilization due to a distributed denial-of-service (DDoS) SYN flood attack targeting a public web server. Which feature on the Palo Alto Networks firewall should an administrator configure to protect the server from resource exhaustion?

A security analyst at a financial firm receives an alert that a workstation has been communicating with a known malicious IP address. The analyst isolates the workstation from the network and begins reviewing logs. Which step of the incident response process is the analyst performing?

A new cybersecurity apprentice is asked to classify the following event: an employee receives an email that appears to come from the IT department, asking them to click a link and reset their password immediately or their account will be disabled. The link leads to a fake login page that captures credentials. Which type of attack best describes this scenario?

A security analyst is reviewing a web server log and sees the following entry: `GET /products.php?id=1' OR '1'='1`. The analyst suspects an injection attack. Which type of attack is most likely being attempted?

A security analyst receives an alert about a workstation repeatedly attempting to connect to an IP address known for hosting malware. The analyst wants to confirm whether the connection was successful and what data might have been transferred. Which type of data should the analyst examine first?

A small business owner wants to protect the company's network from external threats. The owner has installed a firewall and antivirus software on all computers. Which additional basic security measure should the owner implement to protect against unauthorized access to the wireless network?

An organization wants to ensure that sensitive data stored on employee laptops remains confidential even if a laptop is lost or stolen. The data must be unreadable without the correct credentials. Which security control should be implemented?

A new security analyst at a retail company receives a help desk ticket stating that an employee clicked a link in an email and a browser window opened asking for their corporate username and password. The page looks identical to the company's single sign-on portal, but the URL is misspelled. The analyst must classify this event. Which category BEST describes this activity?

A junior security analyst at a healthcare company receives a call from an employee who says they received an email from the IT department asking them to click a link and reset their password. The email address looks slightly misspelled. The analyst wants to confirm whether this is a phishing attempt before the employee clicks anything. Which action should the analyst take FIRST?

A security team is implementing the principle of least privilege across its organization. Which TWO practices best support this principle? (Choose two.)

A junior security analyst receives an alert that a user's account was accessed from two geographically distant locations within a few minutes. The organization has no travel policy exceptions for this user. Which cybersecurity principle is MOST directly relevant to investigating whether this is a genuine compromise?

A small business owner wants to protect customer payment data. The owner asks a security consultant which control best reduces the impact if an attacker compromises a web server that stores payment records. The consultant recommends encrypting the payment records at rest with keys managed separately from the server. Which security principle does this recommendation primarily support?

A junior security analyst at a healthcare company receives a phone call from someone claiming to be the IT help desk. The caller says the analyst's VPN certificate is about to expire and asks the analyst to read back the six-digit code that just appeared in the analyst's authenticator app so the certificate can be renewed remotely. The analyst notices the caller ID shows an internal extension. What should the analyst do first?

A hospital's security team must protect patient records stored on a file server. The compliance officer asks which control ensures that data remains unaltered and trustworthy while it is stored and while it travels between the server and clinical workstations. Which security objective is the officer asking about?

A company wants to protect its web application from attackers who try to inject malicious scripts that would execute in the browsers of other users viewing the application. Which security control should be implemented to mitigate this risk?

A security team is reviewing an incident where an attacker gained initial access by sending an email with a malicious macro-enabled spreadsheet to a finance employee. The employee opened the file and enabled macros. Which control would have been MOST effective at preventing the macro from executing while still allowing legitimate business documents to open?

A retail company stores customer payment card numbers in a database. A compliance auditor asks the security team to reduce the impact if the database is compromised. The team proposes replacing the stored card numbers with surrogate values that can be mapped back only through a separately protected lookup table. Which data protection technique are they proposing?

A security administrator is reviewing logs and sees repeated failed login attempts against several user accounts from a single external IP address over a short period. The attempts use common usernames such as admin, root, and test. No account has been successfully accessed. Which type of attack is most likely occurring?

An employee at a logistics firm plugs an unfamiliar USB drive found in the parking lot into a corporate laptop. Shortly afterward, the endpoint protection console reports that a process is attempting to encrypt files in the user's documents folder and rename them with a new extension. Which type of malware is MOST likely responsible?

A security administrator is configuring a web application firewall (WAF) in front of a public-facing login portal. The administrator wants to protect against automated credential stuffing attacks that use large lists of username and password combinations. Which WAF feature is MOST appropriate to detect and block this behavior?

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password immediately or their account will be locked. The link leads to a website that looks identical to the company's login page. Which type of attack is this?

A financial services firm wants to confirm that its backup copies of a critical trading application can actually be restored after a ransomware incident. The backups are stored on immutable storage and replicated to an offsite location. Which activity best validates that the recovery capability will work when needed?

A company is preparing an incident response plan. The security team wants to ensure that when a critical server is compromised, they can determine what happened, contain the threat, and restore normal operations. The team is defining the phases of the incident response lifecycle. Which sequence correctly represents the standard incident response phases?

A financial services company is reviewing its identity and access management practices after an audit finding. The auditors noted that several former contractors still had active accounts and that some current employees retained access to systems they no longer used. The security team must recommend changes that directly address these findings. (Choose two.)

A security analyst is reviewing a suspicious PowerShell script that was executed on a workstation. The script downloads a file from a remote URL, saves it to a temporary directory, and then executes it. Which TWO indicators should the analyst prioritize to determine whether this activity is malicious? (Choose two.)

A security team is reviewing network traffic captures and wants to determine which internal workstation initiated a connection to an external web server. The capture contains only the packet headers of the conversation. Which pair of attributes in the packet header identifies the source of the connection?

A security awareness trainer is preparing a module on protecting against social engineering. The trainer wants to highlight common technical and human indicators that an email may be a phishing attempt. Which TWO indicators should the trainer include? (Choose two.)

A hospital's IT team is classifying its information assets. A patient-record database stores names, dates of birth, insurance identifiers, and treatment notes. The compliance officer asks the apprentice to label the sensitivity of this data. Which classification best fits this data set?

A company is implementing a data loss prevention (DLP) strategy. The security team wants to prevent employees from emailing files that contain credit card numbers to external recipients. Which DLP component is primarily responsible for identifying the sensitive data within the email content?

A hospital is reviewing its identity and access management practices after an audit finding. The auditors noted that several former employees still had active directory accounts and that some accounts had more access than their roles required. Which two actions directly address the audit findings? (Choose two.)

An e-commerce company's web server was compromised after an attacker submitted crafted input that caused the application to return database error messages revealing table names. The developer wants to stop the application from interpreting user input as executable database code. Which control directly addresses this weakness?

A financial services firm must prove to auditors that its security controls are documented, reviewed, and operating effectively over time. The compliance manager asks which activity produces the evidence trail showing that controls were tested and management acknowledged the results.

A mid-sized retailer is building its incident response capability after a ransomware near-miss. The apprentice is asked which activities belong in the preparation phase of the incident response lifecycle. (Choose two.)

An organization wants to reduce the risk that a stolen laptop's disk contents can be read by a thief. The laptop contains only files on the local drive, and the user sometimes works offline. Which control best meets this requirement?

A small accounting firm has no dedicated IT staff. An employee receives an email that appears to be from the firm's bank, asking them to click a link and re-enter their online banking credentials to 'prevent account suspension.' The employee is unsure whether the email is legitimate. Which cybersecurity concept best describes this attack?

A mid-sized retailer stores customer payment card data on an internal server. A security analyst is asked to recommend controls that protect the confidentiality of that data if the server's disk is physically stolen. Which control best addresses this specific risk?

A security team is conducting a risk assessment for a new web application that will process customer orders. The team must identify which of the following are examples of technical security controls that reduce the likelihood or impact of an attack. (Choose two.)