Cybersecurity-Apprentice Exam Questions and Answers

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?

A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

A network administrator notices that asymmetric routing is occurring on a multi-path firewall deployment, causing valid TCP sessions to be dropped by the firewall. Which feature should the administrator enable to resolve this issue?

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?

An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?