Cybersecurity-Apprentice Practice Test — Free Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) Questions with Explanations

A junior security administrator is asked to verify that the Cortex XDR agent on a Windows endpoint is able to receive updated prevention policies from the cloud. The administrator checks the agent status in the Cortex XDR console and sees that the endpoint is listed as 'Connected' but the last policy update was over 30 days ago. Which action should the administrator take first to ensure the agent receives the latest policies?

A cloud operations team at a healthcare company stores patient records in an Amazon S3 bucket. An auditor asks the security administrator to confirm that the data is encrypted at rest and that the organization controls the encryption keys. Which AWS service should the administrator use to meet this requirement?

A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?

A security analyst is examining network traffic logs and notices that an internal host is sending a large number of SYN packets to multiple external IP addresses on port 80, but never completing the TCP handshake. The analyst suspects a SYN flood attack originating from the internal host. Which security feature should the analyst configure on the firewall to mitigate this type of attack?

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

An organization wants to ensure that sensitive data stored on employee laptops remains confidential even if a laptop is lost or stolen. The data must be unreadable without the correct credentials. Which security control should be implemented?

An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?

A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?

A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?

A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?

A SOC analyst notices that several endpoint alerts share the same file hash and were triggered on different hosts within a short period. Before escalating, the analyst wants to confirm whether this hash is known malware and gather context about its behavior. Which resource should the analyst consult first for this enrichment?

An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

A new cybersecurity apprentice is asked to classify the following event: an employee receives an email that appears to come from the IT department, asking them to click a link and reset their password immediately or their account will be disabled. The link leads to a fake login page that captures credentials. Which type of attack best describes this scenario?

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

A SOC analyst is investigating a malware alert on an endpoint. The analyst wants to understand the behavior of the malware to determine its capabilities. The analyst has a malware sample and needs to analyze it in a safe environment. Which action should the analyst take?

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

A Cortex XDR administrator is configuring endpoint protection for a group of Windows servers that run a custom Java application. The application uses a Just-In-Time (JIT) compiler that frequently generates dynamic code, and the administrator observes that Exploit Protection is blocking the application's normal execution. What is the most appropriate action to resolve this while maintaining security?