Cybersecurity-Apprentice Practice Test 1 — 10 Questions

Question 1

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Option A is correct because regular vulnerability assessments and penetration testing proactively identify exploitable weaknesses in systems and applications before attackers can leverage them, directly supporting risk assessment and remediation prioritization. Option B is correct because ingesting and monitoring Indicators of Compromise (IOCs) such as malicious IPs, domains, file hashes, and URLs from trusted threat intelligence feeds enables early detection of active threats and enriches SIEM/EDR correlation. Option D is correct because threat modeling during application design (e.g., using STRIDE or PASTA) anticipates attack vectors and informs security requirements before code is written, which is a core proactive risk management practice. Option C is incorrect because removing user access controls violates least privilege and dramatically increases risk rather than managing it. Option E is incorrect because permanently disabling logging destroys the audit trail and telemetry needed for detection, investigation, and compliance, and log overflow should instead be handled via retention policies, rotation, and capacity planning.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 2

A security analyst is examining network traffic logs and notices that an internal host is sending a large number of SYN packets to multiple external IP addresses on port 80, but never completing the TCP handshake. The analyst suspects a SYN flood attack originating from the internal host. Which security feature should the analyst configure on the firewall to mitigate this type of attack?

Accepted Answer

Zone Protection profile with SYN flood protection enabled on the internal zone.. Zone Protection profiles are designed to defend against network-layer attacks such as SYN floods, ICMP floods, and port scans. Enabling SYN flood protection on the zone where the internal host resides allows the firewall to monitor and limit SYN packet rates, using techniques like SYN cookies or random early drop. This mitigates the attack without blocking all traffic from the host, preserving legitimate connectivity.

Answer

QoS profile with a maximum bandwidth limit for the internal host.

Answer

Security policy rule that denies all outbound traffic from the internal host.

Answer

DoS Protection profile applied to the Security policy rule allowing the traffic.

Question 3

A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?

Accepted Answer

Based on a hash of session parameters (IP addresses, ports, and protocol). PAN-OS uses a session-based hash of the 5-tuple (source IP, destination IP, source port, destination port, protocol) to select one of the ECMP next-hops for a flow. Because the hash is deterministic per session, all packets belonging to the same session take the same path, preserving stateful inspection and avoiding out-of-order delivery. This is the default ECMP behaviour in a PAN-OS virtual router.

Answer

Round-robin packet by packet

Answer

Random selection for every individual packet

Answer

Based on the lowest interface latency measured by ICMP probes

Question 4

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

Accepted Answer

Review the Cortex XDR Causality Chain and Timeline view for the affected endpoint.. The Cortex XDR Causality Chain and Timeline view reconstructs the full sequence of events — process creation, network connections, file writes, registry changes — linked by causality (parent-child process relationships) for a specific endpoint and alert. This is the purpose-built investigative surface for understanding malware execution flow chronologically. It lets the analyst pivot from the initial alert to root cause and downstream impact in one view.

Answer

Run a vulnerability scan against the endpoint using Panorama compliance tools.

Answer

Examine the DHCP lease table on the core routing switch.

Answer

Export the firewall Traffic Log CSV and sort by destination port numbers.

Question 5

An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?

Accepted Answer

A host-based firewall configured to allow only TCP 443 and the management port, with a default deny policy. A host-based firewall with a default deny policy and explicit allow rules for the required ports enforces reachability at the server itself. It permits HTTPS web traffic and management access while silently dropping every other inbound connection attempt, which is the precise way to shrink the attack surface of an internet-facing host.

Answer

Full disk encryption on the server's data volume

Answer

An intrusion detection system running in promiscuous mode on the server

Answer

A web application firewall placed in front of the server

Question 6

A junior security administrator is asked to verify that the Cortex XDR agent on a Windows endpoint is able to receive updated prevention policies from the cloud. The administrator checks the agent status in the Cortex XDR console and sees that the endpoint is listed as 'Connected' but the last policy update was over 30 days ago. Which action should the administrator take first to ensure the agent receives the latest policies?

Accepted Answer

Check the endpoint's group assignment and policy rules in the Cortex XDR console.. Policy updates in Cortex XDR are managed through endpoint groups and the policies applied to them. If an endpoint is connected but not receiving updates, the most likely cause is misassignment to a group with outdated or no policies. Checking the group and policy configuration is the correct first troubleshooting step, as it is non-disruptive and targets the actual mechanism for policy distribution.

Answer

Manually update the agent software to the latest version.

Answer

Restart the Windows endpoint to force a policy sync.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Question 7

A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?

Accepted Answer

Port security with a maximum of one MAC address and violation mode shutdown. Port security is the Layer 2 control that caps the number of source MAC addresses an interface can learn. Configuring the maximum to one with the shutdown violation mode err-disables the access port the moment a second MAC appears. This precisely stops students from attaching personal routers that bridge multiple devices and generate loops on the residence hall wall jacks.

Answer

Dynamic ARP Inspection on the student VLAN

Answer

BPDU Guard enabled on the access ports

Answer

DHCP snooping with a trusted uplink

Question 8

A cloud operations team at a healthcare company stores patient records in an Amazon S3 bucket. An auditor asks the security administrator to confirm that the data is encrypted at rest and that the organization controls the encryption keys. Which AWS service should the administrator use to meet this requirement?

Accepted Answer

AWS Key Management Service (AWS KMS) customer managed keys. Customer managed keys in AWS KMS allow an organization to define key policies, enable automatic rotation, and audit key usage through CloudTrail, while S3 server-side encryption with SSE-KMS protects objects at rest. Because the auditor demands organizational control of the keys, S3 managed keys, TLS certificates, and data discovery tooling do not meet the stated requirement.

Answer

Amazon S3 default encryption with Amazon S3 managed keys (SSE-S3)

Answer

AWS Certificate Manager (ACM) public certificates

Answer

Amazon Macie sensitive data discovery jobs

Question 9

A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?

Accepted Answer

A remote-access VPN concentrator that terminates client tunnels. A remote-access VPN concentrator is designed to terminate encrypted tunnels from individual clients and place their traffic onto the internal network. It gives roaming employees access to internal resources such as a file server while keeping that server unreachable directly from the internet, which is exactly the edge design described.

Answer

A reverse proxy placed in front of the file server

Answer

A network address translation rule on the edge router

Answer

A site-to-site IPsec VPN between two branch offices

Question 10

A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?

Accepted Answer

A runtime rule that blocks the execution of specific processes, such as /bin/sh, within the container.. Preventing a shell from executing after a container starts is a runtime enforcement task. Prisma Cloud Compute runtime rules can block specific processes by name or path, so a rule that denies /bin/sh stops interactive shell access while leaving the application process unaffected. Configuration and vulnerability checks do not enforce behavior at runtime.

Answer

A vulnerability rule that flags images containing shell binaries with known CVEs.

Answer

An admission controller rule that rejects pods whose security context allows privilege escalation.

Answer

A compliance policy that checks whether the container image is built from a minimal base image.