Cybersecurity-Apprentice Practice Test 12 — 15 Questions

Question 1

A company uses a demilitarized zone (DMZ) to host a public web server. The security policy requires that the web server can only initiate outbound connections to a specific database server on the internal network and must not initiate any other outbound connections. Which firewall rule placement and action best enforces this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place a rule at the top of the security policy allowing DMZ to internal database, followed by a rule denying all other DMZ to internal traffic, and a default deny all.. To enforce that the DMZ web server can only initiate connections to a specific internal database, the firewall policy must first allow that specific traffic, then deny all other DMZ-to-internal traffic, and finally have a default deny. This order ensures the required connection is permitted while blocking any other unauthorized outbound attempts from the DMZ, following the principle of least privilege.

Answer

Place a rule at the top denying all DMZ to internal, followed by a rule allowing DMZ to internal database.

Answer

Place a single rule allowing DMZ to internal any service, relying on the database server's host firewall to restrict access.

Answer

Place a rule allowing internal to DMZ database, and rely on stateful inspection to permit return traffic.

Question 2

A network security engineer is configuring a new Palo Alto Networks firewall to securely allow remote users to access internal applications. The engineer decides to implement GlobalProtect with SSL VPN. Which TWO configurations are required to enable user authentication and ensure that only authorized users can access the internal applications? (Choose two.)

Accepted Answer

Configure an Authentication profile that specifies an LDAP server for user credential validation.. To enable GlobalProtect with SSL VPN and ensure authorized access, an Authentication profile is needed to validate user credentials against a directory service. Additionally, a Security policy rule must permit traffic from the GlobalProtect zone to the internal zone and include user/group matching to enforce authorization. These two configurations together provide authentication and access control for remote users.

Answer

Configure a Decryption policy to inspect all SSL VPN traffic for threats.

Answer

Set up a GlobalProtect portal and gateway with client certificate authentication only.

Answer

Enable User-ID on the internal zone to map IP addresses to usernames.

Question 3

A security analyst is documenting the chain of custody for a hard drive that was seized from a suspect's computer. Which of the following is the PRIMARY purpose of maintaining a chain of custody?

Accepted Answer

To ensure the evidence is admissible in court.. Chain of custody is a legal document that records the seizure, transfer, and analysis of evidence. Its primary purpose is to ensure evidence integrity and admissibility in court. While location tracking, access prevention, and audit compliance are related, they are not the main reason for maintaining it.

Answer

To track the location of the evidence within the organization.

Answer

To comply with internal audit requirements.

Answer

To prevent unauthorized access to the evidence.

Question 4

A SOC analyst is reviewing a potential data exfiltration alert from a next-generation firewall. The alert indicates a large outbound transfer to an unknown external IP over TCP port 443. The analyst needs to determine if this is malicious or benign. Which of the following actions should the analyst take FIRST to gather the most relevant context?

Accepted Answer

Query the endpoint detection and response (EDR) platform for process and network activity on the internal host that initiated the transfer.. The first step should be to query the EDR platform for process and network activity on the internal host. This provides the most direct and detailed context about what initiated the transfer, including the process name, command line, and parent process. That information is critical to quickly assess whether the transfer is malicious or benign, and it can guide subsequent steps such as threat intelligence lookups or firewall log reviews.

Answer

Check the firewall's threat logs for any associated WildFire verdicts on the files or URLs involved.

Answer

Review the firewall's traffic logs to identify the user and application associated with the session.

Answer

Look up the external IP address in an open-source threat intelligence platform to see if it is associated with known malicious activity.

Question 5

A small business owner wants to protect the company's network from external threats. The owner has installed a firewall and antivirus software on all computers. Which additional basic security measure should the owner implement to protect against unauthorized access to the wireless network?

Accepted Answer

Enable WPA3 encryption on the wireless access point. Enabling WPA3 encryption on the wireless access point is the most effective way to protect against unauthorized access. WPA3 provides strong encryption and authentication, ensuring only authorized users can connect. Other measures like disabling SSID broadcast or changing router passwords are less effective or address different aspects. An open guest network would worsen security. Thus, WPA3 is the correct basic security measure.

Answer

Set up a guest network with no password

Answer

Disable the SSID broadcast

Answer

Change the default administrator password on the router

Question 6

A SOC analyst is reviewing an alert generated by the SIEM correlation rule for multiple failed logins followed by a successful login from an unusual geographic location. The account belongs to a finance employee who is currently traveling abroad. What is the MOST appropriate next step for the analyst?

Accepted Answer

Contact the user through a verified out-of-band channel to confirm the login activity.. When a login anomaly could be legitimate travel or a compromise, the analyst should verify with the user through a trusted out-of-band channel. This confirms intent without alerting an attacker and avoids unnecessary disruption. Disabling, closing as false positive, or resetting credentials all skip this verification step and can either harm business operations or miss a real account takeover.

Answer

Close the alert as a false positive because the user is traveling abroad.

Answer

Immediately disable the user's account and escalate to Tier-2.

Answer

Reset the user's password and require re-enrollment in multi-factor authentication.

Question 7

A company is deploying a Network Intrusion Prevention System (NIPS) inline at the perimeter. The security team wants to minimize false positives while ensuring that malicious traffic is blocked. Which TWO actions should be taken during NIPS tuning? (Choose two.)

Accepted Answer

Tune signature thresholds and create exceptions for trusted hosts or applications that trigger false positives.. To minimize false positives while ensuring malicious traffic is blocked, the NIPS should first run in detection mode to baseline traffic and identify which signatures trigger on legitimate activity. Then, thresholds should be tuned and exceptions created for trusted hosts or applications. This approach allows the team to gradually enable blocking for high-confidence signatures without disrupting business operations.

Answer

Disable all signatures and only enable custom signatures for known threats.

Answer

Enable all signatures in blocking mode immediately to maximize protection.

Answer

Set all signatures to 'alert only' permanently to avoid any business disruption.

Question 8

A security administrator is configuring a Palo Alto Networks firewall to protect against network reconnaissance attacks. The administrator wants to detect and block port scans and host sweeps on the untrusted zone. Which TWO actions should be taken to achieve this? (Choose two.)

Accepted Answer

Enable Port Scan protection in a Zone Protection profile and apply it to the untrusted zone.. The correct actions are to enable Port Scan protection and Host Sweep protection in a Zone Protection profile applied to the untrusted zone. Port Scan protection detects scans against a single host, while Host Sweep protection detects scans across multiple hosts. Together, they provide comprehensive defense against reconnaissance attacks. Other options either address different attack types or are too broad, not meeting the specific requirement.

Answer

Enable Packet Based Attack Protection in the Zone Protection profile to block malformed packets.

Answer

Configure a Security policy rule to deny all traffic from the untrusted zone to any destination.

Answer

Create a DoS Protection profile with SYN Flood protection and apply it to a Security policy rule for the untrusted zone.

Question 9

A Tier-1 SOC analyst receives an alert from Cortex XDR indicating that a process on a Windows endpoint attempted to disable Windows Defender real-time protection. The analyst needs to gather the process name, command line, and parent process to decide whether to escalate. Which Cortex XDR console area should the analyst open to review this endpoint telemetry most directly?

Accepted Answer

Incident Response > Investigation, filtering on the endpoint hostname and the alert timestamp. Endpoint triage requires event-level evidence: which process ran, what command line it used, and what process spawned it. The Investigation view in Cortex XDR surfaces exactly that causal telemetry and supports filtering by host and time, so an analyst can reconstruct the activity around the alert. Aggregated dashboards, asset inventory records, and prevention profiles describe posture or counts, not the specific process behavior under investigation.

Answer

Inventory > Endpoints, opening the asset record for the affected host

Answer

Policy > Prevention, reviewing the endpoint protection profile assigned to the host

Answer

Dashboards > Endpoint Security, reviewing the aggregate malware detection widget

Question 10

An organization is deploying a comprehensive threat prevention strategy using Palo Alto Networks Security Profiles. Which THREE security profile types are available out-of-the-box to inspect data plane traffic for specific threat vectors? (Choose three)

Accepted Answer

Anti-Spyware. Anti-Spyware (A) is a correct out-of-the-box Security Profile type that inspects data plane traffic for command-and-control (C2) activity, spyware downloads, and DNS sinkhole-based botnet traffic. Vulnerability Protection (B) is also correct: it is a Security Profile that detects and blocks exploits targeting host software and applications by matching signatures against traffic in the data plane. Antivirus (D) is the third correct profile type, scanning data plane traffic for viruses, worms, and other malware in files transferred over protocols such as HTTP, FTP, SMB, and SMTP. Packet Filter (C) is not a Security Profile type; it is a stateless firewall capability, and Palo Alto Networks firewalls perform stateful inspection rather than offering a packet-filter profile. Session Timeout (E) is not a Security Profile either; it is a session-handling parameter configured in security policy or application settings, not a threat-inspection profile.

Answer

Packet Filter

Answer

Session Timeout

Question 11

A financial services firm wants to confirm that its backup copies of a critical trading application can actually be restored after a ransomware incident. The backups are stored on immutable storage and replicated to an offsite location. Which activity best validates that the recovery capability will work when needed?

Accepted Answer

Perform a full restoration of the application and its data into an isolated environment and verify it functions correctly.. Backup success logs, retention settings, and replication lag all describe the backup pipeline's operation, not its recoverability. The only way to prove that the trading application can be brought back after ransomware is to restore it into an isolated environment and confirm it runs correctly with its data intact. That exercise exposes hidden gaps such as missing dependencies or corrupted backup sets.

Answer

Verify that the immutable storage retention policy is configured to the required number of days.

Answer

Review the backup job success logs and confirm that every scheduled job completed without error.

Answer

Confirm that replication to the offsite location is current by checking the replication lag metric.

Question 12

A hospital is reviewing its identity and access management practices after an audit finding. The auditors noted that several former employees still had active directory accounts and that some accounts had more access than their roles required. Which two actions directly address the audit findings? (Choose two.)

Accepted Answer

Implement a formal deprovisioning process that disables or removes accounts promptly when employment ends.. The audit findings describe two distinct identity governance gaps: accounts that persist after employment ends and entitlements that exceed what roles require. A formal deprovisioning process closes the first gap by removing or disabling accounts promptly, while periodic access reviews close the second by forcing managers to recertify or revoke permissions. Both are direct, structural fixes rather than compensating controls.

Answer

Increase the minimum password length from twelve to sixteen characters for all domain accounts.

Answer

Deploy a network intrusion prevention system on the internal clinical network segment.

Answer

Enable detailed authentication logging and forward the events to the security operations center.

Question 13

A financial services company is reviewing its identity and access management practices after an audit finding. The auditors noted that several former contractors still had active accounts and that some current employees retained access to systems they no longer used. The security team must recommend changes that directly address these findings. (Choose two.)

Accepted Answer

Enforce the principle of least privilege by granting users only the access required for their current job duties and reviewing entitlements regularly.. The audit findings are about accounts that should not exist and permissions that should not persist, so the fixes must govern identity lifecycle and entitlement scope. A joiner, mover, and leaver process ensures timely provisioning and revocation, while least privilege with regular reviews trims standing access. Network, password, and disk-encryption controls are valuable but do not remediate stale or excessive accounts.

Answer

Deploy an intrusion prevention system at the network perimeter to block exploit traffic targeting public-facing web servers.

Answer

Increase the minimum password length from eight to twelve characters for all domain accounts.

Answer

Enable full-disk encryption on all employee laptops to protect data if a device is lost or stolen.

Question 14

An e-commerce company's web server was compromised after an attacker submitted crafted input that caused the application to return database error messages revealing table names. The developer wants to stop the application from interpreting user input as executable database code. Which control directly addresses this weakness?

Accepted Answer

Use parameterized queries with bound parameters for all database access. The incident describes classic SQL injection, where user-supplied input is concatenated into a database statement and interpreted as code, leaking schema details through error messages. Parameterized queries with bound parameters break that link by keeping statement structure fixed and treating input strictly as data. Firewalls, disk encryption, and expanded logging may reduce exposure or improve visibility, but only changing how queries are constructed eliminates the flaw.

Answer

Deploy a web application firewall in blocking mode in front of the server

Answer

Enable full-disk encryption on the database server's storage volumes

Answer

Increase database error logging verbosity and forward logs to the SIEM

Question 15

A financial services firm must prove to auditors that its security controls are documented, reviewed, and operating effectively over time. The compliance manager asks which activity produces the evidence trail showing that controls were tested and management acknowledged the results.

Accepted Answer

Performing a formal risk assessment and control review with documented sign-off. Auditors need more than technical test results or published policies; they need a documented governance cycle. A risk assessment combined with control review and management sign-off records what was evaluated, what controls address each risk, what residual risk remains, and who approved that position on a specific date. That artifact chain demonstrates controls are reviewed and operating under management oversight, which is what the compliance manager must produce.

Answer

Conducting a penetration test of the external web applications

Answer

Enabling verbose logging on all perimeter firewalls and retaining logs for one year

Answer

Publishing the information security policy on the company intranet