Cybersecurity-Apprentice Practice Test 13 — 15 Questions

Question 1

A mid-sized retailer is building its incident response capability after a ransomware near-miss. The apprentice is asked which activities belong in the preparation phase of the incident response lifecycle. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establishing a dedicated communication and escalation channel for responders. Preparation covers everything done before an incident to make response possible: writing and exercising the plan, defining roles, acquiring tools, and provisioning resilient communications. Tabletop exercises and a dedicated escalation channel are both readiness activities that pay off when an event occurs. Forensic imaging, customer notification, and system restoration are executed during later phases once an incident is detected and declared.

Answer

Restoring encrypted systems from verified clean backups

Answer

Collecting and preserving forensic images of the affected file servers

Answer

Notifying affected customers and regulators about the data exposure

Question 2

A network administrator is configuring a new Palo Alto Networks firewall and wants to ensure that users on the internal network can access the internet but cannot directly reach the firewall's management interface from the dataplane. The firewall has three zones: Trust, Untrust, and Management. Which configuration should the administrator implement to achieve this requirement?

Accepted Answer

Assign the management interface to the Management zone and create a Security policy rule that denies traffic from the Trust zone to the Management zone.. The management interface must reside in a dedicated Management zone, and Security policy rules control traffic between zones. Denying Trust-to-Management traffic prevents internal users from reaching the management IP, while a separate rule permits Trust-to-Untrust for internet access. This is the standard best practice for separating management and dataplane traffic on a Palo Alto Networks firewall.

Answer

Enable DNS sinkhole on the Trust zone to redirect management traffic to a decoy server.

Answer

Create a Security policy rule allowing Trust to Management traffic but apply a URL Filtering profile to block administrative URLs.

Answer

Configure a static route for the Management zone that points to the Untrust zone's next-hop gateway.

Question 3

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles in PAN-OS are defined under Device > Server Profiles > Syslog, where you configure the server name, IP/FQDN, port, transport (UDP/TCP/SSL), format (BSD, IETF), and facility. This profile is then referenced in Log Forwarding profiles attached to Security, Threat, or other log types.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 4

An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?

Accepted Answer

GCP Service Account with Custom IAM Role granting required read permissions at the Organization level. Prisma Cloud's GCP onboarding uses a dedicated GCP Service Account with a Custom IAM Role scoped to the Organization level, granting only the read permissions Prisma Cloud needs (e.g., `resourcemanager.organizations.get`, `compute.instances.list`, `cloudasset.assets.list`). This satisfies least-privilege because the role is purpose-built rather than a predefined primitive role like Owner or Editor, and the service account key or Workload Identity Federation is used for API authentication.

Answer

Hardcoded GCP user account credentials with project owner role

Answer

GCP Cloud SQL database master password sharing

Answer

Pre-shared symmetric API keys embedded in Cloud Functions

Question 5

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Accepted Answer

By deploying a compatible legacy agent version that supports older OS APIs while providing core malware and exploit prevention.. Cortex XDR provides support for legacy Windows operating systems by offering compatible agent versions that are designed to work with older OS APIs. These legacy agents still deliver core protection features such as malware prevention and exploit mitigation, ensuring that older servers remain protected without requiring OS upgrades.

Answer

By forcing an automatic in-place upgrade of the legacy Windows server to Windows 11.

Answer

By routing all legacy server traffic through a next-generation firewall proxy instead of installing an agent.

Answer

By disabling all security checks for servers older than five years.

Question 6

A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)

Accepted Answer

Resource configuration history tracking changes to IAM policies and security groups (Config RQL). Option A is correct because Prisma Cloud's resource configuration history (Config RQL) lets investigators query past and present states of IAM policies and security groups, revealing exactly when and how permissions were broadened during the privilege-escalation attempt. Option B is correct because Identity Security/UEBA baselines user behavior and flags anomalies such as impossible travel or unusual access patterns that indicate compromised cloud credentials being misused. Option C is correct because Cloud audit log event analysis (Event RQL) ingests control-plane API activity, so suspicious calls like CreatePolicyVersion, AttachUserPolicy, or AssumeRole can be searched and correlated to the attacker's actions. Option D does not belong because kernel-level defragmentation of database storage volumes is a storage-performance operation unrelated to cloud identity threat detection. Option E does not belong because GlobalProtect CRL distribution concerns VPN client certificate validation, not investigation of compromised cloud credentials or privilege escalation.

Answer

Automatic kernel-level defragmentation of enterprise database storage volumes

Answer

GlobalProtect client certificate revocation list distribution

Question 7

A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?

Accepted Answer

Navigate to Cortex XDR > Incident View to review the automated attack story and affected endpoints.. Cortex XDR's Incident View is the central triage console that automatically correlates endpoint telemetry into an attack story, showing the causal chain of events, affected endpoints, and root cause. For a ransomware outbreak, this is where an analyst immediately sees scope (how many endpoints) and the initial infection vector. It is the designed starting point for incident triage, not policy or hunting tools.

Answer

Run a manual threat hunting query in the Action Center to install new agents.

Answer

Access the Policy Editor to disable the infected endpoints from the network.

Answer

Open the Endpoint Protection profiles to manually delete the malware binaries.

Question 8

A security analyst is reviewing Cortex XDR endpoint alerts and notices a pattern where the same executable is repeatedly flagged for creating suspicious child processes, but the file hash is not present in any threat intelligence feed. The analyst wants to prevent this behavior from executing on all endpoints without blocking other legitimate applications that use similar process creation. Which Cortex XDR prevention module should the analyst configure to address this specific behavioral pattern?

Accepted Answer

Behavioral Threat Protection. Behavioral Threat Protection is the Cortex XDR module that detects and blocks malicious process behaviors, such as an unknown executable repeatedly creating suspicious child processes. Unlike signature-based malware prevention, BTP operates on behavioral indicators and can stop threats without prior knowledge of the file hash. Configuring BTP rules allows targeted prevention without impacting legitimate applications.

Answer

Device Control

Answer

Malware Prevention

Answer

Exploit Prevention

Question 9

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data Filtering profiles (A) are correct because they use predefined or custom patterns (e.g., credit card and SSN regexes) to detect and block sensitive data in traffic, directly preventing exfiltration. SSL Decryption policies (C) are correct because without decrypting outbound HTTPS, the firewall cannot inspect uploads to cloud storage or other encrypted channels, so decryption restores visibility and enforcement for data protection. File Blocking profiles (D) are correct because they identify file types by extension or magic bytes and can block or alert on the egress of sensitive or unauthorized files, stopping exfiltration via file transfers. Management interface IP allow lists (B) only restrict who can administer the firewall and do not inspect or control data flows, so they do not prevent exfiltration. GlobalProtect clientless portal customization banners (E) are purely informational UI elements and provide no enforcement over data leaving the network.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 10

What is the primary purpose of deploying a Threat Intelligence platform (TIP) alongside traditional security controls?

Accepted Answer

To aggregate, correlate, and operationalize threat intelligence feeds from multiple external and internal sources.. A Threat Intelligence Platform (TIP) is specifically designed to ingest, normalize, deduplicate, and correlate threat data from many sources — OSINT feeds, commercial vendors, ISACs, and internal telemetry — then enrich and distribute that intelligence to SIEMs, SOARs, firewalls, and EDR tools via standards like STIX/TAXII. Its core value is operationalization: turning raw indicators (IPs, domains, hashes, TTPs) into actionable context that existing controls can consume. Traditional controls like firewalls and IDS detect or block, but they don't aggregate and contextualize multi-source intelligence — that orchestration layer is the TIP's unique role.

Answer

To automatically isolate compromised VLANs on network switches using 802.1X.

Answer

To encrypt data at rest on enterprise database servers.

Answer

To provide zero-day malware sandbox detonation for Windows executables.

Question 11

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS shaping on a PAN-OS firewall must be applied on the egress interface toward the WAN, because QoS controls outbound traffic scheduling and shaping. Applying it on the egress interface ensures VoIP packets are prioritized as they leave the firewall toward the internet.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 12

An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?

Accepted Answer

Create a Panorama Pre-Rule or Post-Rule blocking the destination IP address and push the policy to managed firewalls.. Panorama manages multiple firewalls centrally, and its Pre-Rules and Post-Rules are policy rulebases that are pushed to all managed firewalls. Creating a Pre-Rule or Post-Rule that blocks the destination C2 IP address and pushing the policy to managed firewalls immediately enforces the block enterprise-wide, which is the correct containment action for a known C2 destination. This leverages Panorama's centralized policy management to stop further communication across all managed enforcement points.

Answer

Change the GlobalProtect Gateway IP pool configuration.

Answer

Modify the local hosts file on every endpoint via Cortex XDR Action Center.

Answer

Reboot the Panorama management server to flush active state tables.

Question 13

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

Accepted Answer

Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference. FCS errors indicate that frames arrive with corrupted bits detected by the Frame Check Sequence at Layer 2. When speed and duplex are correctly matched on both ends (1 Gbps full duplex here), the remaining cause is almost always physical-layer signal integrity problems — damaged cables, faulty SFP optics, dirty connectors, or EMI. These corrupt the electrical/optical signal before it reaches the NIC, producing FCS/CRC errors rather than duplex-mismatch symptoms like late collisions.

Answer

An incorrect Zone Protection Profile flooding threshold

Answer

A mismatch in Virtual Router metric values

Answer

Incorrect TCP MSS adjustment on the Layer 3 interface

Question 14

An administrator is configuring log forwarding filters in PAN-OS to reduce the volume of unneeded informational logs sent to an external SIEM. Where are these log forwarding filters defined?

Accepted Answer

Objects > Log Forwarding, attached to individual Security Policy rules.. Log forwarding filters in PAN-OS are defined under Objects > Log Forwarding, and the resulting log forwarding profile is attached to individual Security Policy rules. This allows administrators to control which logs (e.g., only high-severity threats, or only traffic logs for specific applications) are sent to external destinations like syslog or SIEM. The filter is evaluated per policy rule, giving granular control over log volume.

Answer

Device > Setup > Management, under the Syslog export filter tab.

Answer

Panorama > Collector Groups > Log Retention policies.

Answer

Network > Interfaces > Ethernet, under the advanced logging parameters.

Question 15

A security architect is designing an enterprise logging strategy where all Prisma Cloud audit alerts, vulnerability findings, and compliance violations must be streamed to a third-party SIEM (such as Splunk). Which Prisma Cloud feature should be configured to achieve real-time log export?

Accepted Answer

Prisma Cloud Alert Integrations / Webhooks / SIEM Connectors. Prisma Cloud Alert Integrations, Webhooks, and native SIEM Connectors are the built-in mechanisms for streaming audit alerts, vulnerability findings, and compliance violations to external systems like Splunk in near real-time. These integrations push events as they are generated, which is exactly what an enterprise logging strategy requires. Configuring a SIEM connector (or webhook) is the standard, supported path for real-time log export from Prisma Cloud.

Answer

Manual CSV export from the Prisma Cloud Asset Inventory dashboard

Answer

GlobalProtect syslog forwarding profiles on VM-Series firewalls

Answer

Twistcli command-line batch reporting scripts executed via cron