Cybersecurity-Apprentice Practice Test 14 — 15 Questions

Question 1

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A metric higher than 10 (e.g., 20). Static routes use administrative distance (AD) or metric to rank preference — the lower the value, the more preferred the route. To make a backup route used only when the primary fails, it must have a higher metric than the primary. With the primary at 10, assigning the backup 20 ensures the router installs the primary in the routing table and only falls back to the backup when the primary route is withdrawn (e.g., interface down or next-hop unreachable).

Answer

A metric lower than 10 (e.g., 5)

Answer

A metric of 0

Answer

The exact same metric of 10 to enable equal-cost multi-path (ECMP)

Question 2

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

Accepted Answer

Active sessions are synchronized to the passive peer, allowing seamless traffic continuity without dropping connections.. With Session Synchronization (Session State Sync) enabled in an HA active/passive pair, the active firewall continuously replicates session state — including TCP/UDP session tables, NAT translations, and application state — to the passive peer. On failover, the passive unit already holds the session state and can forward existing flows without forcing users to re-establish connections. This delivers seamless continuity for established sessions, which is the core value of HA session sync.

Answer

All active user sessions are immediately terminated and must re-authenticate.

Answer

Management IP addresses are duplicated on both units simultaneously.

Answer

The passive firewall boots up from power-off state to take over.

Question 3

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

Accepted Answer

Static IP. In a Palo Alto Networks Source NAT rule, the translated source address can be configured as Static IP (C), which maps each original source address to a fixed one-to-one translated address; Dynamic IP (E), which translates to an address from a pool without port translation (typically one-to-one or many-to-one without PAT); and Dynamic IP and Port (DIPP) (D), which performs PAT by translating both address and port so many hosts can share a pool of addresses. These three are the standard translation types offered in the Source NAT configuration under the Translated Source field. The unmarked options do not belong: VLAN Subinterface Tag (A) is an interface/zone attribute, not a NAT translation address type, and Port Forwarding Pool (B) is associated with Destination NAT (port forwarding), not Source NAT translation sources.

Answer

VLAN Subinterface Tag

Answer

Port Forwarding Pool

Question 4

A security awareness trainer is preparing a module on protecting against social engineering. The trainer wants to highlight common technical and human indicators that an email may be a phishing attempt. Which TWO indicators should the trainer include? (Choose two.)

Accepted Answer

The sender's display name matches a known colleague, but the reply-to address points to an external domain.. A reply-to address that differs from the displayed sender and a message that uses urgency or threats to force quick action are both strong phishing indicators. The first reveals a technical mismatch between apparent and actual sender, while the second exploits human psychology. Teaching users to notice these signs and verify requests through a separate trusted channel improves reporting and reduces successful phishing.

Answer

The email contains a link whose visible text matches a legitimate internal URL and the hover preview shows the same URL.

Answer

The message was delivered during normal business hours and uses the company's standard email signature template.

Answer

The email includes the company's full legal name and physical mailing address in the footer.

Question 5

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

Accepted Answer

App-ID based Security policy rules. Palo Alto's App-ID engine identifies applications regardless of port, protocol, or encryption, so a Security policy rule using App-ID can allow only specific approved internal web applications while denying everything else. This gives application-layer control that port-based rules cannot achieve, since modern apps often tunnel over 80/443 or hop ports. App-ID-based rules are the correct control for restricting outbound user traffic to approved applications.

Answer

Static routing tables

Answer

MAC address ACLs

Answer

Port-based IP/Port filtering rules

Question 6

A security administrator is planning a network segmentation design and needs to understand how devices communicate at Layer 2. Which TWO statements accurately describe Ethernet MAC address behavior in a switched network? (Choose two.)

Accepted Answer

A broadcast frame is forwarded out all ports except the port on which it was received.. Switches learn MAC addresses from source addresses of received frames and flood broadcast frames to all ports in the same VLAN except the ingress port. These two behaviors enable efficient unicast forwarding after learning and ensure broadcast-based protocols reach all hosts. Understanding them is key to predicting traffic flow and troubleshooting Layer 2 connectivity issues.

Answer

A unicast frame with an unknown destination MAC address is dropped by the switch.

Answer

A switch forwards a frame with a destination MAC address of FF:FF:FF:FF:FF:FF only to the default gateway.

Answer

MAC addresses are logical addresses assigned by the network administrator and can be changed per subnet.

Question 7

An enterprise security administrator is designing a comprehensive security posture following Zero Trust principles on a Palo Alto Networks Next-Generation Firewall. Which TWO core concepts must be implemented to satisfy a true Zero Trust data and network architecture? (Choose two)

Accepted Answer

Verify explicitly by authenticating and authorizing based on all available data points including user identity, location, and device health.. Option C is correct because Zero Trust's foundational principle of 'verify explicitly' requires every access request to be authenticated and authorized using all available context — user identity, location, device posture/health, and other telemetry — rather than granting trust based on network location alone. Option D is correct because the complementary Zero Trust principle of 'assume breach' demands that organizations minimize lateral movement and blast radius through strict micro-segmentation and least-privilege access, which on a Palo Alto NGFW is enforced via security zones, App-ID/User-ID policies, and granular rules. Option A is incorrect because relying solely on perimeter firewalls with uninspected internal VLANs is a traditional castle-and-moat model that directly contradicts Zero Trust's requirement for inspection and segmentation of east-west traffic. Option B is incorrect because implicitly trusting internal segments after VPN authentication is exactly the implicit-trust assumption Zero Trust eliminates; authentication alone does not justify unrestricted internal access. Option E is incorrect because disabling SSL decryption reduces threat visibility and undermines the continuous inspection and verification that Zero Trust requires, prioritizing privacy at the expense of security enforcement.

Answer

Rely solely on perimeter firewalls to block external malicious actors while leaving internal VLANs uninspected.

Answer

Trust internal corporate network segments implicitly once a user successfully authenticates via VPN.

Answer

Disable SSL decryption for internal traffic to prioritize employee privacy over threat visibility.

Question 8

A security operations team is configuring threat intelligence feeds in Cortex XSIAM. Which THREE indicator types can typically be ingested and correlated against network and endpoint telemetry? (Choose three)

Accepted Answer

File cryptographic hashes (SHA256, MD5). Option A is correct because file cryptographic hashes such as SHA256 and MD5 are standard indicator types that Cortex XSIAM ingests and correlates against endpoint telemetry (e.g., process executions and file activity) to detect known malicious files. Option B is correct because malicious IP addresses and CIDR blocks are core network indicators that XSIAM correlates against network telemetry such as firewall, proxy, and connection logs to identify communication with known-bad infrastructure. Option D is correct because Fully Qualified Domain Names (FQDNs) are standard domain indicators that XSIAM matches against DNS, proxy, and endpoint telemetry to detect resolution or contact with malicious domains. Option C does not belong because biometric fingerprint templates are identity/authentication data, not threat intelligence indicators, and are not ingested as IOC types for network and endpoint correlation. Option E does not belong because printer toner cartridge serial numbers are asset/inventory data with no threat-intelligence relevance and are not correlated as indicators.

Answer

Internal employee biometric fingerprint templates

Answer

Local printer toner cartridge serial numbers

Question 9

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

Accepted Answer

Zero-day malware and ransomware payloads delivered via web downloads or email attachments.. Option A is correct because NGFWs with security subscriptions such as WildFire, Advanced Malware Protection, or similar sandboxing and anti-malware services inspect web and email traffic to detect and block zero-day malware and ransomware payloads that signature-only engines would miss. Option E is correct because NGFWs commonly include URL filtering and anti-phishing subscriptions that categorize and block credential-harvesting sites and phishing domains before users can submit enterprise credentials. Option B is incorrect because unauthorized physical access to server racks is a physical security control addressed by locks, badges, and cameras, not by an NGFW security subscription. Option C is incorrect because fiber-optic attenuation from excessive bending is a Layer 1 cabling/installation issue, not a network security threat mitigated by an NGFW. Option D is incorrect because hardware interface failure from power surges is mitigated by surge protectors, UPS systems, and electrical protection, not by NGFW security subscriptions.

Answer

Unauthorized physical access to server racks within the data datacenter.

Answer

Fiber-optic cable attenuation caused by excessive distance bending.

Answer

Hardware physical interface failure caused by power surge transients.

Question 10

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Accepted Answer

An MTU mismatch between the OSPF neighbors. OSPF neighbors stuck in EXSTART/EXCHANGE almost always indicate an MTU mismatch between the two routers. During the ExchangeStart phase, routers negotiate the Database Description (DBD) sequence and Master/Slave roles, and if the MTU values differ, the DBD packets are dropped, preventing progression to the Loading and Full states.

Answer

A mismatch in OSPF area ID types (e.g., normal vs. stub)

Answer

Incorrect OSPF hello or dead timer intervals

Answer

Authentication type or password mismatch

Question 11

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

Accepted Answer

Behavioral Threat Protection. Behavioral Threat Protection (BTP) is the Cortex XDR module that monitors process behavior in real time and detects post-exploitation techniques such as process injection, credential dumping, and shellcode execution. Because polymorphic malware changes its file signature but still performs the same malicious behaviors (e.g., injecting into legitimate Windows processes), BTP catches it by analyzing the sequence of actions rather than static indicators. This makes it the primary module responsible for blocking process injection attempts.

Answer

URL Filtering profile

Answer

Data Loss Prevention (DLP) engine

Answer

DNS Security subscription

Question 12

An organization deploys a Palo Alto Networks firewall in 'Virtual Wire' mode. How does this deployment mode process incoming Ethernet frames?

Accepted Answer

It inspects and passes traffic inline between two ports without requiring IP addresses or MAC switching tables.. In Virtual Wire mode, a Palo Alto Networks firewall is inserted transparently between two network devices and inspects all traffic passing between its two interfaces without requiring IP addresses, MAC address learning, or routing. It acts as a bump-in-the-wire, applying security policy inline while remaining invisible to the network topology. This matches option C exactly.

Answer

It routes packets between multiple VLAN subnets using layer 3 gateway IPs.

Answer

It terminates VPN tunnels and assigns DHCP leases to remote clients.

Answer

It switches Ethernet frames across multiple ports using Spanning Tree Protocol.

Question 13

An administrator is configuring External Dynamic Lists (EDLs) in PAN-OS. Which THREE list types are natively supported for import into the firewall? (Choose three)

Accepted Answer

Domain list. PAN-OS External Dynamic Lists natively support three source types for import: IP list (D), URL list (C), and Domain list (B). An IP list is used to dynamically import IPv4/IPv6 addresses or subnets for use in security policy, and a URL list imports URLs for URL Filtering, while a Domain list imports domain names (including wildcards) for DNS-based enforcement. These three are the only EDL types configurable under Objects > External Dynamic Lists in PAN-OS. Option A (user password hash list) is not a supported EDL type, since user credential data is handled by authentication services such as LDAP, RADIUS, or Kerberos rather than EDL import. Option E (MAC address list) is also unsupported, as EDLs operate on IP, URL, and domain indicators, not Layer 2 MAC addresses.

Answer

User password hash list

Answer

MAC address list

Question 14

An administrator is troubleshooting a scenario where internal clients cannot establish connections to a newly published public web server hosted behind the firewall using its public NAT IP. What common firewall misconfiguration causes this behavior?

Accepted Answer

Failure to configure NAT Loopback (or hairpin NAT) when internal clients access public IPs of internal servers.. When internal clients try to reach an internal server via its public NAT IP, the firewall must support NAT loopback (also called hairpin NAT or U-turn NAT). Without it, the firewall does not translate the source and destination correctly for traffic that enters and exits the same interface, so the connection fails. Configuring NAT loopback allows internal clients to use the public IP and have the firewall redirect the traffic back to the internal server.

Answer

Missing User-ID mapping for the internal client IP addresses.

Answer

Incorrect configuration of the GlobalProtect Portal external gateway address.

Answer

Attaching an incorrect WildFire analysis profile to the security rule.

Question 15

A Cortex XDR administrator needs to prevent a specific known-malicious SHA-256 hash from executing on all Windows endpoints in a research lab, even if the file is renamed or copied to a new path. The administrator wants the block to take effect as quickly as possible without waiting for a full scan. Which Cortex XDR feature should be used?

Accepted Answer

Add the hash to the Block List in the Cortex XDR management console. The Block List in the Cortex XDR management console is designed for deterministic prevention of known malicious files by hash. When the policy is applied, the agent blocks execution of the listed SHA-256 hash on all targeted Windows endpoints, independent of file name or directory. This provides immediate protection without waiting for a scan and ensures consistent enforcement across the research lab.

Answer

Create a Malware profile with a Wildfire analysis action

Answer

Enable Behavioral Threat Protection with a BIOC rule

Answer

Configure a Restriction policy to block execution from Downloads folders