Cybersecurity-Apprentice Practice Test 15 — 15 Questions

Question 1

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Option C is correct because a Tier-1 SOC analyst's core duty is monitoring the SIEM/alert queue and performing initial triage and categorization of incoming security events, determining whether alerts are true or false positives before deeper investigation. Option D is correct because Tier-1 analysts follow documented, standardized runbooks/SOPs for known alert types and escalate complex or confirmed incidents to Tier-2/Tier-3 for advanced analysis. Option A is wrong because configuring enterprise BGP routing policies on edge routers is a network engineering task, not a SOC analyst responsibility. Option B is wrong because writing custom kernel-level endpoint sensor drivers is a low-level software/EDR development task performed by engineers, not Tier-1 analysts. Option E is wrong because reverse-engineering unknown zero-day malware binaries in a sandbox is advanced malware analysis typically handled by Tier-3/threat research or reverse-engineering specialists.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 2

Under the shared responsibility model in cloud computing, the customer retains responsibility for securing specific layers regardless of whether the service is IaaS, PaaS, or SaaS. Which TWO items are always the customer's responsibility? (Choose two)

Accepted Answer

Data classification, labeling, and encryption key management. Options A and D are correct because the shared responsibility model always places the customer in charge of their own data and identities, no matter the service model. A is right because data classification, labeling, and encryption key management are customer-owned governance tasks: the customer decides what data is sensitive, how it is tagged, and who holds the keys (e.g., in a BYOK or HYOK scheme), since the provider cannot make those business judgments. D is right because user access control, authentication policies, and IAM configurations (roles, policies, MFA, least-privilege assignments) are always configured and maintained by the customer, even in SaaS where the provider only supplies the IAM engine. Option B is wrong because physical media recycling and disk sanitization are provider responsibilities at the hardware layer, typically covered by the provider's asset disposal and NIST 800-88-style sanitization processes. Option C is wrong because patching the hypervisor and virtualization software is the provider's job in IaaS, PaaS, and SaaS, as the customer has no access to that layer. Option E is wrong because data center perimeter security such as fences, guards, and physical access controls is always the cloud provider's responsibility.

Answer

Physical server hardware recycling and disk sanitization

Answer

Underlying cloud provider hypervisor and virtualization software patches

Answer

Physical data center perimeter security fences and guards

Question 3

An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?

Accepted Answer

Prisma Cloud Admission Controller Webhook. The Prisma Cloud Admission Controller Webhook registers with the Kubernetes API server as a ValidatingAdmissionWebhook, so every pod CREATE/UPDATE is intercepted before persistence. It evaluates the pod spec against Prisma Cloud runtime policies and rejects non-compliant manifests such as privileged containers. This is the only component in the list that operates at the admission phase.

Answer

Prisma Cloud Defender DaemonSet

Answer

Prisma Cloud Console

Answer

AWS IAM policy simulator

Question 4

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

Accepted Answer

GlobalProtect. GlobalProtect is Palo Alto Networks' remote access solution that provides secure VPN tunneling for remote workers, including always-on VPN, split tunneling, and integration with the next-generation firewall for security policy enforcement. It securely tunnels both internet-bound and corporate traffic back to the NGFW, matching the requirement.

Answer

WildFire

Answer

AutoFocus

Answer

Traps agent

Question 5

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Accepted Answer

A DoS Protection Profile configured with random early drop or classified rate limiting.. A volumetric brute-force attack originating from thousands of distinct IPs is a distributed denial-of-service pattern, and a DoS Protection Profile with random early drop or classified rate limiting is designed to detect and throttle such floods before they exhaust the portal's resources. DoS Protection Profiles operate at the firewall's dataplane to enforce per-source or per-class rate limits, which directly counters the high-volume, many-source nature of the attack. This is the correct mitigation profile to attach to the security rule.

Answer

A custom URL Filtering profile blocking the login page URL category.

Answer

An Antivirus Profile with signature auto-update enabled every minute.

Answer

A Data Filtering Profile configured to scan for weak passwords.

Question 6

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

Accepted Answer

Provides a standardized industry terminology for describing adversary tactics and techniques.. Option B is correct because MITRE ATT&CK supplies a common, vendor-neutral vocabulary of adversary tactics and techniques, so Cortex XDR analysts can describe and compare alerts consistently across teams and tools. Option C is correct because mapping alerts to ATT&CK techniques lets analysts see which techniques have no corresponding detection rules, exposing coverage gaps in security controls that can then be remediated. Option E is correct because ATT&CK techniques are organized under tactics that correspond to phases of the attack lifecycle, enabling analysts to place each alert in context such as initial access, execution, or exfiltration. Option A is incorrect because Cortex XDR does not recompile malicious binaries into safe patches; that is not a function of ATT&CK mapping or any endpoint protection platform. Option D is incorrect because ATT&CK is a knowledge framework for classifying adversary behavior, not a replacement for preventive controls like endpoint firewalls or network segmentation.

Answer

Automatically recompiles malicious binary code into safe executable patches.

Answer

Directly replaces the need for endpoint firewalls and network segmentation.

Question 7

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

Accepted Answer

Use the twistcli utility in the CI/CD pipeline to scan images before registry push. Prisma Cloud Compute ships the `twistcli` command-line scanner, which is designed to be invoked inside CI/CD jobs (Jenkins, GitLab, GitHub Actions, etc.) to scan container images for CVEs, compliance violations, and secrets before the image is pushed to a registry. Running `twistcli images scan --address --user --password

--details ` returns a non-zero exit code when the configured vulnerability threshold is exceeded, which fails the build and blocks the push — shifting detection left from runtime to build time.

Answer

Enable AWS GuardDuty anomaly detection on the container registry repository

Answer

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Answer

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes

Question 8

Which THREE features are provided by the Cortex XDR agent to protect endpoints against modern malware and advanced threats? (Choose three)

Accepted Answer

Local Analysis utilizing machine learning models to detect unknown malware.. Option A is correct because the Cortex XDR agent performs Local Analysis on the endpoint using machine learning models (including static and behavioral ML) to identify and block previously unknown malware without relying on cloud connectivity. Option B is correct because Behavioral Threat Protection monitors process and system activity in real time to detect post-exploitation techniques such as credential dumping, lateral movement, and ransomware behavior mapped to the MITRE ATT&CK framework. Option C is correct because Exploit Protection applies exploit mitigation techniques (e.g., DEP, ASLR enforcement, and injection prevention) to stop memory corruption and code-injection attacks targeting vulnerable applications. Option D is incorrect because Deep Packet Inspection for BGP routing convergence is a network routing function, not an endpoint agent capability, and BGP is irrelevant to endpoint malware defense. Option E is incorrect because RAID array generation is a storage/hardware fault-tolerance feature, not a security protection provided by the Cortex XDR agent.

Answer

Deep Packet Inspection for BGP routing protocol convergence.

Answer

Automatic generation of RAID disk arrays for local fault tolerance.

Question 9

An administrator wants to protect a server farm from TCP SYN flood attacks. Which security control should be deployed on the external ingress zone?

Accepted Answer

A Zone Protection Profile with SYN flood protection enabled.. A Zone Protection Profile applied to the external ingress zone is the Palo Alto Networks mechanism for defending against volumetric and protocol-based attacks, and it includes a dedicated SYN flood protection section. When enabled, the firewall uses SYN cookies and related thresholds to absorb or drop half-open TCP connection attempts before they exhaust the session table. This directly mitigates TCP SYN flood attacks targeting the server farm.

Answer

A custom decryption policy rule.

Answer

A URL Filtering Profile with high-risk categories blocked.

Answer

A Data Filtering profile configured for credit cards.

Question 10

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

Accepted Answer

Ensure outbound TCP port 443 traffic is permitted to the Cortex XDR backend FQDNs.. Option B is correct because Cortex XDR agents communicate with the cloud console over outbound TCP 443 (HTTPS/TLS) to the Cortex XDR backend FQDNs, so any firewall or proxy blocking that traffic will prevent incident data from being reported. Option C is correct because the agent must resolve the tenant-specific service endpoints (e.g., the tenant's Cortex XDR FQDN) via DNS; if local DNS servers cannot resolve these endpoints, the agent cannot establish its connection to the cloud. Option A is not relevant because DHCP lease renewal timing has no bearing on agent-to-cloud reporting. Option D is incorrect because inbound SSH port 22 is for administrative access, not for agent telemetry, which is outbound-initiated. Option E is incorrect because SNMP v3 traps on port 162 are for network monitoring and are unrelated to Cortex XDR agent communication.

Answer

Check that local DHCP leases are renewed every 30 seconds.

Answer

Confirm that inbound SSH port 22 is open on all endpoint host firewalls.

Answer

Verify that SNMP v3 trap listeners are active on port 162.

Question 11

When performing threat hunting in Cortex XDR using XQL, an analyst needs to identify anomalous execution chains. Which THREE XQL query stages or clauses are valid and commonly used in building investigative queries? (Choose three)

Accepted Answer

stats count() by actor_process_image_path. Option C is correct because every XQL query must begin by specifying the data source with the dataset stage, and 'dataset = xdr_data' is the standard dataset for Cortex XDR endpoint telemetry. Option B is correct because 'filter' is the XQL stage used to narrow results by field conditions, and 'filter event_type = 'PROCESS_START'' validly restricts the query to process-creation events, which is essential for building execution chains. Option A is correct because 'stats count() by actor_process_image_path' is a valid XQL aggregation stage that groups process starts by their executable path, helping analysts spot anomalous or rare binaries. Option D is incorrect because 'SELECT * FROM root WHERE execute == true' is SQL syntax, not XQL, and XQL does not use SELECT/FROM/WHERE clauses. Option E is incorrect because 'RUN DIAGNOSTICS FOR ALL ENDPOINTS IMMEDIATE' is not an XQL stage or clause; it resembles a response-action command rather than a query construct.

Answer

SELECT * FROM root WHERE execute == true

Answer

RUN DIAGNOSTICS FOR ALL ENDPOINTS IMMEDIATE

Question 12

An administrator needs to verify the MAC address associated with a specific IP address on the local network segment using the firewall CLI. Which command should be executed?

Accepted Answer

show arp all. The 'show arp all' command displays the ARP cache, which maps IP addresses to MAC addresses on the local network segment. This is the correct way to verify the MAC address associated with a specific IP on a Palo Alto Networks firewall CLI. ARP entries are populated dynamically as the firewall communicates with hosts on the same subnet.

Answer

show mac-table all

Answer

show interface ip

Answer

show routing route

Question 13

When designing a Security Operations Center (SOC) incident triage workflow, which TWO core principles are fundamental for effective incident management? (Choose two)

Accepted Answer

Establishing clear severity levels and prioritization criteria for incoming alerts.. Option A is correct because a SOC triage workflow depends on defined severity levels and prioritization criteria (for example, mapping alerts to P1–P4 based on asset criticality, exploitability, and business impact) so analysts consistently decide what to work first. Option C is correct because repeatable playbooks and documentation for standard incident types (such as phishing, malware, or unauthorized access) standardize response steps, reduce mean time to respond (MTTR), and ensure consistent, auditable handling across shifts. Option B is incorrect because granting every analyst unrestricted administrator access to all enterprise systems violates least privilege and expands the attack surface and insider-risk exposure. Option D is incorrect because ignoring low-severity alerts without review or automation creates blind spots and lets minor indicators escalate into major incidents. Option E is incorrect because deleting all historical log data daily destroys the evidence needed for detection, correlation, forensics, and compliance retention requirements.

Answer

Allowing every analyst unrestricted administrator access to all enterprise systems.

Answer

Ignoring low-severity alerts completely without review or automation.

Answer

Deleting all historical log data daily to maintain optimal disk storage capacity.

Question 14

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

Accepted Answer

Enable Anti-Tamper protection with a designated administrator password.. Anti-Tamper protection in the Cortex XDR agent settings locks the agent's files, services, and registry keys so that local users—even those with local administrator rights—cannot stop, modify, or uninstall the agent. It is enabled in the agent configuration profile and protected by a designated uninstall password that only the security team knows. This directly satisfies the requirement of preventing tampering or uninstallation on Windows workstations.

Answer

Configure Windows BitLocker drive encryption on the system drive.

Answer

Enable User Account Control (UAC) at the default notification level.

Answer

Set the endpoint network profile to Public domain.

Question 15

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

Accepted Answer

Traffic log. The Traffic log in Palo Alto Networks firewalls records all sessions that match Security policy rules, including those with drop or deny actions. It contains source/destination IPs, ports, applications, and the action taken, making it the correct log for reviewing blocked connection attempts.

Answer

System log

Answer

Config log

Answer

Threat log