Cybersecurity-Apprentice Practice Test 16 — 15 Questions

Question 1

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the operation mode parameter is set to prevent rather than detect or disable.. The Cortex XDR agent's operation mode determines whether it only detects/reports or actively blocks malicious activity. To run in full prevention mode without user intervention, the installation profile must set the operation mode to 'prevent' (as opposed to 'detect' or 'disable'), which is configured in the agent installation package/profile before deployment. This ensures the endpoint enforces policy from the moment the agent registers.

Answer

Disable the self-defense mechanism during MSI deployment.

Answer

Configure the proxy bypass list for local loopback communication.

Answer

Set the heartbeat interval to 60 seconds.

Question 2

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

Accepted Answer

Prisma Cloud Application Security. Prisma Cloud Application Security (formerly Prisma Cloud Code Security) is the module that scans Infrastructure as Code templates (Terraform, CloudFormation, ARM, etc.) for misconfigurations and integrates into developer workflows like GitHub, GitLab, and Terraform Cloud via CI/CD hooks. It enforces policy-as-code before deployment.

Answer

Prisma Cloud Agentless Scanning

Answer

Prisma Cloud Runtime Defender DaemonSet

Answer

VM-Series Virtual Next-Generation Firewall

Question 3

An administrator needs to troubleshoot why a specific user is unable to access an internal application mapped via User-ID. Which TWO tools or commands can verify User-ID mapping status? (Choose two)

Accepted Answer

CLI command: show user ip-user-mapping all. Option C, `show user ip-user-mapping all`, is correct because it directly displays the User-ID IP-to-username mappings currently known to the firewall, letting the administrator confirm whether the specific user's IP is mapped to the expected username. Option E, `show user group name <group-name>`, is correct because it lists the members of a User-ID group, allowing verification that the user is properly resolved into the group used by the security policy for the internal application. Options A, B, and D are incorrect because `show high-availability state`, `show interface hardware`, and `show system environmental` report HA status, interface hardware details, and hardware/environmental health respectively, none of which reveal User-ID mapping or group membership information.

Answer

CLI command: show high-availability state

Answer

CLI command: show interface hardware

Answer

CLI command: show system environmental

Question 4

A tier-1 SOC analyst receives an alert for a blocked malware execution detected by WildFire on a firewall. What is the standard operational response procedure for this type of high-confidence prevention alert?

Accepted Answer

Verify that the threat was successfully blocked by the firewall and check if any other endpoints attempted to access the same file.. WildFire is Palo Alto Networks' cloud-based malware analysis sandbox, and when it identifies a file as malicious, the firewall can enforce a prevention action (block or alert) inline. Because the alert indicates the threat was already blocked, the analyst's job shifts from containment to verification and scope assessment — confirming the block succeeded and checking whether other hosts attempted to download the same file, which would indicate a broader campaign or lateral movement attempt. This is the standard tier-1 triage pattern for high-confidence prevention alerts: validate the control worked, then hunt for related activity.

Answer

Escalate the alert directly to law enforcement without reviewing internal logs.

Answer

Immediately re-image the firewall management plane to remove potential rootkits.

Answer

Disable WildFire inline inspection to prevent future network latency.

Question 5

A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)

Accepted Answer

Establishment of network connections to known malicious IP addresses or unexpected ports. Prisma Cloud Compute's runtime defense for containers includes network-based threat detection, so option A is correct: it monitors container network activity and can alert on or block connections to known malicious IP addresses and unexpected ports using threat intelligence and behavioral models. Option C is correct because process execution monitoring is a core runtime defense capability — Prisma Cloud Compute uses models of allowed/expected processes and can detect or prevent execution of unauthorized or disallowed binaries inside a container. Option E is correct because file system integrity monitoring watches for modifications to sensitive files within the container file system and can generate alerts or block those changes. Option B is not correct because physical hardware temperature monitoring is a data-center or host-level concern, not a container runtime behavior Prisma Cloud Compute defends against. Option D is not correct because AWS IAM policy changes occur in the cloud management control plane and are handled by cloud security posture management (CSPM) or audit/identity monitoring, not by container runtime defense rules.

Answer

Physical server hardware temperature anomalies

Answer

AWS IAM policy changes in the underlying cloud management control plane

Question 6

An administrator needs to configure granular endpoint settings for different departments within the organization. Which THREE components of Cortex XDR should be utilized? (Choose three)

Accepted Answer

Endpoint Groups to categorize workstations based on criteria such as department or OS.. The scenario requires granular endpoint configuration per department, which Cortex XDR achieves through three components. Option A, Endpoint Groups, is correct because groups let the administrator categorize endpoints by criteria such as department, OS, or tags, providing the scoping mechanism that makes settings granular per department. Option C, Installation Settings, is correct because these define the initial agent configuration parameters (e.g., distribution, registration, and default settings) applied when the agent is first installed, ensuring endpoints start with the appropriate baseline. Option E, Agent Settings profiles, is correct because these profiles define operational parameters and prevention module states (e.g., Malware, Exploit, Behavioral threat protection) and are assigned to endpoint groups, delivering the department-specific behavior. Options B and D are incorrect: WPA3 enterprise RADIUS shared secrets are a wireless authentication concern unrelated to Cortex XDR endpoint policy, and BGP ASN path configuration is a network routing function with no role in endpoint settings management.

Answer

Global Wi-Fi WPA3 enterprise RADIUS shared secrets.

Answer

BGP Autonomous System Number (ASN) path configuration tables.

Question 7

Which TWO protocols are commonly used for device management and administrative access on a Palo Alto Networks firewall management plane? (Choose two)

Accepted Answer

SSH. SSH (Option C) is correct because it provides encrypted command-line administrative access to the Palo Alto Networks firewall management plane, typically on port 22, and is a standard secure management protocol. HTTPS (Option E) is correct because it secures the web-based management interface (PAN-OS web UI) using TLS, commonly on port 443, and is the recommended protocol for GUI administration. FTP (Option A) is not used for management access since it is an unencrypted file-transfer protocol and lacks administrative session capabilities. Telnet (Option B) is excluded because, although it offers remote CLI access, it is cleartext and insecure, so it is not a recommended management protocol. HTTP (Option D) is not correct because the web UI should be accessed over HTTPS rather than unencrypted HTTP.

Answer

FTP

Answer

Telnet

Answer

HTTP

Question 8

When onboarding multi-account cloud environments into Prisma Cloud, administrators can choose from several integration methods. Which THREE advantages are gained by setting up centralized cloud account onboarding and role aggregation? (Choose three)

Accepted Answer

Simplifies IAM role maintenance by leveraging organization-level trust relationships. Option A is correct because centralized onboarding uses organization-level trust relationships (for example, AWS Organizations with a single management-account role or Azure management groups) so that IAM roles are maintained once at the org level rather than per account, greatly simplifying role maintenance. Option C is correct because this aggregation model automatically discovers and onboards new accounts as they are added to the organization, eliminating the need to manually configure permissions and onboard each account individually. Option D is correct because aggregating all accounts under one centralized integration gives a single consolidated view of posture and compliance across every business unit and account. Option B is not correct because Prisma Cloud onboarding does not configure VM-Series firewalls to peer BGP with an ISP, which is a network-routing function unrelated to cloud account integration. Option E is not correct because Prisma Cloud is a cloud security posture and protection platform and has no capability to reboot physical data center servers during hardware failures.

Answer

Enables VM-Series firewalls to route BGP updates directly to the ISP

Answer

Allows Prisma Cloud to directly reboot physical data center servers during hardware failures

Question 9

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

Accepted Answer

A Decryption policy rule configured with the 'Forward Proxy' action.. Option A is correct because a Decryption policy rule with the 'Forward Proxy' action is the actual policy construct that tells the firewall to intercept and re-sign outbound SSL/TLS sessions destined to external servers. Option B is correct because SSL Forward Proxy requires a Forward Trust Certificate (the CA certificate the firewall uses to generate spoofed server certificates); it must be signed by an enterprise CA that the endpoints already trust, otherwise clients will reject the re-signed certificates. Option E is correct because a Decryption Profile attached to the decryption rule defines the enforcement settings for the proxy, such as blocking untrusted issuers, expired certificates, and unsupported versions/ciphers, and is required for the rule to function as intended. Option C is incorrect because an external BGP peer is a routing feature and has no role in SSL Forward Proxy decryption. Option D is incorrect because a GlobalProtect Gateway license is unrelated to decryption; SSL Forward Proxy does not require GlobalProtect licensing.

Answer

An external BGP routing peer for prefix exchange.

Answer

A GlobalProtect Gateway license installed on the management plane.

Question 10

An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)

Accepted Answer

Secret detection to prevent credentials from being hardcoded in serverless source code. Prisma Cloud Compute secures serverless functions such as AWS Lambda across the build and runtime lifecycle. Option A is correct because it performs secret detection, scanning serverless source code and function configurations to catch hardcoded credentials (API keys, tokens, passwords) before they are deployed. Option B is correct because it scans serverless deployment packages and their dependencies for known vulnerabilities (CVEs), so risky libraries are identified before or during deployment. Option C is correct because Prisma Cloud provides runtime protection and function hardening for FaaS, detecting and blocking injection attacks and other malicious execution behavior in running functions. Option D is incorrect because BGP peering between VPCs and on-premises routers is a network connectivity concern, not a serverless security capability of Prisma Cloud Compute. Option E is incorrect because Prisma Cloud is a security platform and does not provide physical rack space or data center infrastructure in AWS.

Answer

Configuring enterprise BGP peering sessions between cloud VPCs and on-premises routers

Answer

Providing dedicated physical server rack space in AWS data centers

Question 11

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

Accepted Answer

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.. Option C is correct because App-ID is a behavioral, multi-stage classifier: when a session first starts, the firewall may only have enough information to label it 'unknown-tcp', but as additional packets arrive it matches application signatures and protocol heuristics deeper in the stream, so the App-ID can legitimately change to a specific application such as 'ssl' or 'web-browsing'. Option D is correct because, with SSL/TLS decryption enabled, the firewall can inspect the TLS handshake (for example the ClientHello/ServerHello and SNI) and then identify the session as 'ssl' or the underlying web application, which explains a mid-session transition from 'unknown-tcp' to 'ssl'. Options A, B, and E do not belong: a reboot would terminate or reset sessions rather than reclassify an existing one, static routing changes affect path selection and not application identification, and NAT source-port translation does not cause App-ID to re-evaluate or renegotiate the application.

Answer

The firewall rebooted mid-session, causing the application cache to reset.

Answer

Static routing tables dynamically updated the next-hop gateway.

Answer

NAT rules translated the source port, forcing an application renegotiation.

Question 12

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

Accepted Answer

To centralize log collection, event correlation, and security incident monitoring across disparate enterprise systems.. A SIEM aggregates logs from firewalls, endpoints, servers, and applications into a central platform, then applies correlation rules and analytics to detect and alert on security incidents. Its core value is providing a single pane of glass for monitoring, triage, and compliance reporting across heterogeneous enterprise systems. This matches option A precisely.

Answer

To analyze unknown executable files in an isolated sandbox environment.

Answer

To automatically patch operating system vulnerabilities on endpoints.

Answer

To enforce inline packet inspection and drop malicious TCP packets.

Question 13

A security administrator is configuring a web application firewall (WAF) in front of a public-facing login portal. The administrator wants to protect against automated credential stuffing attacks that use large lists of username and password combinations. Which WAF feature is MOST appropriate to detect and block this behavior?

Accepted Answer

Bot detection and behavioral analysis. Credential stuffing uses automated tools and often distributed IPs, so bot detection and behavioral analysis is the most appropriate WAF feature. It can identify non-human interaction patterns and challenge or block them. Rate limiting and signature rules provide some value but are less effective against distributed, low-volume automated login attempts.

Answer

Cross-site scripting (XSS) filtering

Answer

Signature-based SQL injection rules

Answer

Rate limiting based on source IP address

Question 14

A security analyst is reviewing captured traffic and needs to identify which protocol resolves a known IPv4 address to its corresponding MAC address on the local segment. Which protocol performs this function?

Accepted Answer

ARP. ARP is the protocol that maps a known IPv4 address to a MAC address on a local network. A host broadcasts an ARP request asking who owns the address, and the owner responds with its hardware address. This mapping is required because Ethernet frames must carry a destination MAC address, so without ARP a host could not deliver traffic to another device on the same segment.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 15

A network security analyst is reviewing how a host on a corporate LAN resolves names and discovers services. The analyst wants to identify TWO protocols or mechanisms that operate at the application layer and rely on UDP for transport. (Choose two.)

Accepted Answer

mDNS queries on the local segment. DNS to a recursive resolver and mDNS both operate at the application layer and use UDP. DNS favors UDP for its small, fast request-response exchanges on port 53, while mDNS uses UDP multicast on port 5353 for local name resolution and service discovery. HTTP, SMTP, and SSH are application-layer protocols but rely on TCP for reliable transport, so they do not meet the stated criterion.

Answer

SMTP delivery between mail servers

Answer

SSH remote administration sessions

Answer

HTTP requests to a web server on port 80