Cybersecurity-Apprentice Practice Test 17 — 15 Questions

Question 1

A security analyst at a financial firm notices that a Cortex XDR agent on a Windows 10 endpoint quarantined a file named 'invoice.pdf.exe' that was downloaded from a phishing email. The analyst wants to confirm the file's reputation and see if it has been seen across other organizations. Which Cortex XDR component should the analyst use to check the file's global reputation and threat intelligence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WildFire cloud service. WildFire cloud service is the correct component because it provides global file reputation and threat intelligence by analyzing files from multiple organizations. It integrates with Cortex XDR to enhance detection and response. The other options are internal Cortex XDR features that do not offer external threat intelligence or global file reputation.

Answer

Cortex XDR Query Center

Answer

Cortex XDR Device Control

Answer

Cortex XDR Incident Response Center

Question 2

A security administrator is configuring the Cortex XDR agent on a group of Linux servers. The administrator wants to ensure that the agent can prevent exploitation of known vulnerabilities in common Linux services. Which TWO prevention modules in the Cortex XDR agent profile should the administrator enable to achieve this? (Choose two.)

Accepted Answer

Exploit Protection. To prevent exploitation of known vulnerabilities in Linux services, the administrator should enable Exploit Protection and Kernel Exploit Protection. Exploit Protection blocks user-space exploitation attempts, while Kernel Exploit Protection specifically targets kernel vulnerabilities. Together, they provide comprehensive prevention against exploit-based attacks on Linux servers.

Answer

Malware Protection

Answer

Behavioral Threat Protection

Answer

File Integrity Monitoring

Question 3

A security analyst is reviewing a suspicious PowerShell script that was executed on a workstation. The script downloads a file from a remote URL, saves it to a temporary directory, and then executes it. Which TWO indicators should the analyst prioritize to determine whether this activity is malicious? (Choose two.)

Accepted Answer

The PowerShell process was spawned by a Microsoft Office application.. The two strongest indicators are Office spawning PowerShell and the use of an encoded command. The parent-child relationship suggests a macro or exploit launched the script, while Base64 encoding indicates an attempt to hide the payload. Together they form a high-confidence pattern of malicious script execution, unlike location or timing, which are too common to be reliable.

Answer

The downloaded file was saved to the user's Downloads folder.

Answer

The PowerShell execution policy was set to RemoteSigned.

Answer

The script ran during normal business hours.

Question 4

A Tier-1 SOC analyst receives an alert indicating that a workstation's host-based antivirus quarantined a known malware binary. The analyst must follow the organization's standard operating procedure for confirmed malware containment. Which action should the analyst take FIRST?

Accepted Answer

Isolate the affected workstation from the network and preserve volatile evidence.. For confirmed malware on an endpoint, the SOC playbook prioritizes containment while preserving volatile evidence. Isolating the workstation stops lateral movement, and capturing memory and active connections supports later forensic analysis. Rebooting, rescanning, or deleting the file and closing the alert either destroys evidence or skips required investigation and escalation steps, leaving the environment at risk.

Answer

Delete the quarantined file and close the alert as resolved.

Answer

Immediately reboot the workstation to clear the infection from memory.

Answer

Run a full antivirus scan and wait for the results before notifying anyone.

Question 5

A help desk technician is explaining basic network concepts to a new hire. The technician needs to describe which protocol operates at the Transport layer of the OSI model and provides reliable, connection-oriented delivery. Which protocol should the technician identify?

Accepted Answer

TCP. TCP is the Transport layer protocol that provides reliable, connection-oriented delivery through mechanisms such as the three-way handshake, sequence numbers, acknowledgments, and retransmissions. UDP is connectionless, while ICMP and ARP serve Network layer and address resolution functions respectively. Identifying TCP correctly is fundamental to understanding how applications achieve dependable data transfer.

Answer

ARP

Answer

ICMP

Answer

UDP

Question 6

A SOC analyst is reviewing a Cortex XSIAM alert for a suspicious PowerShell script execution. The analyst wants to see the full command line and the parent process of the PowerShell process. Which Cortex XSIAM feature should the analyst use?

Accepted Answer

Process Tree. The Process Tree feature in Cortex XSIAM visualizes the parent-child relationships of processes and includes the full command line for each process. This allows the analyst to see exactly how the PowerShell script was executed and what spawned it. Other features like Alert Details or Threat Hunting do not offer this specific view.

Answer

Incident Response

Answer

Threat Hunting

Answer

Alert Details

Question 7

A Cortex XDR administrator needs to ensure that endpoints in a high-security department can only communicate with a specific set of internal servers and cannot access the internet. Which Cortex XDR agent feature should be configured to enforce this network restriction?

Accepted Answer

Host Firewall policy. The Host Firewall policy is designed to control network traffic on the endpoint, allowing rules that restrict communication to specific internal servers while blocking all other connections, including the internet. Other policies address file, device, or exploit protection, not network restrictions.

Answer

Malware Prevention policy

Answer

Exploit Prevention policy

Answer

Device Control policy

Question 8

A Cortex XDR administrator needs to prevent users from copying sensitive files to unauthorized USB storage devices on a group of Windows endpoints. The administrator wants to allow only specific encrypted USB drives that are registered with the organization. Which Cortex XDR agent module should be configured to achieve this?

Accepted Answer

Device Control. Device Control is the Cortex XDR agent module designed to manage peripheral access, including USB storage devices. It supports granular policies that can allow only approved devices based on identifiers like vendor ID or serial number. Malware Protection, Exploit Protection, and Behavioral Threat Protection focus on software threats and do not control hardware device usage. Thus Device Control is the correct choice.

Answer

Malware Protection

Answer

Behavioral Threat Protection

Answer

Exploit Protection

Question 9

A junior security analyst at a healthcare company receives a call from an employee who says they received an email from the IT department asking them to click a link and reset their password. The email address looks slightly misspelled. The analyst wants to confirm whether this is a phishing attempt before the employee clicks anything. Which action should the analyst take FIRST?

Accepted Answer

Instruct the employee to forward the email to the security team and do not click the link.. The correct approach is to preserve the suspicious message and prevent interaction with it. Forwarding the email to the security team keeps headers and URLs intact for analysis, while instructing the employee not to click avoids credential theft or malware execution. This supports containment and enables responders to check for other recipients and block the sender or link.

Answer

Reply to the email asking the sender to verify their identity.

Answer

Delete the email from the employee's mailbox and close the ticket.

Answer

Tell the employee to click the link from a personal device so the corporate network is not affected.

Question 10

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Option B is correct because a Management Profile applied to an interface explicitly controls which management services (HTTPS, SSH, Telnet, SNMP, etc.) are permitted and from which source IP addresses, so restricting it to trusted management subnets prevents unauthorized administrative access from untrusted networks. Option E is correct because enabling an Authentication Profile with MFA on administrative accounts adds a strong second factor, mitigating credential theft and brute-force or password-reuse attacks against the management plane. Option A is incorrect because an Antivirus security profile on outbound HTTP rules protects data-plane traffic, not the management plane. Option C is incorrect because the captive portal is a user authentication/redirection feature for data-plane traffic and disabling it does not harden administrative access. Option D is incorrect because dynamic DNS updates on an untrusted interface increase exposure and are unrelated to securing management access.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 11

An organization wants to reduce the risk that a stolen laptop's disk contents can be read by a thief. The laptop contains only files on the local drive, and the user sometimes works offline. Which control best meets this requirement?

Accepted Answer

Enable full-disk encryption with a strong pre-boot authentication passphrase. The threat is offline physical access to data stored on the local drive, and the user may be disconnected from the network. Full-disk encryption with pre-boot authentication converts the drive contents into ciphertext that cannot be read without the key, directly mitigating that risk. Screen locks, VPN enforcement, and endpoint detection each address different threats, such as walk-up access, data in transit, or live malicious processes, and none protects a powered-off drive.

Answer

Deploy endpoint detection and response with behavioral blocking rules

Answer

Require a VPN connection for all access to corporate file shares

Answer

Enforce a screen lock that activates after five minutes of inactivity

Question 12

An administrator wants to view active sessions matching a specific source IP address (192.168.1.50) using the firewall CLI. Which command is correct?

Accepted Answer

show session all filter source 192.168.1.50. The correct CLI command to view active sessions matching a specific source IP is 'show session all filter source 192.168.1.50'. The 'show session all' command lists sessions, and the 'filter source' keyword narrows the output to sessions originating from that IP. This is the documented PAN-OS syntax for filtering sessions by source address.

Answer

show arp filter 192.168.1.50

Answer

show session filter ip 192.168.1.50

Answer

show ip session 192.168.1.50

Question 13

A security administrator is configuring Prisma Cloud to monitor an Azure subscription. They need to ensure that Prisma Cloud can read all resources and their configurations but must not be able to modify or delete any resources. Which Azure built-in role should be assigned to the Prisma Cloud service principal?

Accepted Answer

Reader. The Reader role provides read-only access to all resources in an Azure subscription, allowing Prisma Cloud to retrieve configurations without the ability to modify them. Contributor and Owner include write permissions, and User Access Administrator is limited to access management, making Reader the correct choice.

Answer

Contributor

Answer

User Access Administrator

Answer

Owner

Question 14

A network security analyst is investigating a suspected ARP spoofing attack on the local network. The analyst needs to verify the ARP cache on a Windows workstation to identify any duplicate IP addresses mapped to different MAC addresses. Which TWO commands can be used to display the ARP cache on the workstation? (Choose two.)

Accepted Answer

arp -a. To inspect the ARP cache on a Windows workstation, the analyst can use either arp -a or netsh interface ip show arp. Both commands list IP-to-MAC address mappings, enabling detection of duplicate IPs with different MACs, which is a sign of ARP spoofing. The other commands provide different network information and do not show ARP entries.

Answer

route print

Answer

netstat -ano

Answer

ipconfig /all

Question 15

A network administrator is configuring a Layer 3 interface on a Palo Alto Networks firewall to participate in a broadcast domain. The interface must obtain its IP address automatically from a DHCP server on the same subnet. Which interface configuration setting must be enabled to allow the firewall to act as a DHCP client?

Accepted Answer

DHCP Client. To have the firewall obtain an address automatically from a DHCP server on the same subnet, the Layer 3 interface must be configured with DHCP Client enabled. This mode allows the interface to request and renew a lease, dynamically receiving an IP address, subnet mask, default gateway, and DNS settings, which simplifies deployment in environments where centralized address management is used.

Answer

Static IP

Answer

DHCP Server

Answer

PPPoE