Cybersecurity-Apprentice Practice Test 18 — 15 Questions

Question 1

Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)

Accepted Answer

Isolate the endpoint from the network to prevent lateral movement.. Option A is correct because the Cortex XDR management console provides a network isolation action that cuts an endpoint off from the network (while typically preserving the management channel to the console) to stop lateral movement during an active incident. Option E is correct because Cortex XDR allows administrators to quarantine malicious or suspicious files/artifacts directly from the console as part of the response workflow, preventing execution or spread. Option B is wrong because HVAC cooling systems are physical facility infrastructure, not something managed by Cortex XDR. Option C is wrong because BGP routing tables on core routers are network-layer configurations outside the endpoint security console's scope. Option D is wrong because resetting Wi-Fi SSID pre-shared keys is a wireless infrastructure task, not an endpoint response action in Cortex XDR.

Answer

Reboot the physical datacenter HVAC cooling systems.

Answer

Modify core BGP routing tables on enterprise core routers.

Answer

Reset enterprise Wi-Fi SSID pre-shared keys.

Question 2

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Layer 3. Option B (Layer 3) is correct because a Palo Alto Networks firewall physical interface can be configured as a Layer 3 interface, which is assigned an IP address and participates in routing decisions, supporting features like static routes, OSPF, BGP, and DHCP. Option E (Virtual Wire) is correct because a physical port can be configured as a virtual wire interface, which binds two ports into a transparent, bump-in-the-wire pair that forwards traffic without any MAC or IP addressing or routing. The other options are not valid physical interface types on a Palo Alto firewall: WAN Accelerator is not an interface configuration mode, Switchport Trunk is a Cisco-style Layer 2 switching concept not offered as a physical port type here, and Promiscuous Bridge is not a supported interface type (tap and Layer 2 are the relevant transparent modes, but not 'promiscuous bridge').

Answer

WAN Accelerator

Answer

Switchport Trunk

Answer

Promiscuous Bridge

Question 3

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

Accepted Answer

Cortex XDR agent. The Cortex XDR agent is the lightweight software installed on endpoints (workstations, servers) that continuously collects telemetry, enforces prevention policies, and performs local analysis directly on the host OS. It is the component responsible for on-host data collection and threat prevention.

Answer

Panorama management server

Answer

Prisma Access cloud security service

Answer

WildFire cloud analysis engine

Question 4

A Tier-1 SOC analyst receives an alert from the endpoint agent indicating that a known malicious hash was blocked during execution. The analyst wants to confirm whether any other endpoints in the organization attempted to execute the same file and whether those attempts were blocked or allowed. Which data source should the analyst query to obtain this information?

Accepted Answer

The central management console's alert and event database. The central management console collects endpoint telemetry from all agents, so searching it by the malicious hash reveals every host that attempted execution and the resulting action. Local logs, firewall traffic, and DNS logs lack the endpoint execution context required. Using the central console enables rapid scoping and informed containment decisions.

Answer

The endpoint agent's local quarantine log stored on the affected host

Answer

The DNS server's query log for the affected subnet

Answer

The firewall's Application Command Center (ACC) traffic logs

Question 5

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

Accepted Answer

Configure Syslog forwarding or use the Cortex XDR streaming API to export alerts and BIOC data to the SIEM.. Cortex XDR supports real-time log and alert forwarding to external SIEMs through two native mechanisms: Syslog forwarding (configured in the Cortex XDR console) and the Cortex XDR streaming API, which exports alerts, BIOC (Behavioral Indicator of Compromise) events, and endpoint telemetry. These are the documented, supported paths for meeting a policy that requires real-time centralised log ingestion. They preserve event fidelity and timeliness, unlike batch exports.

Answer

Configure NetFlow export on the local endpoint network interface card.

Answer

Export daily CSV reports from the Cortex XDR console via email.

Answer

Enable SNMP trap generation inside the local Windows Event Viewer settings.

Question 6

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

Accepted Answer

The receiver's buffer is full and it is requesting the sender to pause transmission.. A TCP window size of zero means the receiver's receive buffer is full and it is advertising a zero window to tell the sender to stop transmitting until it can drain the buffer. This is normal TCP flow control, not an error — the sender will periodically send zero-window probes until the receiver advertises a non-zero window.

Answer

The maximum segment size (MSS) negotiation has failed during the three-way handshake.

Answer

An asymmetric routing loop has caused sequence numbers to go out of sync.

Answer

The firewall has blocked the session due to a security profile match.

Question 7

A SOC analyst is reviewing the primary log categories generated by a Palo Alto Networks Next-Generation Firewall. Which TWO log types are natively available in PAN-OS for security monitoring and incident analysis? (Choose two)

Accepted Answer

Threat logs. Threat logs (A) are a native PAN-OS log type that records security events detected by the firewall's security profiles, such as antivirus, anti-spyware, vulnerability protection, URL filtering, and WildFire verdicts, making them essential for incident analysis. Traffic logs (B) are also natively generated by PAN-OS and capture details of sessions traversing the firewall, including source/destination, application, action, and bytes, which supports security monitoring and forensic review. Kernel memory core-dump logs (C) are OS-level diagnostic artifacts, not a PAN-OS security log category. BIOS hardware diagnostic logs (D) belong to hardware/firmware diagnostics and are unrelated to firewall security logging. Local switch VLAN spanning-tree logs (E) are Layer 2 switch logs and are not a native PAN-OS log type.

Answer

Kernel memory core-dump logs

Answer

BIOS hardware diagnostic logs

Answer

Local switch VLAN spanning-tree logs

Question 8

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

Accepted Answer

Administration > Access Control > Trusted IP. Trusted IP restrictions in Prisma Cloud are configured under Administration > Access Control > Trusted IP, where administrators define allowlisted CIDR ranges that are permitted to reach the administrative console. This setting is a platform-level access control, not a per-cloud-account or workload-level control, so it lives in the Administration section. Once configured, login attempts from IPs outside the trusted ranges are blocked before authentication completes.

Answer

Cloud Accounts > Add Account > Network Security

Answer

Inventory > Asset Explorer > Filters

Answer

Compute > Defend > Access Rules

Question 9

A security operations center (SOC) analyst is investigating a series of alerts indicating that internal users are accessing malicious domains. The analyst wants to verify whether the Palo Alto Networks firewall is blocking these domains based on DNS sinkholing. Which firewall feature should the analyst check to confirm that DNS sinkholing is properly configured and operational?

Accepted Answer

DNS Security profile applied to the Security policy rule allowing DNS traffic.. The correct feature to check is the DNS Security profile applied to the Security policy rule allowing DNS traffic. DNS Security provides DNS sinkholing by responding to queries for malicious domains with a sinkhole IP address, preventing users from reaching the actual malicious site. It uses Palo Alto Networks threat intelligence and is the only feature among the options that operates at the DNS layer to block malicious domains proactively.

Answer

WildFire analysis profile applied to the Security policy rule allowing DNS traffic.

Answer

Anti-Spyware profile applied to the Security policy rule allowing DNS traffic.

Answer

URL Filtering profile applied to the Security policy rule allowing web traffic.

Question 10

A security administrator is configuring Cortex XDR agent installation packages for a mixed environment of Windows and macOS endpoints. The administrator needs to ensure that the agent can communicate with the Cortex XDR cloud tenant and that endpoints are protected immediately after installation. Which TWO configuration settings are required in the installation package to achieve this? (Choose two.)

Accepted Answer

Registration token. The tenant ID and registration token are the two required settings for the Cortex XDR agent to communicate with the cloud tenant and register successfully. The tenant ID identifies the correct tenant, and the registration token authenticates the agent. Without these, the agent cannot establish a connection or receive policies, leaving the endpoint unprotected.

Answer

WildFire API key

Answer

Endpoint group name

Answer

Proxy server address

Question 11

A security analyst for a healthcare company is configuring Prisma Cloud to monitor an AWS environment that stores protected health information. The compliance team requires that all data at rest be encrypted with customer-managed keys and that any deviation be detected within minutes. Which Prisma Cloud capability should the analyst use to continuously detect S3 buckets that are not encrypted with a customer-managed AWS KMS key?

Accepted Answer

Create a Config RQL policy that evaluates the S3 bucket encryption configuration and flags buckets not using a customer-managed KMS key.. The requirement is continuous detection of a configuration state, not of API activity or runtime behavior. Prisma Cloud Config policies built with RQL directly query the S3 bucket encryption attributes and can distinguish AWS-managed keys from customer-managed KMS keys. This produces the near-real-time, configuration-aware alerting the compliance team needs without relying on the customer to make a new API call.

Answer

Configure a CloudTrail integration and create an alert for any PutBucketEncryption API call in the account.

Answer

Deploy the Prisma Cloud Compute Defender to the EC2 instances that access the buckets and enable file integrity monitoring.

Answer

Enable Prisma Cloud Anomaly Detection for S3 to baseline normal access patterns and alert on unusual GetObject calls.

Question 12

A junior security analyst is reviewing the TCP/IP model as part of onboarding. She needs to identify which layer is responsible for logical addressing and routing of packets between different networks. Which layer of the TCP/IP model performs this function?

Accepted Answer

The Internet layer. The Internet layer of the TCP/IP model is responsible for logical addressing and routing. Protocols like IP assign addresses and determine paths across networks. The Network Access layer deals with physical and link concerns, the Transport layer manages end-to-end delivery, and the Application layer supports user services. Only the Internet layer performs the logical addressing and inter-network routing the scenario describes.

Answer

The Network Access layer

Answer

The Application layer

Answer

The Transport layer

Question 13

A SOC analyst is triaging an alert for a suspicious login to a cloud-based email service. The alert indicates a successful login from an IP address in a foreign country, but the user typically works from the United States. The analyst checks the user's recent activity and sees that the login occurred outside normal working hours. Which of the following actions should the analyst take NEXT to determine if the login is malicious?

Accepted Answer

Contact the user to verify if they initiated the login from that location.. The next step should be to contact the user to verify whether they initiated the login. This is a non-disruptive action that can quickly clarify whether the login is legitimate, such as if the user is traveling or using a VPN. If the user denies the login, the analyst can then proceed with containment actions like password reset and session revocation, and further investigate for compromise.

Answer

Reset the user's password and revoke all active sessions immediately.

Answer

Block the foreign IP address on the firewall to prevent further access.

Answer

Review the user's mailbox audit logs for any suspicious email forwarding rules or file downloads.

Question 14

A network administrator is configuring a site-to-site VPN between two offices using IPsec in tunnel mode. The administrator wants to ensure that only specific subnets can communicate over the VPN, and that the traffic is encrypted and authenticated. Which combination of IPsec components achieves this?

Accepted Answer

ESP in tunnel mode with specific proxy IDs for the allowed subnets. ESP in tunnel mode encrypts the entire original IP packet and encapsulates it, providing confidentiality for site-to-site VPNs. Specific proxy IDs (also called traffic selectors) define which local and remote subnets are allowed over the VPN, enforcing the restriction to only those subnets. Together, they meet the encryption and subnet restriction requirements.

Answer

AH in transport mode with a wildcard proxy ID

Answer

AH in tunnel mode with specific proxy IDs

Answer

ESP in transport mode with a wildcard proxy ID

Question 15

A security administrator is configuring Prisma Cloud Cloud Account onboarding for an AWS environment that includes standalone accounts as well as accounts that were created through AWS Organizations. The administrator wants to minimize the manual effort required to grant Prisma Cloud read-only access and to automatically include future accounts. Which approach should the administrator use?

Accepted Answer

Create a CloudFormation stack set in the AWS Organizations management account to deploy the Prisma Cloud read-only role to all existing and future member accounts.. Prisma Cloud onboards AWS Organizations by deploying a read-only IAM role through a CloudFormation stack set from the management account, which automatically applies to existing and future member accounts. This eliminates per-account manual role creation and satisfies the requirement for automatic inclusion of new accounts while keeping least-privilege access.

Answer

Configure an AWS Config aggregator in the management account and provide Prisma Cloud with the aggregator ARN and a service-linked role.

Answer

Generate a cross-account IAM role in each member account manually and then add each account individually in Prisma Cloud using its account ID and external ID.

Answer

Use AWS IAM Identity Center to federate Prisma Cloud users into each account and grant them the SecurityAudit managed policy.