Cybersecurity-Apprentice Practice Test 19 — 15 Questions

Question 1

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Objects > Applications > [Application Name], modifying TCP timeout settings. In Palo Alto Networks PAN-OS, application-specific TCP timeout settings are configured under Objects > Applications > [Application Name], where you can override the default session timeout for that application. This allows the engineer to extend the timeout for the custom database application without affecting global or interface-level timeouts. Modifying the application object ensures the change applies only to traffic identified as that application.

Answer

Network > Interfaces > Advanced > TCP Timeout

Answer

Policies > Security > Timeout Profile

Answer

Device > Setup > Management > Session Settings

Question 2

A hospital network administrator must ensure that only authorized medical devices can connect to a dedicated VLAN. The devices support 802.1X and have unique certificates. The administrator wants to enforce identity-based access at the switch port and reject any device without valid credentials. Which technology should be implemented?

Accepted Answer

802.1X port-based network access control. 802.1X is designed for port-based network access control, requiring devices to authenticate before gaining access. With certificate-based EAP methods, it verifies device identity and can reject unauthorized devices. MAC filtering, PVLANs, and DAI do not provide authentication and cannot enforce the hospital's requirement for authorized medical devices only.

Answer

MAC address filtering on the switch

Answer

Private VLAN (PVLAN) isolation

Answer

Dynamic ARP Inspection (DAI)

Question 3

A security team must ensure that objects in an Amazon S3 bucket cannot be made public, even if an administrator later attaches a permissive bucket policy. Which S3 setting should the team enable?

Accepted Answer

S3 Block Public Access at the account level with block public policies and block public access granted through new ACLs enabled. Account-level S3 Block Public Access settings override bucket policies and ACLs that would grant public access, acting as a guardrail even against permissive changes made later. Versioning, Object Lock, and server access logging address durability, immutability, and auditing respectively, but none of them restrict public access grants.

Answer

S3 server access logging to a separate logging bucket

Answer

S3 Object Lock in compliance mode with a long retention period

Answer

S3 Versioning with MFA Delete enabled on the bucket

Question 4

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

Accepted Answer

Prisma Cloud CSPM Resource Configuration Scan. Prisma Cloud CSPM (Cloud Security Posture Management) continuously scans cloud resource configurations — including S3 bucket policies, ACLs, and public access settings — against security benchmarks such as CIS, PCI-DSS, and HIPAA. Its Resource Configuration Scan detects misconfigurations like public S3 buckets and surfaces them as alerts or compliance violations.

Answer

WildFire cloud-based analysis service

Answer

Prisma Cloud Compute Defender

Answer

VM-Series firewall URL filtering profile

Question 5

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

Accepted Answer

Physical host hardware and virtualization hypervisor. In an IaaS model, the cloud provider manages the physical data center, physical hardware, networking infrastructure, and virtualization hypervisor.

Answer

Application runtime libraries and code

Answer

Identity and Access Management (IAM) role assignments

Answer

Guest operating system security patches

Question 6

Which TWO types of files or threats are typically inspected and analyzed by the WildFire cloud service when integrated with Cortex XDR? (Choose two)

Accepted Answer

Suspicious Microsoft Office documents containing embedded macros or scripts.. WildFire is Palo Alto Networks' cloud-based malware analysis and threat prevention service, and when integrated with Cortex XDR it automatically submits suspicious files for detonation and behavioral analysis. Option C is correct because malicious Microsoft Office documents with embedded macros or scripts (e.g., VBA, PowerShell, or OLE objects) are a primary WildFire target, since these files are commonly used in phishing and must be analyzed for malicious macro behavior. Option D is correct because unknown or zero-day executable binaries and PE files are the core artifacts WildFire detonates in its sandboxed VMs to observe process, registry, file system, and network activity and generate verdicts and signatures. Option A does not belong because benign PNG wallpaper images are static image files with no executable or macro content and are not typical WildFire inspection targets. Option B does not belong because ordinary MP3 audio recordings are non-executable media files that do not warrant cloud sandbox analysis. Option E does not belong because plain text files contain no executable code or scriptable content and are not analyzed by WildFire.

Answer

Default operating system desktop background wallpaper images in PNG format.

Answer

Uncompressed family vacation audio MP3 recordings.

Answer

Standard plain text grocery shopping lists without executable content.

Question 7

A security analyst is reviewing a suspicious PowerShell script that was executed on a user's workstation. The script attempted to download a file from a remote server and execute it in memory. Which TWO Windows event log sources would provide the MOST relevant information to investigate this activity? (Choose two.)

Accepted Answer

Microsoft-Windows-Sysmon/Operational log. The PowerShell Operational log and Sysmon Operational log are the most relevant sources. The PowerShell Operational log captures script block logging and execution details, while Sysmon provides process creation with command lines and network connection events. Together, they allow the analyst to reconstruct the script's behavior, including the download attempt and in-memory execution, which are critical for incident response.

Answer

Microsoft-Windows-Windows Defender/Operational log

Answer

Security log

Answer

Microsoft-Windows-TaskScheduler/Operational log

Question 8

A security team is reviewing network traffic captures and wants to determine which internal workstation initiated a connection to an external web server. The capture contains only the packet headers of the conversation. Which pair of attributes in the packet header identifies the source of the connection?

Accepted Answer

The source IP address and source port. In packet headers, the source IP address and source port together identify the originating host and application socket. The destination fields point to the external web server, while framing and TTL fields describe delivery mechanics. An analyst looking for the internal workstation that initiated the connection should inspect the source address and source port of the first packet in the session.

Answer

The Ethernet frame preamble and the frame check sequence

Answer

The IP header time-to-live value and the protocol number

Answer

The destination IP address and destination port

Question 9

A security administrator is configuring a Cortex XDR agent policy to protect against exploit techniques such as memory corruption and return-oriented programming (ROP). Which two protection modules should be enabled to mitigate these threats? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention and Kernel Exploit Protection are designed to block exploitation techniques like memory corruption and ROP. Exploit Prevention covers user-mode applications, while Kernel Exploit Protection addresses kernel-level attacks. Together they provide comprehensive mitigation against the described threats.

Answer

Malware Prevention

Answer

Behavioral Threat Protection

Answer

Host Firewall

Question 10

An organization is designing segmentation for a data center. The security architect wants east-west traffic between application tiers to be inspected and policy-controlled without forcing all traffic through a single physical appliance that could become a bottleneck. The design should also allow security policy to follow workloads as they move between hypervisors. Which approach best meets these goals?

Accepted Answer

Implementing microsegmentation with distributed policy enforcement at the hypervisor or host level. Microsegmentation with distributed enforcement places security policy at the workload or hypervisor level, so east-west traffic between application tiers is inspected and controlled without funneling through a central appliance. Because policy is bound to the workload rather than a physical location, it travels with virtual machines across hypervisors, meeting both requirements.

Answer

Relying on VLANs alone to separate application tiers on the same physical switches

Answer

Deploying a large perimeter firewall and routing all east-west traffic through it in a hub-and-spoke topology

Answer

Using network address translation to hide application tier addresses from each other

Question 11

A security engineer is deploying a Palo Alto Networks firewall in a network that uses NAT. The engineer needs to ensure that the firewall can identify applications that use dynamic ports, such as FTP, and apply the correct security policy. Which feature should the engineer configure to achieve this?

Accepted Answer

App-ID with protocol decoders. App-ID with protocol decoders allows the firewall to inspect control channels and dynamically open ports for data connections, correctly identifying applications like FTP. This is the native method on Palo Alto Networks firewalls, replacing traditional ALGs. Other options do not provide this capability.

Answer

Application Override policy

Answer

ALG (Application Layer Gateway) for FTP

Answer

NAT policy with dynamic IP and port

Question 12

Which THREE actions occur when an endpoint is placed into 'Isolation' mode using Cortex XDR? (Choose three)

Accepted Answer

Configured isolation exceptions can allow specific forensic servers to communicate with the host.. Option A is correct because Cortex XDR isolation supports isolation exceptions that whitelist specific destinations (such as forensic or remediation servers) so they can still reach the isolated host. Option C is correct because the agent must maintain its connection to the Cortex XDR management backend, which is permitted through predefined exceptions so the console can still manage and release the endpoint. Option D is correct because isolation works by blocking all network traffic except the defined exceptions, effectively dropping all non-exempt inbound and outbound communication. Option B is wrong because isolation is a network containment action, not a disk-wiping or zeroing operation. Option E is wrong because isolation never cuts physical power; the endpoint remains powered on and running so the agent can enforce the isolation policy.

Answer

The endpoint hard drive is securely wiped and zeroed out.

Answer

The endpoint physical hardware power supply is automatically cut off.

Question 13

A security team is deploying an intrusion prevention system (IPS) inline between an internal segment and the internet gateway. During testing, legitimate business traffic is being dropped because the IPS is matching benign patterns. The team wants to reduce false positives while keeping meaningful detection. Which TWO tuning actions are appropriate? (Choose two.)

Accepted Answer

Adjust the confidence or severity threshold so only higher-confidence signatures trigger blocking. False positives in an inline IPS are best reduced by tuning signature confidence or severity thresholds so only reliable signatures block, and by adding narrow exceptions or allowlists for specific trusted flows that keep matching. Both actions preserve meaningful detection while stopping benign business traffic from being dropped.

Answer

Increase the sensor's inspection throughput by disabling logging

Answer

Switch the sensor from inline mode to promiscuous tap mode

Answer

Disable all signatures in the affected category to eliminate the matches

Question 14

An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Continuous cloud resource configuration auditing against security benchmarks. Option C is correct because Prisma Cloud CSPM's core purpose is continuous configuration assessment: it ingests cloud resource configurations and evaluates them against built-in and custom security benchmarks and compliance standards (e.g., CIS, PCI DSS, HIPAA, NIST) to detect misconfigurations and drift. Option D is correct because CSPM begins with agentless, API-based discovery and inventory of assets across multi-cloud environments (AWS, Azure, GCP, OCI, Alibaba Cloud), giving visibility into resources such as compute instances, storage buckets, and IAM policies. Option A is not a CSPM function; runtime memory dumping and kernel rootkit prevention belong to workload/container runtime protection (e.g., Prisma Cloud Compute/Defender), not posture management. Option B is not a CSPM function; line-rate Layer 7 TLS decryption is performed by next-generation firewalls or similar inspection platforms, not by a posture management service. Option E is not a CSPM function; secure web gateway DNS tunneling prevention is a network security/SASE capability, unrelated to cloud configuration auditing or asset inventory.

Answer

Active runtime container memory dumping and kernel rootkit prevention

Answer

Line-rate Layer 7 decryption of TLS encrypted inbound web traffic

Answer

Remote user secure web gateway DNS tunneling prevention

Question 15

A system administrator at a small company receives an alert that an internal workstation is making repeated connection attempts to an external IP address on TCP port 445. The administrator wants to quickly identify which internal host is generating this traffic and verify whether the firewall is blocking it. Which action should the administrator take first?

Accepted Answer

Review the firewall's traffic logs filtered by destination port 445 and source zone.. Traffic logs are the primary source for identifying which internal host is communicating with an external IP on a specific port. They include source and destination details along with the firewall's action, allowing the administrator to quickly pinpoint the workstation and verify blocking. Other log types do not contain session-level data.

Answer

Run a packet capture on the firewall's management interface to inspect the traffic.

Answer

Check the firewall's system logs for configuration changes related to port 445.

Answer

Disable the security policy rule that allows SMB traffic and wait for user complaints.