Cybersecurity-Apprentice Practice Test 2 — 10 Questions

Question 1

An organization wants to ensure that sensitive data stored on employee laptops remains confidential even if a laptop is lost or stolen. The data must be unreadable without the correct credentials. Which security control should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Full-disk encryption. Full-disk encryption ensures that data at rest is encrypted and cannot be read without the proper key. This directly protects confidentiality if a laptop is lost or stolen. The other options are detective or preventive controls for other purposes but do not encrypt data on the device.

Answer

File integrity monitoring

Answer

Security information and event management (SIEM)

Answer

Data loss prevention (DLP)

Question 2

A SOC analyst notices that several endpoint alerts share the same file hash and were triggered on different hosts within a short period. Before escalating, the analyst wants to confirm whether this hash is known malware and gather context about its behavior. Which resource should the analyst consult first for this enrichment?

Accepted Answer

A threat intelligence platform or malware analysis service that maps the hash to known campaigns and behaviors. File hashes are ideal pivot points for enrichment because they are stable identifiers. A threat intelligence or malware analysis service maps a hash to known families, campaigns, and behaviors, which lets the analyst assess severity and escalate with context. Quarantine folders, change tickets, and network traffic dashboards serve other purposes and do not directly answer whether the hash is a known threat.

Answer

The firewall's application command center for outbound session volume trends

Answer

The organization's change management ticketing system for recent software deployments

Answer

The endpoint agent's local quarantine folder on each affected host

Question 3

An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?

Accepted Answer

Create a profile exception using the specific file hash or behavioral signature parameters identified in the alert.. The correct best practice is to create a profile exception scoped to the specific file hash or behavioral signature identified in the alert. This suppresses the false positive without weakening protection for other files or behaviors. Cortex XDR supports exceptions at the profile level (e.g., Malware, Exploit, Restriction profiles) so the legitimate admin tool is allowlisted only where needed. This preserves detection fidelity while eliminating recurring noise.

Answer

Uninstall the Cortex XDR agent from all endpoints in that department.

Answer

Delete the alert from the incident queue without taking action.

Answer

Set the entire Cortex XDR agent fleet to Audit mode permanently.

Question 4

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures between the Cortex XDR agent and the management server almost always point to a trust or interception issue. If a proxy or firewall performs TLS inspection (decryption) and the Cortex XDR root certificate is not installed in the agent's trust store, the agent rejects the proxy's re-signed certificate and the handshake fails, which matches the observed symptoms.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 5

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust rejects the idea of a trusted internal network, so Option B is correct because inspecting and logging all traffic on every port and protocol with App-ID and Threat Prevention ensures no flow is blindly trusted and that application-layer visibility and threat detection apply universally. Option C is correct because Zero Trust requires micro-segmentation, and using zones and virtual routers on Palo Alto firewalls creates granular micro-perimeters that contain lateral movement between workloads. Option E is correct because Zero Trust enforces least-privilege access decisions based on user identity, application, and content rather than IP address or network location, which is exactly what Palo Alto's User-ID and App-ID enable. Option A is wrong because implicitly trusting internal-zone traffic is the traditional castle-and-moat assumption that Zero Trust explicitly eliminates. Option D is wrong because relying only on perimeter firewalls and leaving internal lateral traffic uninspected contradicts Zero Trust's requirement to inspect east-west traffic and assume breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 6

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

Accepted Answer

The Incidents tab in the Cortex XDR management console.. The Incidents tab in the Cortex XDR management console is where correlated alerts are grouped into incidents, enriched with causality chains, and mapped to MITRE ATT&CK techniques — including Command and Control (TA0011) tactics such as T1071 Application Layer Protocol and T1571 Non-Standard Port. Analysts use this view to see which endpoints are communicating with known C2 infrastructure and to pivot into the causal chain for investigation.

Answer

The Dashboards tab under System Settings on the firewall.

Answer

The User-ID Agent status page.

Answer

The ACC (Application Command Center) threat map on Panorama.

Question 7

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

Accepted Answer

An Interface Management Profile assigned to the interface. To allow a Palo Alto Networks firewall interface to respond to ICMP echo requests (ping) for diagnostics, an Interface Management Profile must be created and assigned to that interface. The profile explicitly enables management services like Ping, Telnet, SSH, HTTP, HTTPS, and SNMP on the interface.

Answer

A Security Policy rule with an application of 'ping'

Answer

A Zone Protection Profile applied to the egress zone

Answer

The Device > Setup > Management tab

Question 8

A new cybersecurity apprentice is asked to classify the following event: an employee receives an email that appears to come from the IT department, asking them to click a link and reset their password immediately or their account will be disabled. The link leads to a fake login page that captures credentials. Which type of attack best describes this scenario?

Accepted Answer

Phishing. The scenario describes a deceptive email that impersonates IT and pressures the user to enter credentials on a fake page. This is a phishing attack, which relies on social engineering rather than technical exploitation. The other choices describe different attack categories that do not match the observed behavior.

Answer

Man-in-the-middle (MITM)

Answer

SQL injection

Answer

Denial-of-service (DoS)

Question 9

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire Portal provides a public and private cloud analysis search interface where analysts can manually submit or look up a file hash (MD5, SHA-1, or SHA-256) to see whether WildFire has previously analyzed it and what verdict was returned. This is the standard manual hash lookup method in the Palo Alto Networks ecosystem. It is distinct from automated WildFire forwarding configured on firewalls.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 10

A security engineer is hardening an Amazon EC2 instance that hosts a public-facing web application. The engineer wants to reduce the attack surface at the network and host layers. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Attach a security group that allows inbound traffic only on ports 80 and 443 from the internet, and restrict all other inbound ports.. Hardening an EC2 instance requires both network-level and host-level reductions in exposure. A restrictive security group limits which inbound ports are reachable from the internet, while removing unnecessary services and packages eliminates host-level entry points. Monitoring and backup actions, such as CloudTrail, AMIs, and CloudWatch, support detection and recovery but do not shrink the attack surface.

Answer

Create an Amazon Machine Image (AMI) backup of the instance before making changes.

Answer

Enable AWS CloudTrail to record all API calls made in the account.

Answer

Enable detailed monitoring in Amazon CloudWatch for the instance.