Cybersecurity-Apprentice Practice Test 20 — 15 Questions

Question 1

A help desk technician receives a ticket from a user whose Windows laptop is running the Cortex XDR agent. The user reports that a business-critical line-of-business application now fails to launch, and the agent tray icon shows a red status. Before escalating, the technician wants to capture the reason the agent interfered with the application. Which Cortex XDR action should the technician perform first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the endpoint's action center and agent logs in the Cortex XDR console to identify the blocking module and event. When an application is blocked, the fastest reliable path is to read the recorded detection. The action center and agent logs in the Cortex XDR console show which protection module acted, the triggering rule, and the process details. With that evidence the administrator can apply a narrowly scoped exclusion or adjust the policy, rather than disabling protection or reinstalling the agent and losing the diagnostic trail.

Answer

Uninstall and reinstall the Cortex XDR agent to clear the red status

Answer

Stop the Cortex XDR agent service on the endpoint and instruct the user to relaunch the application

Answer

Add the application folder to the malware exclusion list immediately and ask the user to retry

Question 2

A small business owner wants to protect customer payment data. The owner asks a security consultant which control best reduces the impact if an attacker compromises a web server that stores payment records. The consultant recommends encrypting the payment records at rest with keys managed separately from the server. Which security principle does this recommendation primarily support?

Accepted Answer

Data confidentiality through cryptographic protection. Encrypting payment records at rest with keys stored separately protects confidentiality even if the web server is compromised. An attacker who exfiltrates the database or files obtains ciphertext that is useless without the key. Keeping key management separate prevents the attacker from retrieving the key from the same compromised host, which directly reduces the impact of the breach.

Answer

Non-repudiation

Answer

Least privilege

Answer

Defense in depth

Question 3

A Cortex XDR administrator is investigating a Windows endpoint where the agent reported an exploit attempt against a document reader process. The exploit was blocked, but the administrator wants to understand the exact memory manipulation technique used before the block. Which Cortex XDR capability should the administrator use to examine the sequence of events and process behavior captured around the exploit?

Accepted Answer

The Causality Analysis engine's alert details, which correlate the exploit attempt with the process tree and preceding activity.. Causality Analysis assembles endpoint events into a causal chain, so the alert details reveal the process tree, the document reader's actions, and the memory manipulation steps preceding the block. WildFire verdicts, device control logs, and inventory reports lack runtime behavioral context and cannot describe the technique used on the endpoint.

Answer

The Endpoint Management inventory report, which lists installed applications and their versions.

Answer

The WildFire verdict page for the document, which shows the static file properties and signature names.

Answer

The Device Control module logs, which record USB and peripheral access events on the endpoint.

Question 4

A company is implementing a data loss prevention (DLP) strategy. The security team wants to prevent employees from emailing files that contain credit card numbers to external recipients. Which DLP component is primarily responsible for identifying the sensitive data within the email content?

Accepted Answer

Content inspection engine. The content inspection engine is responsible for scanning and recognizing sensitive data patterns such as credit card numbers. It uses techniques like regular expressions and checksum validation to identify potential matches. The policy engine then uses that classification to enforce rules. Endpoint agents and consoles serve different roles in the DLP architecture.

Answer

Policy engine

Answer

Endpoint agent

Answer

Management console

Question 5

A security analyst is reviewing a packet capture of a TCP session between an internal client and an external server. The capture shows the client sending a segment with the SYN flag set and the server responding with a segment that has both SYN and ACK set. The client then sends an ACK. What does this sequence indicate about the session?

Accepted Answer

The TCP three-way handshake completed and the connection is established. The three segments SYN, SYN+ACK, and ACK are the canonical TCP three-way handshake. The client proposes a connection with SYN, the server acknowledges and proposes its own sequence with SYN+ACK, and the client confirms with ACK. Completion of this exchange places both endpoints in the ESTABLISHED state, allowing application data to be exchanged. Recognizing this pattern helps the analyst distinguish normal session setup from resets, retransmissions, or teardown traffic.

Answer

The session is being torn down gracefully by both endpoints

Answer

The client is retransmitting a lost SYN because the server did not respond

Answer

The server is rejecting the connection and resetting the session

Question 6

An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?

Accepted Answer

Classification and protection of data stored within the cloud storage buckets. Regardless of IaaS, PaaS, or SaaS, the customer always retains responsibility for classifying and protecting their own data — including data in cloud storage buckets. Providers secure the infrastructure and platform, but data ownership, classification, encryption choices, and access governance remain with the customer. This is the constant across all service models.

Answer

Physical security of the underlying data center facilities

Answer

Configuration of host-level firewalls in a managed PaaS database

Answer

Hypervisor patching and firmware updates in AWS EC2 instances

Question 7

A junior administrator is asked to identify the default administrative distance values used by a Palo Alto Networks firewall for routes learned from different sources. Which statement correctly identifies the default administrative distance for OSPF internal routes?

Accepted Answer

30. PAN-OS uses a default administrative distance of 30 for OSPF internal routes, which is lower than values for RIP or eBGP but higher than static or connected routes. This preference order ensures that more trusted or directly configured paths win when multiple sources advertise the same prefix, which is critical for predictable routing behavior on the firewall.

Answer

120

Answer

10

Answer

110

Question 8

A SOC analyst is triaging a phishing alert that includes an email attachment. The analyst needs to determine whether the attachment is malicious before escalating. Which TWO actions are appropriate first steps in this triage? (Choose two.)

Accepted Answer

Analyze the attachment in a sandboxed environment to observe its behavior. Reputation lookup and sandbox analysis are safe, fast, and evidence-based first steps. They determine maliciousness without exposing production systems or destroying evidence. Opening the file on a workstation, forwarding it broadly, or deleting it prematurely are unsafe or counterproductive. These two actions support an informed escalation decision.

Answer

Delete the original email from the mail server immediately without further analysis

Answer

Forward the attachment to all users asking if they recognize the sender

Answer

Open the attachment directly on the analyst's workstation to observe its behavior

Question 9

An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?

Accepted Answer

Use the Cortex XDR upgrade feature in Endpoint Management to push the new agent version to selected endpoint groups.. The Cortex XDR management console includes an Endpoint Management section with an upgrade feature that lets administrators push a new agent version to selected endpoint groups. This is the recommended, scalable method because it handles version targeting, scheduling, and reporting across the enterprise without touching each endpoint manually.

Answer

Reinstall the operating system on all endpoints using a clean golden image.

Answer

Manually log into every individual endpoint and run the uninstall wizard.

Answer

Modify the DNS records to point agents to a secondary upgrade server.

Question 10

A security analyst notices that a Cortex XDR agent on a Windows server has blocked a legitimate administrative tool because it matched a behavioral threat signature. The analyst wants to prevent this tool from being blocked in the future without disabling Behavioral Threat Protection entirely. What should the analyst do?

Accepted Answer

Create an exception rule in the Cortex XDR console for the specific tool's file hash or path.. The analyst should create an exception rule for the legitimate tool, specifying its hash or path, within the Cortex XDR console. This whitelists the tool for Behavioral Threat Protection while keeping the module enabled. Disabling the module is overly broad, and Device Control or Exploit Prevention exceptions are irrelevant because they address different security functions.

Answer

Add the tool to the Device Control allow list.

Answer

Disable Behavioral Threat Protection on the server.

Answer

Modify the Exploit Prevention policy to exclude the tool.

Question 11

A SOC analyst is triaging a malware alert in Cortex XDR. The analyst needs to determine the scope of the infection by identifying other endpoints that communicated with the same malicious domain. Which TWO actions should the analyst take to achieve this? (Choose two.)

Accepted Answer

Use the Cortex XDR Query Builder to search for network connections to the malicious domain across all endpoints.. To determine the scope of a malware infection, the analyst needs to search across all endpoints for communication with the malicious domain. Using the Cortex XDR Query Builder or XQL allows for custom queries that filter network events by domain and time frame, identifying all affected endpoints. Other actions like reviewing a single incident timeline or endpoint inventory do not provide this cross-endpoint visibility.

Answer

Review the Cortex XDR Incident Timeline for the original alert to see related endpoints.

Answer

Use the Cortex XDR Causality Chain to view the process that initiated the connection and then pivot to other endpoints.

Answer

Check the Cortex XDR Endpoint Inventory for endpoints with similar operating system versions.

Question 12

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

Accepted Answer

SAML. Option A (SAML) is correct because PAN-OS natively supports SAML 2.0 as an authentication method for GlobalProtect, allowing the firewall to redirect users to an external Identity Provider (IdP) for credential verification and SSO. Option C (RADIUS) is correct because PAN-OS natively integrates with RADIUS servers as an authentication profile, so GlobalProtect can forward user credentials to a RADIUS server for validation. Option B is incorrect because an IPsec pre-shared key is a tunnel-level secret used for peer authentication, not a method for verifying individual GlobalProtect user credentials. Option D is incorrect because WPA3 Enterprise 802.1X is a wireless LAN authentication standard, not a PAN-OS GlobalProtect user authentication method. Option E is incorrect because SNMPv3 USM passwords are for securing SNMP management traffic, not for authenticating GlobalProtect users.

Answer

IPsec Pre-Shared Key exchange exclusively without user credentials

Answer

WPA3 Enterprise 802.1X

Answer

SNMPv3 localized USM passwords

Question 13

An administrator is assigning IPv4 addresses to devices in a lab subnet. One host must be configured so that it can always be reached at the same address by other lab systems, and it must not depend on a DHCP server being available. Which configuration approach should the administrator use?

Accepted Answer

Configure the host with a static IP address, subnet mask, and default gateway.. A static IP configuration writes the address, mask, and gateway directly into the host, so the device always uses the same address whether or not a DHCP server is running. That satisfies both requirements: predictable reachability and independence from DHCP. Reservations and automatic leases still require the DHCP server, and APIPA produces non-routable link-local addresses.

Answer

Configure the host to obtain an address automatically with a short lease time.

Answer

Reserve the address on the DHCP server using the host's MAC address.

Answer

Enable APIPA so the host self-assigns an address from 169.254.0.0/16.

Question 14

A security administrator is configuring Cortex XDR to protect a fleet of Linux servers. The administrator wants to ensure that the agent can detect and prevent exploitation of vulnerabilities in commonly targeted services such as Apache and SSH. Which Cortex XDR module should be enabled and configured to provide this protection?

Accepted Answer

Exploit Prevention. Exploit Prevention is the Cortex XDR module specifically designed to detect and block exploitation of vulnerabilities in services like Apache and SSH. It monitors for techniques such as memory corruption and command injection, and can prevent the exploit from executing. Configuring this module on Linux servers ensures protection against targeted attacks on exposed services.

Answer

Malware Prevention

Answer

Behavioral Threat Protection

Answer

Device Control

Question 15

An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?

Accepted Answer

In the Cortex XDR management console under Endpoint Management > Agent Settings.. Cortex XDR agent prevention modules (Malware, Exploit, Behavioral Threat Protection, etc.) are configured centrally in the Cortex XDR management console under Endpoint Management > Agent Settings, where administrators can view and modify the protection profiles applied to endpoint groups. This is the authoritative location because the agent receives its policy from the management backend, not from local OS settings. Checking here confirms exactly which modules are active for a given set of workstations.

Answer

In the Active Directory Domain Controller Group Policy Management Editor.

Answer

In the firewall Security Policy rulebase.

Answer

In the global DNS Server configuration utility.