Cybersecurity-Apprentice Practice Exam 2 — 20 Questions

Question 1

A SOC analyst is investigating a malware alert on an endpoint. The analyst wants to understand the behavior of the malware to determine its capabilities. The analyst has a malware sample and needs to analyze it in a safe environment. Which action should the analyst take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Submit the malware sample to a sandbox for automated analysis.. Malware analysis should always be performed in an isolated environment to prevent accidental execution and spread. A sandbox provides a safe, automated way to observe malware behavior, including its network communications and system changes. Submitting the sample to a sandbox is the correct action, as it balances safety with the need for detailed behavioral analysis.

Answer

Run the malware on a personal laptop with antivirus disabled.

Answer

Execute the malware on a production workstation to observe its behavior.

Answer

Upload the malware sample to a public file-sharing site for analysis by others.

Question 2

An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)

Accepted Answer

IP Address. Option A (IP Address) is correct because a Layer 3 interface on a Palo Alto Networks firewall must be assigned an IPv4 or IPv6 address (or be configured as DHCP client) to participate in a routed network and forward traffic between subnets. Option B (Security Zone) is correct because every Layer 3 interface must be bound to a security zone, which defines the trust level and the security policy rules that govern traffic entering and leaving that interface. Option C (DHCP Server Scope) is incorrect because a DHCP server scope is only needed if the firewall itself is acting as a DHCP server for clients, not for basic Layer 3 routed operation. Option D (MAC Address Override) is incorrect because overriding the interface MAC address is an optional feature for specific scenarios like ISP requirements or HA, not a mandatory parameter. Option E (Virtual Wire Pair Identifier) is incorrect because virtual wire pairs are used for Layer 2 transparent (tap) deployments, not for Layer 3 routed interfaces.

Answer

DHCP Server Scope

Answer

MAC Address Override

Answer

Virtual Wire Pair Identifier

Question 3

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR network isolation blocks all traffic except management communication by default. To allow a specific forensic server to reach an isolated endpoint, the responder configures IP-based isolation exceptions in the Cortex XDR profile (or via the isolation policy), whitelisting the forensic server's IP so its traffic is permitted while all other traffic remains blocked. This preserves containment while enabling evidence collection.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 4

A Cortex XDR administrator is configuring endpoint protection for a group of Windows servers that run a custom Java application. The application uses a Just-In-Time (JIT) compiler that frequently generates dynamic code, and the administrator observes that Exploit Protection is blocking the application's normal execution. What is the most appropriate action to resolve this while maintaining security?

Accepted Answer

Create an exception for the Java application's executable in the Exploit Protection module.. A targeted exception for the Java application's executable in Exploit Protection is the correct balance, allowing the legitimate JIT compiler to function while preserving exploit prevention for other processes. Global disable or module changes are too broad and do not address the specific compatibility issue. Upgrading the agent alone may not resolve the JIT-generated code detection. Scoped exceptions are the standard remediation for legitimate applications that trigger exploit prevention.

Answer

Move the servers to a different endpoint group with Behavioral Threat Protection disabled.

Answer

Upgrade the Cortex XDR agent to the latest version.

Answer

Disable Exploit Protection globally for all endpoints in the organization.

Question 5

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)

Accepted Answer

Enable the Prisma Cloud Config assessment feature for each cloud account.. To detect publicly accessible storage buckets, Prisma Cloud must have read-only access to storage services and the Config assessment feature must be enabled. These two actions allow Prisma Cloud to query bucket configurations and evaluate them against security policies. Compute agents, audit logs, and webhooks do not provide the necessary configuration data.

Answer

Deploy Prisma Cloud Compute agents on all virtual machines.

Answer

Configure CloudTrail, Azure Activity Log, and GCP Audit Logs to send logs to Prisma Cloud.

Answer

Set up a Prisma Cloud webhook to receive alerts from cloud providers.

Question 6

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

Accepted Answer

The two hosts are on different IP subnets and require a router or Layer 3 device to communicate. IP communication depends on subnet boundaries, not physical topology. Hosts on 172.16.5.0/24 and 172.16.6.0/24 are on separate logical networks even when cabled to the same switch. A host forwards off-subnet traffic to its default gateway, so without a router or Layer 3 switch providing inter-subnet routing, the two hosts cannot exchange packets. Confirming subnet membership and the presence of a Layer 3 path is essential before blaming switching or ACLs.

Answer

The switch is blocking traffic because the MAC address table has not learned the server's MAC address

Answer

The server's /24 mask is too large and causes it to treat the workstation as local

Answer

The workstation is using the wrong default gateway, which prevents ARP from resolving the server

Question 7

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

Accepted Answer

An incorrect peer AS number or incorrect peer IP address configuration. BGP peers stuck in the Idle state means the router has not even begun the TCP connection or has repeatedly failed to establish one, which most commonly results from a misconfigured peer IP address or peer AS number. If the peer address is wrong, the TCP session to port 179 never forms; if the peer AS number is wrong, the OPEN message is rejected and the session tears down back to Idle. Both are fundamental peer configuration errors that prevent the BGP finite state machine from progressing.

Answer

An AS-path loop detection trigger

Answer

MD5 authentication password mismatch during OPEN message exchange

Answer

BGP route reflection timer expiration

Question 8

A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?

Accepted Answer

The technique is code injection, and the agent blocked the write operation and may have terminated the injecting process.. Writing to another process's memory is a hallmark of code injection, often used by malware to execute code in the context of a trusted process. Behavioral Threat Protection detects this activity and can block the write operation, preventing the injection. Depending on the configured policy, the agent may also terminate the injecting process. The other options misidentify the technique or the agent's response.

Answer

The technique is privilege escalation, and the agent escalated the alert to the cloud for analysis.

Answer

The technique is DLL side-loading, and the agent quarantined the DLL file.

Answer

The technique is process hollowing, and the agent terminated the target process.

Question 9

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

Accepted Answer

172.16.10.32 and 172.16.10.63. With a subnet mask of 255.255.255.224 (/27), the subnet increment is 32. The address 172.16.10.33 falls within the subnet starting at 172.16.10.32. Therefore, the network address is 172.16.10.32 and the broadcast address is 172.16.10.63. The correct answer is 172.16.10.32 and 172.16.10.63.

Answer

172.16.10.0 and 172.16.10.31

Answer

172.16.10.0 and 172.16.10.63

Answer

172.16.10.33 and 172.16.10.62

Question 10

A new security analyst at a retail company receives a help desk ticket stating that an employee clicked a link in an email and a browser window opened asking for their corporate username and password. The page looks identical to the company's single sign-on portal, but the URL is misspelled. The analyst must classify this event. Which category BEST describes this activity?

Accepted Answer

Phishing. The deceptive email link and counterfeit single sign-on page are designed to capture the employee's credentials, which is the defining behavior of phishing. The other categories describe availability attacks, post-compromise escalation, or database manipulation, none of which match the evidence. Correct classification drives the proper response: reset the user's credentials, block the URL, and reinforce awareness training.

Answer

Denial of service

Answer

SQL injection

Answer

Privilege escalation

Question 11

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. DNS-based C2 is detected and blocked by the Anti-Spyware profile, which includes DNS sinkhole functionality. When a DNS query matches a known malicious domain in the Palo Alto DNS signature database, the firewall can sinkhole the response (returning a bogus IP) to prevent the internal host from reaching the C2 server. Attaching the Anti-Spyware profile to the security rule enables this automatic blocking.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 12

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

Accepted Answer

Apply policy tags to group related policies and use those tags in alert rules to control which findings are surfaced to each business unit.. Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Answer

Disable all policies that have not generated an alert in the last 30 days to reduce the number of active policies.

Answer

Increase the scan frequency of the cloud accounts to every five minutes so that duplicate alerts are generated for each scan cycle.

Answer

Enable auto-remediation for every high-severity policy so that all findings are fixed without human review.

Question 13

A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?

Accepted Answer

Private IP addresses. The 192.168.1.0/24 range falls within the RFC 1918 private address space, specifically 192.168.0.0/16. Private addresses are not routable on the public Internet and require network address translation to communicate externally. Public addresses are globally routable, multicast addresses serve groups, and loopback addresses refer to the local host, so only the private designation fits the administrator's observation.

Answer

Public IP addresses

Answer

Multicast addresses

Answer

Loopback addresses

Question 14

A junior security analyst is reviewing Prisma Cloud alerts for an Amazon S3 bucket that was made publicly accessible. The analyst needs to quickly understand the potential impact and prioritize remediation. Which Prisma Cloud capability should the analyst use first?

Accepted Answer

The alert's resource configuration details and the associated compliance standard violations.. Prisma Cloud alerts include the offending resource's configuration and the compliance standards it violates, which directly answer what is wrong and why it matters. This built-in context lets an analyst triage a public S3 bucket quickly, determine business impact, and decide on remediation steps without switching to external tools.

Answer

The Prisma Cloud Compute radar view to inspect the bucket's container image layers.

Answer

The AWS Cost Explorer to determine whether the bucket is incurring unexpected charges.

Answer

The AWS Trusted Advisor console to view the S3 bucket permissions check.

Question 15

A small company runs its customer web portal on a single Amazon EC2 instance. The security lead must decide who is responsible for patching the guest operating system, according to the AWS shared responsibility model. Who is responsible?

Accepted Answer

The customer, because the customer controls the guest operating system, applications, and data on the instance.. Under the AWS shared responsibility model, AWS is responsible for security of the cloud (physical hosts, hypervisor, network), while the customer is responsible for security in the cloud. For a customer-managed EC2 instance, the guest operating system, applications, and data fall to the customer. Patching the guest OS is therefore the customer's obligation, not AWS's, a partner's, or a 50/50 split.

Answer

The AWS Support team, because the instance was launched from an AWS-provided Amazon Machine Image.

Answer

AWS, because EC2 is an Infrastructure as a Service offering and AWS manages the hypervisor and guest OS.

Answer

A shared 50/50 split, with AWS patching the kernel and the customer patching user-space applications.

Question 16

A Tier-1 SOC analyst is preparing to escalate a confirmed malware infection on a finance workstation to the Tier-2 team. Which TWO pieces of information are most essential to include in the escalation ticket to enable effective response? (Choose two.)

Accepted Answer

The affected host's name, IP address, and the user account currently logged in. A useful escalation must identify the affected asset and user, and it must convey the technical detection evidence so the responder can validate and scope the incident quickly. Host identifiers enable correlation and containment, while process tree, hashes, and C2 indicators provide the investigative starting point. Bulk data, environment inventories, and personal preferences do not advance response.

Answer

The full raw packet capture of all traffic from the workstation for the past 24 hours

Answer

A list of every security tool deployed across the entire organization and their version numbers

Answer

The analyst's personal opinion about which team member should handle the case

Question 17

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. Option B (Hello and Dead timer intervals) is correct because OSPF neighbors must agree on the Hello interval and Dead interval on the interface; mismatched timers prevent Hello packets from being accepted and the adjacency never reaches 2-Way/Full. Option D (Authentication type and password) is correct because if authentication is configured, both routers must use the same authentication type (e.g., MD5 or SHA) and matching key/password, otherwise OSPF packets fail authentication and are discarded. Option E (Area ID) is correct because two OSPF routers can only form an adjacency if their interfaces belong to the same OSPF area, since the Area ID is carried in the Hello packet and must match. Option A (Process ID) is not required to match because the OSPF process ID is locally significant to the router and is not carried in Hello packets. Option C (Router ID) is not required to match because each OSPF router must have a unique Router ID within the OSPF domain; duplicate Router IDs actually cause adjacency problems rather than being a requirement.

Answer

Process ID

Answer

Router ID

Question 18

A security administrator is configuring Cortex XDR agent settings for a group of Linux servers. The administrator wants to ensure that the agent does not interfere with a custom application that performs legitimate but unusual system calls, which are currently being flagged as malicious by the agent's behavioral threat protection. What should the administrator do to prevent the agent from blocking this application while maintaining security?

Accepted Answer

Create a Behavioral Threat Protection exception for the application's process name and hash.. Creating a Behavioral Threat Protection exception for the application's process name and hash is the correct approach. It allows the legitimate application to run without interference while keeping behavioral threat protection active for other processes. This balances security and functionality.

Answer

Add the application to the allow list in the Exploit Protection module.

Answer

Configure the agent to run in 'Report Only' mode for Behavioral Threat Protection.

Answer

Disable Behavioral Threat Protection entirely on the Linux servers.

Question 19

A small company is moving its first workload to Microsoft Azure and wants to use Prisma Cloud to monitor the environment. The administrator needs to grant Prisma Cloud read access to the Azure subscription so that it can collect resource configuration and evaluate policies. Which action should the administrator take?

Accepted Answer

Create an Azure service principal with a Reader role assignment on the subscription and provide its credentials to Prisma Cloud.. Onboarding an Azure subscription into Prisma Cloud requires an identity that can read resource configuration across the subscription. A service principal assigned the Reader role at the subscription scope provides exactly that read-only access through Azure Resource Manager, allowing Prisma Cloud to collect configuration and evaluate policies without granting permissions to change resources.

Answer

Generate a shared access signature token for the storage account and enter it into the Prisma Cloud console.

Answer

Assign the Global Administrator directory role to a user account and use that account for the Prisma Cloud integration.

Answer

Install the Prisma Cloud Compute Defender agent on every virtual machine in the subscription.

Question 20

A security analyst is reviewing a web server log and sees the following entry: `GET /products.php?id=1' OR '1'='1`. The analyst suspects an injection attack. Which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The payload `' OR '1'='1` is a textbook SQL injection attempt. It aims to alter the logic of a database query by injecting a tautology. The other attack types would involve different payloads and mechanisms, such as script tags for XSS, shell commands for command injection, or forged requests for CSRF.

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Answer

Command injection