Cybersecurity-Apprentice Practice Exam 2 — 20 Questions

Question 1

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

App-ID. App-ID uses multiple classification mechanisms, including signature matching, heuristics, and SSL decryption analysis, to identify applications regardless of port.

Answer

Data-ID

Answer

Device-ID

Answer

User-ID

Question 2

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

Accepted Answer

show counter global filter packet-drop yes. The command 'show counter global filter packet-drop yes' allows administrators to view global packet drop counters in real time, which is essential for troubleshooting traffic drops on the firewall.

Answer

show system resources

Answer

show session all

Answer

show interface all

Question 3

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust principles include continuous verification, least privilege access, inspecting and logging all traffic, and assuming breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 4

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Accepted Answer

A DoS Protection Profile configured with random early drop or classified rate limiting.. Zone Protection profiles or DoS Protection profiles protect against volumetric attacks and flood conditions originating from single or multiple IP sources.

Answer

A custom URL Filtering profile blocking the login page URL category.

Answer

An Antivirus Profile with signature auto-update enabled every minute.

Answer

A Data Filtering Profile configured to scan for weak passwords.

Question 5

An administrator is configuring a File Blocking profile to prevent users from downloading potentially dangerous file types. However, users legitimately need to download password-protected archive files (such as .zip files encrypted with passwords) for business operations. How should the administrator configure the profile to handle encrypted archives safely?

Accepted Answer

Configure the File Blocking profile to detect and block 'encrypted-zip' and 'encrypted-rar' file types.. File Blocking profiles can be configured to detect and block or alert on encrypted archives (like password-protected .zip files) because attackers often use them to bypass payload inspection.

Answer

Enable WildFire inline machine learning to guess user archive passwords.

Answer

Set the URL Filtering profile action to bypass inspection for all archive file extensions.

Answer

Attach an Antivirus profile set to automatically decrypt password-protected ZIP files using a dictionary attack.

Question 6

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. APT and zero-day protection relies on WildFire cloud sandbox analysis, DNS Security for malicious domain detection, and inline machine learning.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 7

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

Accepted Answer

To centralize log collection, event correlation, and security incident monitoring across disparate enterprise systems.. SIEM systems aggregate, correlate, and analyze log data from multiple sources across the enterprise to detect security incidents and provide audit trails.

Answer

To analyze unknown executable files in an isolated sandbox environment.

Answer

To automatically patch operating system vulnerabilities on endpoints.

Answer

To enforce inline packet inspection and drop malicious TCP packets.

Question 8

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. Vulnerability Protection profiles inspect traffic for known exploit signatures, including vulnerability scans and exploit attempts targeting servers.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 9

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data exfiltration is prevented using Data Filtering profiles, File Blocking profiles, and SSL Decryption to inspect encrypted egress traffic.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 10

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). A static route requires a destination subnet, a next-hop specification (IP address or interface), and a route name/destination identifier.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID

Question 11

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object (or Address Group) allows administrators to group IP addresses, subnets, or ranges under a single label for policy rules.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 12

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

Accepted Answer

An Authentication Profile combined with an Admin Role Profile mapping the AD group.. Integrating PAN-OS with LDAP/RADIUS or SAML using an Authentication Profile linked to an Admin Role Profile maps Active Directory groups to firewall management roles.

Answer

A custom decryption rule enforcing SAML client authentication.

Answer

A standard Security policy rule with an explicit user match condition.

Answer

A GlobalProtect Portal agent configuration.

Question 13

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Securing the management plane involves restricting administrative access via Management Profile source IP whitelisting and ensuring strong administrative authentication settings.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 14

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Quarantined items can be managed and reviewed directly from the Cortex XDR management console under Incident Response or Endpoint views.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 15

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

Accepted Answer

In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.. Cortex XDR allows administrators to create profile exceptions based on hash or behavioral exception rules for specific trusted scripts.

Answer

Change the Agent settings to bypass all SSL decryption rules.

Answer

Disable the Local Analysis module entirely for the target endpoint group.

Answer

Modify the Windows Firewall inbound rules on the local endpoint.

Question 16

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles are configured under Device > Server Profiles > Syslog in the PAN-OS management interface.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 17

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Tier-1 analysts focus on initial alert triage, alert verification, running basic playbooks, and escalating verified threats to Tier-2.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 18

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

Accepted Answer

Check that the connection status shows Connected with a recent heartbeat timestamp.. The connection status in Endpoint Management indicates whether the agent has an active, healthy TLS session with the backend server.

Answer

Ensure the endpoint operating system is running the latest patch level.

Answer

Confirm that the kernel module version matches the BIOS version.

Answer

Verify that the local disk usage is below 10 percent.

Question 19

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

Accepted Answer

Objects > Applications > [Application Name], modifying TCP timeout settings. Application timeouts can be customized under Objects > Applications by creating or editing an application override, or by modifying timeout settings in Device > Setup > Session.

Answer

Network > Interfaces > Advanced > TCP Timeout

Answer

Policies > Security > Timeout Profile

Answer

Device > Setup > Management > Session Settings

Question 20

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agents require specific Windows OS patches (such as Universal C Runtime updates) and proper MSI execution privileges.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.