Cybersecurity-Apprentice Practice Exam 3 — 20 Questions

Question 1

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID inspection in PAN-OS security policy rules identifies applications regardless of port or protocol, including tunneling apps that disguise themselves as web traffic. By matching on the actual application signature rather than port 80/443, the firewall can detect and block the hidden tunnels.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 2

A SOC analyst is triaging a phishing report submitted by an employee. The email contains a link to a credential-harvesting page that mimics the organization's webmail portal. The analyst has confirmed the URL is malicious. Which action should the analyst take to protect other users while preserving evidence?

Accepted Answer

Add the malicious URL to the web proxy blocklist, hunt for other recipients, and reset credentials for users who clicked.. A confirmed phishing URL requires immediate containment that stops further clicks and remediates users who already submitted credentials. Blocking the URL, hunting for other recipients, and resetting compromised credentials accomplishes both goals while preserving evidence. Replying to the attacker, mass-forwarding the live email, or only blocking the sender domain leaves credential compromise unaddressed and can increase exposure.

Answer

Forward the phishing email to all employees as a training example and ask them to delete it.

Answer

Block the sender's domain at the email gateway and delete all copies of the message from user mailboxes.

Answer

Reply to the phishing email warning the sender to stop and ask them to remove the malicious link.

Question 3

A SOC analyst is reviewing a firewall log where an internal host repeatedly connected to an external IP address on TCP port 4444 every 60 seconds for several hours. The connections transferred only a few bytes each time. Which characteristic most strongly suggests this is command-and-control beaconing rather than normal user traffic?

Accepted Answer

The connections occur at a highly regular interval with small, consistent payloads. Command-and-control beaconing is defined by automation: the implant contacts its controller on a schedule and exchanges just enough data to receive instructions or confirm liveness. A fixed interval such as every 60 seconds combined with consistently small transfers is far more indicative than port choice, DNS usage, or hosting provider. Those contextual details can support an investigation, but the behavioral regularity is what elevates the traffic from benign to suspicious.

Answer

The external address belongs to a cloud hosting provider rather than an ISP

Answer

The destination port is a well-known service port such as 443

Answer

The internal host resolved the external address through DNS before connecting

Question 4

A security engineer is deploying a new containerized workload in a Kubernetes cluster that is monitored by Prisma Cloud Compute. The engineer needs to ensure that the container cannot escalate privileges by gaining additional capabilities beyond those explicitly granted. Which Kubernetes security context setting should be configured to meet this requirement?

Accepted Answer

Set allowPrivilegeEscalation to false in the container's securityContext.. The allowPrivilegeEscalation setting directly controls whether a process can gain more privileges than its parent. When set to false, it blocks common escalation techniques such as setuid binaries and file capabilities. Prisma Cloud Compute can enforce this setting through its runtime policies, ensuring containers adhere to least privilege.

Answer

Set readOnlyRootFilesystem to true in the container's securityContext.

Answer

Set privileged to true in the container's securityContext.

Answer

Set runAsNonRoot to true in the container's securityContext.

Question 5

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

Accepted Answer

Exploit Protection module monitoring common application memory spaces and blocking anomalous execution flows.. The Exploit Protection module in Cortex XDR monitors common application memory spaces (e.g., browsers, Office, Java) and blocks exploitation techniques such as memory corruption, ROP chains, and shellcode execution before a file is dropped. Because fileless attacks execute directly in memory via vulnerable services, Exploit Protection is specifically designed to detect and block these anomalous execution flows at the exploitation stage.

Answer

Scheduled weekly full disk scans using YARA rules.

Answer

Antivirus signature database matching against known file hashes.

Answer

Browser extension security hardening policies.

Question 6

A security operations center (SOC) analyst receives an alert about a potential data exfiltration attempt. The analyst needs to determine which internal host is communicating with a known malicious IP address and what application is being used. Which PAN-OS feature should the analyst use to quickly correlate the traffic and identify the host and application?

Accepted Answer

Traffic logs filtered by the malicious IP address as destination.. Traffic logs in PAN-OS capture session details including source and destination IP addresses, applications, and ports. By filtering traffic logs for sessions where the destination IP matches the known malicious address, the analyst can immediately see the internal source IP and the application in use. This provides the fastest correlation without needing additional tools. Other logs like Threat or WildFire may not have the necessary session context or may not be generated if no threat signature is triggered.

Answer

User-ID logs to map the IP address to a username.

Answer

WildFire analysis reports for the internal host.

Answer

Threat logs filtered by the malicious IP address as source.

Question 7

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

Accepted Answer

Deploying WAAS as a Defender module integrated with proxy or ingress annotations / container injection. Prisma Cloud WAAS in Kubernetes is deployed as a Defender module that integrates with the ingress controller or a reverse proxy, using annotations and container injection to inspect north-south and east-west traffic. This is the documented supported deployment for containerized microservices behind an ingress. The other options describe unrelated or nonexistent integrations.

Answer

Enabling WAAS via Azure Security Center native policy extension

Answer

Installing WAAS directly onto the physical AWS Nitro security chip

Answer

Configuring AWS Shield Advanced route table scrubbing rules

Question 8

A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?

Accepted Answer

Navigate to Cortex XSIAM > Settings > Data Sources to review agent and collector ingestion health metrics.. Cortex XSIAM's Settings > Data Sources section provides ingestion health metrics for agents, collectors, and brokers, showing whether logs are being received, parsed, and whether any data is being dropped. This is the correct place to verify log collector health and parsing status. It gives visibility into throughput, errors, and source status across all integrated data sources.

Answer

Open the Threat Intelligence management page and verify API token validity.

Answer

Review the GlobalProtect Gateway logs for active tunnel handshakes.

Answer

Check the Panorama > Setup > Operations > Export Panorama Configuration menu.

Question 9

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Accepted Answer

The next-hop IP address advertised by the BGP peer is unreachable in the routing table.. The most common reason a BGP route appears in the RIB-in but is not selected as best is that the next-hop IP address is unreachable. BGP best-path selection requires a valid, reachable next hop; if the next hop cannot be resolved in the routing table (or via a connected/static route), the route is marked as not best and not installed in the forwarding table.

Answer

The firewall's management plane CPU is exceeding 90% utilization.

Answer

The BGP peer is configured in a different autonomous system.

Answer

The Virtual Router does not have OSPF enabled.

Question 10

A SOC analyst notices that an internal server is making repeated DNS queries for randomly generated domain names, and the queries are failing with NXDOMAIN responses. The server is not scheduled to run any new applications. Which type of malicious activity does this pattern MOST likely indicate?

Accepted Answer

A domain generation algorithm used by malware for command-and-control.. Repeated NXDOMAIN responses for randomly generated domains from an unscheduled internal server is a classic indicator of a domain generation algorithm used by malware to find its command-and-control infrastructure. The analyst should treat the host as potentially compromised, isolate it, and investigate for malware. DNS tunneling, load balancing health checks, and resolver DoS do not match the random failing query pattern.

Answer

A misconfigured application performing a DNS-based load balancing health check.

Answer

A DNS tunneling exfiltration channel encoding stolen data in query strings.

Answer

A denial-of-service attack against the internal DNS resolver.

Question 11

A help desk technician receives a ticket stating that a Cortex XDR agent on a Windows laptop displays a red status in the console and the user cannot access the corporate VPN. The technician confirms the laptop has internet access and can browse external websites. The technician needs to restore the agent's management connection so the security team can see the device again. Which step should the technician take first?

Accepted Answer

Confirm the Cortex XDR agent service is running and check whether the endpoint can resolve and reach the required cloud service hostnames.. With internet access confirmed, the most likely causes are a stopped agent service or blocked resolution and reachability of the Cortex XDR cloud hostnames. Checking the service and cloud endpoint reachability is quick, non-destructive, and directly restores the management connection so the security team can see the device.

Answer

Reimage the laptop and return it to the user with a fresh operating system image.

Answer

Uninstall the VPN client because it is likely conflicting with the Cortex XDR agent.

Answer

Disable Windows Update on the laptop to prevent driver changes from affecting the agent.

Question 12

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles on Palo Alto Networks firewalls enforce category- and reputation-based blocking using PAN-DB, the cloud-hosted URL categorization database. To block access to sites categorized as malicious, the URL Filtering profile must be attached to the Security policy rule. Without it, the rule has no URL category enforcement mechanism.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 13

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

Accepted Answer

Process execution events. The Cortex XDR agent collects rich endpoint telemetry for behavioral analytics and threat hunting, and process execution events (A) are core because they capture process creation, command lines, parent-child relationships, and related metadata used by the causality chain and Behavioral Threat Protection. Network connection events (B) are also collected, recording endpoint network activity such as connections, ports, and remote IPs so the agent can correlate network behavior with process activity for threat detection and investigation. File modification and creation events (C) are likewise collected, tracking file writes, creations, and related file operations that are essential for detecting malware drops, ransomware behavior, and persistence. The remaining options do not belong: physical datacenter environmental temperature readings (D) are facility/environmental monitoring data not gathered by an endpoint agent, and monitored Wi-Fi router SSID signal strengths (E) are wireless infrastructure metrics outside the Cortex XDR agent's endpoint telemetry scope.

Answer

Physical datacenter environmental temperature readings

Answer

Monitored Wi-Fi router SSID signal strengths

Question 14

A security analyst notices that a production Amazon RDS database is reachable from the internet on port 3306. The database sits in a private subnet, and the analyst must identify which configuration change most likely introduced this exposure. Which AWS component should the analyst review first?

Accepted Answer

The RDS security group inbound rules. Security groups are stateful instance-level firewalls, and an inbound rule that allows port 3306 from 0.0.0.0/0 is the classic cause of an RDS database becoming internet-reachable. Network ACLs, parameter groups, and backup retention do not grant network access in this manner, so the security group rules are the correct place to look first.

Answer

The RDS automated backup retention window

Answer

The RDS parameter group settings

Answer

The network ACL associated with the private subnet

Question 15

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?

Accepted Answer

Enable Causation Analysis and expanded forensic data collection in the Agent Settings profile for that endpoint group.. Cortex XDR's Causation Analysis and expanded forensic data collection, configured in the Agent Settings profile for the endpoint group, is the feature designed to capture detailed process, file, and network telemetry around a specific application's behavior. This gives the administrator the forensic data needed to determine whether the application's behavior is truly malicious or a false positive.

Answer

Increase the firewall packet capture buffer size to 1 GB.

Answer

Configure a URL filtering block page bypass.

Answer

Enable administrative debug logging on the local syslog server.

Question 16

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

Accepted Answer

URL Filtering Profile. URL Filtering Profiles are specifically designed to control web access by categorizing URLs and domains, allowing administrators to block access to known malicious, phishing, and other risky categories. When attached to a security rule that governs outbound web traffic, the profile enforces these block actions based on the destination URL. This directly addresses the requirement to prevent employees from visiting malicious and phishing domains.

Answer

Denial of Service (DoS) Protection Profile

Answer

File Blocking Profile

Answer

WildFire Analysis Profile

Question 17

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

Accepted Answer

In the Tag field of the Layer 2 interface configuration. For a Layer 2 subinterface on a Palo Alto Networks firewall, the VLAN tag is specified in the Tag field of the Layer 2 interface configuration. This field binds the subinterface to a specific 802.1Q VLAN ID so the firewall can process tagged frames correctly. The Tag field is the only place where the VLAN ID is defined for a Layer 2 subinterface.

Answer

Within the DHCP Server IP pool configuration

Answer

In the Virtual Router general settings

Answer

Inside the Zone Protection Profile assigned to the interface

Question 18

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. A Vulnerability Protection Profile is the correct feature because it inspects traffic against a signature database that includes reconnaissance and scanning signatures (e.g., port scans, host sweeps). Setting the action to drop or reset-both actively blocks the scanner rather than merely alerting. This directly addresses automated vulnerability scanning tools hitting the database server.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 19

A junior security analyst is learning about cloud security posture management (CSPM) with Prisma Cloud. The analyst asks a senior colleague to explain the primary purpose of CSPM. Which statement best describes the primary purpose of Prisma Cloud's CSPM capabilities?

Accepted Answer

To continuously monitor cloud environments for misconfigurations and compliance violations.. Prisma Cloud CSPM continuously monitors cloud environments for misconfigurations and compliance violations. It scans resources, evaluates them against policies and standards, and alerts on issues. This helps organizations identify and remediate risks like public buckets, open ports, and missing encryption, ensuring a secure and compliant cloud posture.

Answer

To encrypt data at rest in cloud storage services automatically.

Answer

To provide runtime protection for containers and hosts by blocking malicious processes.

Answer

To manage user identities and access permissions across multiple cloud providers.

Question 20

A security analyst is investigating a potential security incident in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user recently created a new access key. Which AWS service should the analyst query to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures all API activity in an AWS account, including IAM actions. To find who created an access key, the analyst can search CloudTrail logs for the CreateAccessKey event. Other services like AWS Config, GuardDuty, and IAM Access Analyzer serve different purposes and do not provide the necessary audit details.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS Config