Cybersecurity-Apprentice Practice Exam 3 — 20 Questions

Question 1

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Accepted Answer

An MTU mismatch between the OSPF neighbors. Being stuck in EXSTART/EXCHANGE state in OSPF typically points to a mismatch in Maximum Transmission Unit (MTU) sizes across the link or interface configuration errors.

Answer

A mismatch in OSPF area ID types (e.g., normal vs. stub)

Answer

Incorrect OSPF hello or dead timer intervals

Answer

Authentication type or password mismatch

Question 2

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures usually stem from expired certificates, SSL inspection proxies intercepting traffic without proper root CA trust, or incorrect proxy settings.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 3

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Accepted Answer

By deploying a compatible legacy agent version that supports older OS APIs while providing core malware and exploit prevention.. Cortex XDR supports legacy operating systems with specific legacy agent versions that provide core prevention capabilities supported by those OS architectures.

Answer

By forcing an automatic in-place upgrade of the legacy Windows server to Windows 11.

Answer

By routing all legacy server traffic through a next-generation firewall proxy instead of installing an agent.

Answer

By disabling all security checks for servers older than five years.

Question 4

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

Accepted Answer

Provides a standardized industry terminology for describing adversary tactics and techniques.. MITRE ATT&CK mapping provides a common framework for understanding adversary tactics, standardizing incident reports, and identifying security coverage gaps.

Answer

Automatically recompiles malicious binary code into safe executable patches.

Answer

Directly replaces the need for endpoint firewalls and network segmentation.

Question 5

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. OSPF neighbors must have matching Area ID, Hello/Dead intervals, and authentication parameters (if enabled) to form an adjacency.

Answer

Process ID

Answer

Router ID

Question 6

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Layer 3. PAN-OS physical interfaces can be configured in several modes, including Layer 3, Layer 2, Virtual Wire, and Tap.

Answer

WAN Accelerator

Answer

Switchport Trunk

Answer

Promiscuous Bridge

Question 7

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

Accepted Answer

An Interface Management Profile assigned to the interface. Management Profile (or Interface Management Profile) allows administrators to permit or deny specific management traffic like ping, SSH, or HTTPS on specific interfaces.

Answer

A Security Policy rule with an application of 'ping'

Answer

A Zone Protection Profile applied to the egress zone

Answer

The Device > Setup > Management tab

Question 8

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

Accepted Answer

Add a Vulnerability Protection Profile exception for that specific Signature ID.. Vulnerability Protection Profile exceptions allow administrators to exempt specific signature IDs from action (e.g., set to allow or disabled) while keeping the rest of the profile active.

Answer

Change the global firewall operating mode from operational to maintenance mode.

Answer

Disable the Anti-Spyware Profile assigned to the zone.

Answer

Delete the default vulnerability signature from the PAN-OS software base.

Question 9

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

Accepted Answer

Network > Virtual Routers > [Virtual Router Name] > Static Routes. Static routes are configured under Network > Virtual Routers, selecting the specific virtual router instance, and then adding a static route entry.

Answer

Device > Setup > Operations > Routing

Answer

Network > Interfaces > Ethernet > Static Route

Answer

Policies > Routing > Static

Question 10

An administrator configures Dynamic NAT on a Palo Alto Networks firewall using a pool of public IP addresses. After implementation, some internal clients intermittently fail to establish outbound connections. Upon reviewing traffic logs, the administrator notes that the NAT translation pool has exhausted all available ports for a specific source IP. Which feature should be enabled or adjusted to prevent this port exhaustion?

Accepted Answer

Add additional public IP addresses to the NAT translation pool or enable DIPP block allocation.. Port exhaustion in dynamic IP and port NAT can be mitigated by adding more IP addresses to the NAT pool, enabling destination IP translation, or adjusting port allocation settings.

Answer

Change the NAT type from Source NAT to Static Destination NAT.

Answer

Enable Universal NAT without port mapping.

Answer

Disable stateful inspection on the security rule.

Question 11

An administrator is setting up a Site-to-Site IPsec VPN tunnel on a Palo Alto Networks firewall. The VPN tunnel comes up, but traffic from the local subnet cannot reach the remote subnet. Upon checking the IPsec SA status, the phase 2 security associations are active. What is the most likely cause of the traffic failure?

Accepted Answer

A mismatch in Proxy IDs between the local and remote peers. IPsec Phase 2 SAs being active means the tunnel is established, but if traffic fails, proxy IDs (or IKEv2 selectors) might not match, or security rules/routing are misconfigured.

Answer

Lifetime expiration in Phase 1 negotiation

Answer

DHCP relay configuration on the tunnel interface

Answer

Phase 1 Encryption algorithm mismatch (e.g., AES-256 vs AES-128)

Question 12

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

Accepted Answer

VLAN tagging and subinterface bindings on the Virtual Wire object. Virtual Wire objects support VLAN normalization or VLAN tagging options, and subinterfaces or VWire tags must match expected frame tags.

Answer

DHCP relay agent configuration

Answer

Virtual Router next-hop IP addresses

Answer

NAT Destination translation rules

Question 13

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles utilize PAN-DB to categorize and control web browsing traffic.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 14

An administrator needs to test DNS resolution from the Palo Alto Networks firewall command line interface (CLI) to ensure the management plane can reach external name servers. Which command should be used?

Accepted Answer

ping host [hostname]. The 'ping host' or operational command utility allows testing connectivity and DNS resolution from the firewall.

Answer

test dns-server [hostname]

Answer

nslookup target [hostname]

Answer

show dns-cache

Question 15

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

Accepted Answer

Static IP. Source NAT translation can utilize dynamic IP and port (DIPP), dynamic IP, or static IP configurations.

Answer

VLAN Subinterface Tag

Answer

Port Forwarding Pool

Question 16

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

Accepted Answer

SAML. PAN-OS supports multiple authentication methods including RADIUS, LDAP, SAML, Kerberos, and local database authentication.

Answer

IPsec Pre-Shared Key exchange exclusively without user credentials

Answer

WPA3 Enterprise 802.1X

Answer

SNMPv3 localized USM passwords

Question 17

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

Accepted Answer

Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference. Incrementing FCS errors and CRC errors on an Ethernet interface typically indicate physical layer issues such as bad cabling, duplex mismatches (though both set to full), or physical media degradation.

Answer

An incorrect Zone Protection Profile flooding threshold

Answer

A mismatch in Virtual Router metric values

Answer

Incorrect TCP MSS adjustment on the Layer 3 interface

Question 18

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

Accepted Answer

A metric higher than 10 (e.g., 20). To configure a backup static route (floating static route), the metric/preference value must be higher than the primary route.

Answer

A metric lower than 10 (e.g., 5)

Answer

A metric of 0

Answer

The exact same metric of 10 to enable equal-cost multi-path (ECMP)

Question 19

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

Accepted Answer

App-ID based Security policy rules. App-ID allows administrators to identify and control specific applications regardless of port and protocol, making it the correct choice for application-level restrictions.

Answer

Static routing tables

Answer

MAC address ACLs

Answer

Port-based IP/Port filtering rules

Question 20

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

Accepted Answer

The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.. A 'zone mismatch' drop indicates that the packet's incoming interface does not belong to the security zone expected by the session or route lookup.

Answer

The security rule destination zone does not match the source zone.

Answer

The NAT policy is translating the packet to an unassigned IP address.

Answer

The Virtual Router has two default routes pointing to different interfaces.