Cybersecurity-Apprentice Practice Exam 4 — 20 Questions

Question 1

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The next-hop IP address advertised by the BGP peer is unreachable in the routing table.. BGP route selection depends on attributes like weight, local preference, AS-path length, origin, and MED. If a route is not best, it fails one of these decision criteria or has an unreachable next hop.

Answer

The firewall's management plane CPU is exceeding 90% utilization.

Answer

The BGP peer is configured in a different autonomous system.

Answer

The Virtual Router does not have OSPF enabled.

Question 2

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS profile and QoS policy rule are applied on the egress physical interface where traffic leaves the firewall, to manage bandwidth allocation properly.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 3

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 4

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

Accepted Answer

Active sessions are synchronized to the passive peer, allowing seamless traffic continuity without dropping connections.. With HA session synchronization enabled, active stateful TCP and UDP sessions are synchronized to the peer firewall, preventing dropped connections during a failover.

Answer

All active user sessions are immediately terminated and must re-authenticate.

Answer

Management IP addresses are duplicated on both units simultaneously.

Answer

The passive firewall boots up from power-off state to take over.

Question 5

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

Accepted Answer

Reset the user password in Active Directory via integration command.. Compromised credential playbooks typically involve resetting the user's password in Active Directory, revoking active sessions, and notifying the user or manager.

Answer

Factory reset all enterprise core routing switches.

Answer

Format the physical hard drive of the Active Directory Domain Controller.

Question 6

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' CLI command allows administrators to simulate or test source, destination, user, and application parameters against the security policy rules.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions

Question 7

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

Accepted Answer

Offloading security profile pattern matching to dedicated hardware security processors (ASICs/FPGAs).. Hardware offloading and dedicated Single-Pass Parallel Software Architecture (SP3) or hardware acceleration processors (such as security processors on higher-end firewalls) handle signature and pattern matching efficiently.

Answer

Disabling stateful inspection globally across all zones.

Answer

Converting all Layer 3 interfaces to loopback interfaces.

Answer

Configuring static routing to bypass the dataplane entirely.

Question 8

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

Accepted Answer

A Decryption policy rule configured with the 'Forward Proxy' action.. SSL Forward Proxy requires a Decryption policy rule, a Decryption profile (with Forward Proxy action), and a trusted Forward Trust Certificate signed by an internal CA.

Answer

An external BGP routing peer for prefix exchange.

Answer

A GlobalProtect Gateway license installed on the management plane.

Question 9

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID uses application decoding, heuristics, and signature matching to identify apps regardless of port, and App-ID signatures accurately detect tunneling protocols.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 10

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

Accepted Answer

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.. App-ID initially identifies traffic based on initial packets (port/heuristics), and as payload decryption or deeper signature inspection occurs (e.g., SSL handshake or HTTP parsing), App-ID re-evaluates and updates the session application.

Answer

The firewall rebooted mid-session, causing the application cache to reset.

Answer

Static routing tables dynamically updated the next-hop gateway.

Answer

NAT rules translated the source port, forcing an application renegotiation.

Question 11

A tier-1 SOC analyst receives an alert for a blocked malware execution detected by WildFire on a firewall. What is the standard operational response procedure for this type of high-confidence prevention alert?

Accepted Answer

Verify that the threat was successfully blocked by the firewall and check if any other endpoints attempted to access the same file.. When malware is proactively blocked by WildFire or Anti-Malware, the analyst verifies the prevention status and checks if any other hosts were exposed.

Answer

Escalate the alert directly to law enforcement without reviewing internal logs.

Answer

Immediately re-image the firewall management plane to remove potential rootkits.

Answer

Disable WildFire inline inspection to prevent future network latency.

Question 12

A SOC analyst is reviewing real-time firewall traffic in the Application Command Center (ACC). What is the primary purpose of the ACC in a Palo Alto Networks firewall?

Accepted Answer

To provide a visual and interactive summary of network traffic, applications, and threats over time.. The ACC provides a graphical summary of application, user, URL, and threat traffic passing through the firewall to help identify usage patterns and anomalies.

Answer

To execute active containment playbooks on infected endpoint hosts.

Answer

To automatically generate SIEM correlation rules based on machine learning.

Answer

To compile configuration backups before pushing policy changes.

Question 13

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

Accepted Answer

Use Parsing Rules in Cortex XSIAM to map raw log fields to the XDM schema.. Log Forwarder and Parser configurations in Cortex XSIAM use Analytics and Parsing rules, specifically leveraging Parsing Rules to transform raw logs into the XDM (XDR Data Model) common schema.

Answer

Create an Incident Response Playbook in XSOAR to regex-parse the raw text file.

Answer

Modify the firewall Zone Protection profile to drop unparsed packets.

Answer

Configure Data Collection Rules in Expedition to automatically rewrite the syslog header.

Question 14

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

Accepted Answer

Process execution events. The Cortex XDR agent collects comprehensive endpoint telemetry including process executions, network connections, file modifications, and registry events.

Answer

Physical datacenter environmental temperature readings

Answer

Monitored Wi-Fi router SSID signal strengths

Question 15

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

Accepted Answer

Trigger the 'Isolate Endpoint' action from the Cortex XDR Incident response tools.. Cortex XDR allows administrators and automated playbooks to isolate endpoints from the network using the 'Isolate Endpoint' action in the Action Center or incident response capabilities.

Answer

Change the Authentication Profile to drop Kerberos ticket grants.

Answer

Enable strict Zone Protection profiles on the local switch interface.

Answer

Apply a Global Protect Portal lockout via Panorama Device Groups.

Question 16

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire portal allows security professionals to manually search file hashes to view historical analysis reports and verdicts.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 17

A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?

Accepted Answer

Navigate to Cortex XSIAM > Settings > Data Sources to review agent and collector ingestion health metrics.. Cortex XSIAM provides dedicated data source monitoring and health dashboards to track ingestion rates, parsing errors, and collector status.

Answer

Open the Threat Intelligence management page and verify API token validity.

Answer

Review the GlobalProtect Gateway logs for active tunnel handshakes.

Answer

Check the Panorama > Setup > Operations > Export Panorama Configuration menu.

Question 18

An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?

Accepted Answer

Create an exception rule in Cortex XDR using the alert details to filter out the scanner's specific parameters.. Cortex XDR allows analysts to tune alerts by creating exception rules based on alert criteria such as specific hosts, file paths, or command lines.

Answer

Delete the default Security Policy rule on the firewall governing internal subnets.

Answer

Disable the entire Local Analysis module globally across all endpoint security profiles.

Answer

Restart the Cortex XDR Agent daemon on the vulnerability scanner host.

Question 19

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

Accepted Answer

Configure the SIEM server profile to export logs using CEF (Common Event Format) or JSON formatting.. When configuring SIEM integrations or log forwarding profiles in Palo Alto Networks products, administrators can specify standard formats such as CEF or JSON for seamless ingestion.

Answer

Disable all header encryption and export logs using raw ASCII carriage returns only.

Answer

Rewrite the PAN-OS kernel to natively output syslog in Microsoft Word DOCX format.

Answer

Convert all log files into uncompressed raw bitmap graphics prior to export.

Question 20

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

Accepted Answer

Review the Cortex XDR Causality Chain and Timeline view for the affected endpoint.. The Cortex XDR Causality Chain and BIOC (Behavioral Indicator of Compromise) timeline provide a graphical and chronological representation of process activity.

Answer

Run a vulnerability scan against the endpoint using Panorama compliance tools.

Answer

Examine the DHCP lease table on the core routing switch.

Answer

Export the firewall Traffic Log CSV and sort by destination port numbers.