Cybersecurity-Apprentice Practice Test 22 — 15 Questions

Question 1

A security analyst is reviewing Cortex XDR endpoint alerts and wants to confirm that the agent's exploit protection module is actively preventing known exploitation techniques on a Windows workstation. Which Cortex XDR agent capability should the analyst verify is enabled for this endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploit Protection. Exploit Protection is the Cortex XDR agent module specifically designed to block known exploitation techniques at the memory and system-call level. Malware Protection handles file-based threats, Behavioral Threat Protection watches process behavior, and Device Control manages peripherals. To verify that known exploitation methods are prevented on the Windows endpoint, the analyst must confirm Exploit Protection is enabled.

Answer

Behavioral Threat Protection

Answer

Malware Protection

Answer

Device Control

Question 2

A SOC analyst is triaging an alert for a host that beaconed to a known command-and-control domain over HTTPS. The firewall shows the session was allowed because the traffic matched the SSL application with a valid server certificate. Which action should the analyst take to determine whether data was exfiltrated during the session?

Accepted Answer

Check the Traffic log session details for bytes sent and received, and correlate with the session end reason and application details. When encrypted C2 traffic is allowed, the Traffic log is the primary record of session metadata, including bytes sent and received. A disproportionately large outbound byte count compared with typical beacon size indicates data was transferred to the C2 server. Threat and URL Filtering logs describe detection and policy action, not transfer volume, and packet capture cannot decrypt the payload retroactively.

Answer

Query the URL Filtering log for the destination to confirm the category and whether the site was blocked

Answer

Review the firewall's Threat log for the session to see if any vulnerability or spyware signature fired on the payload

Answer

Enable packet capture on the firewall for the destination domain and wait for the next beacon to inspect the payload

Question 3

An administrator is reviewing Cortex XDR investigation tools. Which THREE features are available when investigating an incident in the Cortex XDR Incident View? (Choose three)

Accepted Answer

List of impacted endpoints and user accounts.. Option A is correct because the Cortex XDR Incident View aggregates the affected assets of an incident, presenting the list of impacted endpoints and the associated user accounts so the analyst knows the scope of the compromise. Option B is correct because the Incident View includes the attack story graph, which visualizes the correlated causality chain of alerts and events, letting the investigator trace how the attack progressed across the environment. Option D is correct because the Incident View exposes response action buttons that let the analyst contain and remediate directly, such as isolating an endpoint from the network or terminating a malicious process on the host. Options C and E are not part of Cortex XDR's investigation capabilities: payroll deduction processing is an HR/finance function unrelated to security operations, and real-time webcam monitoring is neither a Cortex XDR feature nor a legitimate incident-response tool.

Answer

Automated payroll deduction processing for compromised users.

Answer

Real-time physical webcam monitoring of the user's workspace.

Question 4

A junior administrator is documenting the corporate network and must list services that operate at the transport layer of the TCP/IP model. Which TWO protocols operate at the transport layer? (Choose two.)

Accepted Answer

UDP. The transport layer is responsible for end-to-end delivery between applications, using port numbers to identify processes and offering different service levels. TCP provides reliable, connection-oriented delivery, while UDP provides lightweight, connectionless delivery. Both are transport-layer protocols. IP belongs to the network layer, Ethernet to the link layer, and HTTP to the application layer.

Answer

IP

Answer

Ethernet

Answer

HTTP

Question 5

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

Accepted Answer

Reset the user password in Active Directory via integration command.. Option B is correct because a compromised-credential playbook must remediate the account itself, and Cortex XSOAR integrations such as Active Directory (e.g., ad-reset-password or ad-user-reset-password) let the playbook reset the user's password programmatically. Option C is correct because notifying the affected user and/or the security team is a standard containment/communication step, typically done with the Mail Sender or similar integration to trigger awareness and follow-up. Option E is correct because terminating the attacker's existing access is essential; integrations to firewalls, VPN gateways, or identity providers (e.g., session revocation or user logout commands) invalidate active sessions so stolen credentials or tokens can no longer be used. Option A does not belong because factory-resetting core routing switches is a destructive network action unrelated to credential compromise and would cause an outage. Option D does not belong because formatting the Domain Controller's hard drive is catastrophic and irrelevant to remediating a single compromised user account.

Answer

Factory reset all enterprise core routing switches.

Answer

Format the physical hard drive of the Active Directory Domain Controller.

Question 6

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

Accepted Answer

Use Parsing Rules in Cortex XSIAM to map raw log fields to the XDM schema.. Cortex XSIAM uses Parsing Rules to transform raw, non-standard log data into the Cortex XDM (Extended Data Model) schema by mapping source fields to normalized schema fields. This is the correct component for ingesting custom application logs that don't conform to standard RFC formats like syslog or CEF. Parsing Rules are applied during data ingestion before the data is stored and queried.

Answer

Create an Incident Response Playbook in XSOAR to regex-parse the raw text file.

Answer

Modify the firewall Zone Protection profile to drop unparsed packets.

Answer

Configure Data Collection Rules in Expedition to automatically rewrite the syslog header.

Question 7

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

Accepted Answer

Review the Cyvera.txt log file located in the Cortex XDR installation directory.. The Cyvera.txt log file is the primary diagnostic log for the Cortex XDR agent on Windows endpoints. It records detailed information about agent operations, including communication attempts with the Cortex XDR server, registration status, and any errors encountered during telemetry upload. Since the issue is specifically about agents failing to report telemetry, this log provides the most direct evidence of the communication failure. Other logs listed are either installation-related or pertain to different Palo Alto products (PAN-OS, log collector).

Answer

Open the msiexec.log file generated during the initial software installation.

Answer

Check the /var/log/pan/nsm.log file on the log collector.

Answer

Inspect the pan_event_log.csv file in the PAN-OS system partition.

Question 8

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

Accepted Answer

VLAN tagging and subinterface bindings on the Virtual Wire object. A Virtual Wire (VWire) on a Palo Alto Networks firewall binds two physical interfaces into a transparent Layer 2 path, so the firewall inspects traffic without participating in routing or NAT. When VLAN-tagged frames traverse a VWire, the firewall must be told how to handle those tags — either to pass them through or to match them to subinterfaces. The VLAN tagging and subinterface bindings on the Virtual Wire object control this behaviour, so misconfiguration there directly explains intermittent tag-stripping or tag-mismatch failures.

Answer

DHCP relay agent configuration

Answer

Virtual Router next-hop IP addresses

Answer

NAT Destination translation rules

Question 9

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

Accepted Answer

Inspect and log all traffic across all zones with least-privilege access control.. Zero Trust architecture mandates that no user, device, or network segment is implicitly trusted, regardless of whether it resides inside or outside the traditional perimeter. The foundational principle is to inspect and log all traffic across all zones — including internal east-west traffic — while enforcing least-privilege access control based on identity, context, and policy. On a Palo Alto Networks firewall, this translates to applying security policies with full Layer 7 inspection, logging, and granular allow/deny rules to every zone pair, eliminating any implicit trust based on network location.

Answer

Rely solely on perimeter firewalls to block external attackers.

Answer

Bypass security inspection for authenticated VPN users.

Answer

Implicitly trust traffic originating from internal zones.

Question 10

A junior administrator is documenting the TCP/IP model layers for a training manual. The administrator needs to map the OSI model's Transport layer to its equivalent layer in the TCP/IP model. Which layer of the TCP/IP model corresponds to the OSI Transport layer?

Accepted Answer

Transport layer. The TCP/IP model's Transport layer is the direct counterpart to the OSI Transport layer. Both handle end-to-end data transfer, segmentation, and port addressing. The Internet layer aligns with OSI Network, while the Network Access layer covers OSI Data Link and Physical. The Application layer aggregates the top three OSI layers. Correctly mapping these layers is essential for troubleshooting and for understanding where protocols like TCP and UDP operate.

Answer

Network Access layer

Answer

Application layer

Answer

Internet layer

Question 11

An organization wants to protect its internal DNS servers from being used in DNS amplification attacks. The security team decides to implement DNS response rate limiting (RRL). Which statement best describes how RRL mitigates this threat?

Accepted Answer

RRL limits the rate of identical responses sent to a single destination, reducing the amplification effect.. DNS response rate limiting (RRL) mitigates amplification attacks by capping the rate at which a DNS server sends identical responses to a single destination. Attackers spoof the victim's IP and send many queries for the same record, causing the server to flood the victim with large responses. RRL limits these responses, reducing the attack's impact without affecting legitimate traffic.

Answer

RRL limits the number of DNS queries a client can send per second.

Answer

RRL encrypts DNS responses to prevent tampering.

Answer

RRL validates the source IP address of DNS queries to prevent spoofing.

Question 12

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. Option A is correct because inline machine learning in threat prevention profiles enables real-time blocking of zero-day exploits by analyzing traffic patterns locally without relying solely on signatures. Option B is correct because the DNS Security service inspects DNS queries against Palo Alto Networks' threat intelligence to block malicious domains, including DNS tunneling and command-and-control (C2) callbacks used by APTs. Option C is correct because a WildFire profile automatically submits unknown executables and documents to the WildFire cloud for sandbox detonation and analysis, generating signatures that protect against previously unseen malware. Option D is not appropriate because SNMPv1 uses cleartext community strings and is inherently insecure, making it unsuitable for a hardened firewall. Option E is not appropriate because static IPsec tunnels with disabled Phase 2 rekeying reduce cryptographic agility and do not address zero-day or multi-stage attack protection.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 13

A security analyst receives an alert about a workstation repeatedly attempting to connect to an IP address known for hosting malware. The analyst wants to confirm whether the connection was successful and what data might have been transferred. Which type of data should the analyst examine first?

Accepted Answer

Firewall session logs. Firewall session logs are the most direct source to verify whether a connection was allowed and how much data was transferred. They capture the five-tuple of source IP, destination IP, source port, destination port, and protocol, along with bytes sent and received. This allows the analyst to confirm the connection and assess potential data exfiltration.

Answer

System event logs

Answer

Email gateway logs

Answer

Antivirus scan reports

Question 14

A security team is reviewing an incident where an attacker gained initial access by sending an email with a malicious macro-enabled spreadsheet to a finance employee. The employee opened the file and enabled macros. Which control would have been MOST effective at preventing the macro from executing while still allowing legitimate business documents to open?

Accepted Answer

Disabling macros by default and requiring signed macros from trusted publishers. Disabling macros by default and only allowing signed macros from trusted publishers directly stops the execution of unsigned malicious macros. This preserves the ability to open legitimate documents while preventing the specific attack vector. Email filtering and network IPS add defense in depth, but the most effective control for macro execution is at the application policy level.

Answer

Deploying an intrusion prevention system (IPS) at the network perimeter

Answer

Enforcing full-disk encryption on all finance laptops

Answer

Blocking all .xlsm file extensions at the email gateway

Question 15

A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?

Accepted Answer

Prisma Cloud Cloud Detection and Response (CDR) / Identity Security. Prisma Cloud's Cloud Detection and Response (CDR) module — which includes Identity Security / UEBA capabilities — ingests cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) and applies machine-learning behavioral baselines to detect anomalous API activity such as impossible travel, unusual AssumeRole patterns, or mass S3 enumeration indicative of credential compromise. This is the module that surfaces 'suspicious API activity' alerts tied to identity risk.

Answer

Prisma Access Remote Browser Isolation

Answer

Prisma Cloud Container Vulnerability Management

Answer

Prisma Cloud Web Application and API Security (WAAS)