Cybersecurity-Apprentice Practice Test 23 — 15 Questions

Question 1

A security architect is designing a Prisma Cloud deployment for a Google Cloud environment that spans multiple projects under a single organization. The architect wants Prisma Cloud to discover resources in all current and future projects without configuring each project manually. What should the architect do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Onboard the GCP organization in Prisma Cloud and grant the service account the required roles at the organization level.. Prisma Cloud supports GCP organization-level onboarding, where a service account is granted the necessary roles at the organization node. This grants inherited access to every project in the organization, so current and future projects are discovered automatically without adding each one manually, matching the architect's scalability requirement.

Answer

Configure a VPC Service Controls perimeter around all projects and provide Prisma Cloud with the perimeter name.

Answer

Create a separate service account in each GCP project and add each project individually to Prisma Cloud.

Answer

Use Google Cloud's Security Command Center Premium and forward its findings to Prisma Cloud via Pub/Sub.

Question 2

A security administrator is reviewing logs and sees repeated failed login attempts against several user accounts from a single external IP address over a short period. The attempts use common usernames such as admin, root, and test. No account has been successfully accessed. Which type of attack is most likely occurring?

Accepted Answer

Brute-force or password-guessing attack against default and common accounts. The pattern of many failed logins from one external IP using generic account names such as admin, root, and test is a classic brute-force or password-guessing attempt against default accounts. Since no login succeeded, the immediate priorities are to block or rate-limit the source, disable or rename default accounts, enforce strong authentication, and monitor for changes in the pattern.

Answer

Credential stuffing using leaked username and password pairs

Answer

Pass-the-hash attack using captured NTLM hashes

Answer

Kerberoasting against service accounts

Question 3

A security analyst at a financial firm receives an alert that a workstation has been communicating with a known malicious IP address. The analyst isolates the workstation from the network and begins reviewing logs. Which step of the incident response process is the analyst performing?

Accepted Answer

Containment. Isolating a compromised workstation from the network is a containment action. Containment aims to limit the scope and impact of an incident while the analyst investigates further. Identification has already occurred because the alert confirmed malicious communication. Eradication and recovery come later, after the threat is fully understood and removed. Thus, the analyst is performing containment.

Answer

Recovery

Answer

Eradication

Answer

Identification

Question 4

An administrator wants to dynamically block connections from IP addresses published on a trusted third-party threat feed. Which feature should be used to ingest this feed into firewall policies?

Accepted Answer

External Dynamic List (EDL). An External Dynamic List (EDL) on Palo Alto Networks firewalls allows the firewall to dynamically import IP addresses, URLs, or domain names from an external source (such as a trusted third-party threat feed) and reference them directly in security policies. The firewall periodically polls the EDL source (via HTTP/HTTPS) and updates the list automatically, enabling real-time blocking of malicious IPs without manual intervention. This is the correct feature for ingesting a threat feed into firewall policies.

Answer

Custom App-ID Signature Pattern

Answer

DHCP Server Lease Table

Answer

Static Address Group

Question 5

A SOC analyst is reviewing real-time firewall traffic in the Application Command Center (ACC). What is the primary purpose of the ACC in a Palo Alto Networks firewall?

Accepted Answer

To provide a visual and interactive summary of network traffic, applications, and threats over time.. The Application Command Center (ACC) in Palo Alto Networks firewalls is a dashboard that provides visual, interactive summaries of network traffic, applications, users, and threats over time. It aggregates data from traffic, threat, URL, and WildFire logs into widgets and charts, enabling analysts to spot trends and drill down into specific activity. It is a monitoring and visibility tool, not an enforcement or automation engine.

Answer

To execute active containment playbooks on infected endpoint hosts.

Answer

To automatically generate SIEM correlation rules based on machine learning.

Answer

To compile configuration backups before pushing policy changes.

Question 6

A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?

Accepted Answer

Establish a master CloudTrail setup in the management account paired with cross-account IAM roles for Prisma Cloud access. A master (organization) CloudTrail in the AWS Organizations management account aggregates API activity from all member accounts into a single S3 bucket and CloudWatch Logs destination. Prisma Cloud then assumes a cross-account IAM role to read that centralized trail, giving one ingestion point and consistent posture visibility across the org. This is the AWS-recommended pattern for multi-account CloudTrail governance.

Answer

Deploy VM-Series firewalls in every VPC to inspect CloudTrail API payloads locally

Answer

Rely entirely on Prisma Cloud Compute Defenders installed on AWS EC2 instances

Answer

Configure independent CloudTrail logging directly inside each individual member account without cross-account roles

Question 7

A security analyst is reviewing a suspicious email reported by a user. The email contains a link to a website that asks for login credentials. The analyst wants to safely determine if the link is malicious without exposing the corporate network. Which of the following is the BEST action to take?

Accepted Answer

Submit the URL to a threat intelligence platform like VirusTotal.. Using a threat intelligence platform like VirusTotal allows safe reputation checks and often provides sandbox reports without exposing the corporate network. Directly clicking the link or forwarding it are risky and do not provide controlled analysis. A sandbox with no network access cannot evaluate the site's behavior.

Answer

Click the link from the analyst's own workstation to see where it redirects.

Answer

Forward the email to all employees to warn them about the phishing attempt.

Answer

Open the link in a sandboxed virtual machine with no network access.

Question 8

A retail company stores customer payment card numbers in a database. A compliance auditor asks the security team to reduce the impact if the database is compromised. The team proposes replacing the stored card numbers with surrogate values that can be mapped back only through a separately protected lookup table. Which data protection technique are they proposing?

Accepted Answer

Tokenization. The proposed design replaces sensitive card numbers with surrogate values and keeps the reversible mapping in a separately protected lookup table. That is the definition of tokenization. Because the vault is isolated from the database that holds the tokens, a breach of the database alone does not expose usable card data, which satisfies the auditor's goal of reducing impact.

Answer

Data masking with static character substitution

Answer

Hashing with a salted one-way function

Answer

Asymmetric encryption using a public and private key pair

Question 9

Which security concept describes the practice of hiding internal network topology and IP address schemes from external entities using Network Address Translation (NAT)?

Accepted Answer

Network Address Translation (NAT) and topology hiding. NAT with topology hiding translates internal private IP addresses to public addresses, preventing external entities from seeing the internal addressing scheme and network structure. This is a recognized security benefit of NAT, often described as topology hiding. It obscures internal IP ranges and host counts from external observers.

Answer

Application Layer Gateway (ALG)

Answer

Multi-Factor Authentication (MFA)

Answer

End-to-End Encryption

Question 10

A security engineer is configuring Prisma Cloud Compute to enforce runtime security policies for serverless functions in AWS Lambda. The goal is to detect and prevent malicious activities such as crypto mining and data exfiltration. Which TWO Prisma Cloud Compute capabilities should be enabled to achieve this? (Choose two.)

Accepted Answer

Runtime defense for serverless functions. To detect and prevent malicious activities in serverless functions, runtime defense and behavioral baselining are essential. Runtime defense monitors function invocations for suspicious behavior, while behavioral baselining establishes a normal pattern and alerts on deviations. Together, they provide the necessary runtime visibility and protection for AWS Lambda functions.

Answer

Vulnerability scanning of function layers

Answer

Static code analysis of function code

Answer

Network traffic encryption for function invocations

Question 11

A security analyst is reviewing how data moves through the TCP/IP stack. She needs to identify TWO protocols that operate at the Transport layer and provide end-to-end communication between applications on different hosts. (Choose two.)

Accepted Answer

TCP. TCP and UDP are the two core Transport layer protocols in the TCP/IP model. TCP provides reliable, connection-oriented delivery, while UDP offers connectionless, best-effort delivery. Both use port numbers to multiplex application data between hosts. IP and ICMP work at the Internet layer, and ARP resolves link-layer addresses, so none of those provide the end-to-end application transport the analyst requires.

Answer

ARP

Answer

ICMP

Answer

IP

Question 12

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

Accepted Answer

Network > Virtual Routers > [Virtual Router Name] > Static Routes. On a Palo Alto Networks firewall, static routes are configured under the virtual router. The correct path is Network > Virtual Routers > [Virtual Router Name] > Static Routes, where you define the destination subnet (192.168.10.0/24) and the next-hop IP (10.0.0.1). This is the standard PAN-OS navigation for static routing.

Answer

Device > Setup > Operations > Routing

Answer

Network > Interfaces > Ethernet > Static Route

Answer

Policies > Routing > Static

Question 13

A SOC analyst is reviewing a SIEM alert that shows multiple failed login attempts followed by a successful login for the same user account from an unusual geographic location within a short time window. The account is used by a remote employee who normally connects from a single city. Which activity should the analyst prioritize to determine whether this represents a compromised account?

Accepted Answer

Review the authentication logs to confirm the source IP addresses and login timestamps. Reviewing authentication logs confirms the source IPs, timestamps, and success or failure patterns behind the alert. This evidence determines whether the login truly originated from an unusual location and whether the failures align with a brute-force or credential-stuffing attempt. Containment and deeper forensic checks should follow confirmation, not precede it.

Answer

Immediately disable the user account to prevent further unauthorized access

Answer

Check the user's mailbox rules for any forwarding or deletion rules created recently

Answer

Run a full antivirus scan on the user's endpoint to detect malware

Question 14

A financial services firm stores sensitive customer data in an Amazon S3 bucket. An auditor requires that all access to the bucket be logged, that logs capture the identity of the requester, and that logs be retained for one year. Which combination should the security administrator implement?

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket and configure a trail that delivers logs to a separate S3 bucket with a one-year retention lifecycle policy.. The auditor requires access logging, requester identity, and one-year retention. CloudTrail data events capture object-level S3 operations with requester identity, and a trail can deliver logs to a separate bucket where a lifecycle policy enforces one-year retention. Server access logging lacks the same identity context, management events miss data access, and S3 Inventory reports do not record who accessed objects.

Answer

Enable AWS CloudTrail management events only and rely on default retention in CloudTrail.

Answer

Enable Amazon S3 Inventory reports and configure a one-year retention policy on the inventory destination bucket.

Answer

Enable S3 server access logging on the bucket and set a one-year lifecycle policy on the same bucket.

Question 15

A company requires remote workers to establish a secure tunnel back to the corporate data center using GlobalProtect. Which component authenticates the users before assigning an IP address pool?

Accepted Answer

An Authentication Profile linked to the GlobalProtect Portal/Gateway configuration.. GlobalProtect authentication is handled by an Authentication Profile configured on the portal and/or gateway. The Authentication Profile defines the authentication method (e.g., LDAP, RADIUS, SAML, Kerberos) and is referenced in the portal/gateway configuration. After successful authentication, the user is assigned an IP address from the configured pool.

Answer

A Security policy rule with an explicit source user match.

Answer

A decryption policy specifying a trusted CA certificate.

Answer

A NAT rule translating the public IP to a private IP.