Cybersecurity-Apprentice Practice Test 24 — 15 Questions

Question 1

A help desk technician is on a support call with a remote user whose workstation cannot reach any resources on the corporate network. The technician asks the user to run a command that will show the workstation's IP address, subnet mask, and default gateway. Which command should the user run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ipconfig /all. When a workstation cannot reach the network, the first thing to verify is its own IP configuration. Running ipconfig /all on Windows shows the IPv4 address, subnet mask, default gateway, DNS servers, and DHCP lease information in one output. That lets the technician confirm whether the host has a valid address on the correct subnet and a gateway it can actually use.

Answer

tracert 8.8.8.8

Answer

netstat -an

Answer

nslookup corp-dc01

Question 2

A hospital's security team must protect patient records stored on a file server. The compliance officer asks which control ensures that data remains unaltered and trustworthy while it is stored and while it travels between the server and clinical workstations. Which security objective is the officer asking about?

Accepted Answer

Integrity. Integrity guarantees that data is not changed in unauthorized ways, whether it sits on a file server or crosses the network to a workstation. Hashing and digital signatures let the hospital detect tampering. Availability concerns uptime, confidentiality concerns disclosure, and non-repudiation concerns proving actions, so integrity is the objective that matches the compliance officer's requirement.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 3

An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?

Accepted Answer

It eliminates the need to install and maintain software agents on target virtual machines while maintaining visibility.. Agentless scanning in Prisma Cloud uses cloud provider APIs and snapshot-based analysis to inspect workloads (e.g., EC2 instances, containers) without installing a software agent on each VM. This preserves visibility into vulnerabilities, misconfigurations, and malware while eliminating the operational overhead of deploying, patching, and maintaining agents across every workload.

Answer

It enables active SSL decryption of all inbound TLS traffic on public load balancers.

Answer

It provides real-time layer 7 container runtime process execution blocking.

Answer

It replaces the need for cloud provider API integrations entirely.

Question 4

A Tier-1 analyst receives an alert that a user's credentials were used to authenticate to a SaaS application from an unfamiliar foreign IP address at 03:00 local time, while the user was asleep. The identity provider shows a successful single-factor login. Which immediate containment step best limits further unauthorized access while preserving evidence?

Accepted Answer

Reset the user's password, revoke active sessions and refresh tokens, and require MFA enrollment before restoring access. For a suspected credential compromise, the priority is to invalidate the attacker's access while keeping the account recoverable. A password reset removes the known credential, session and token revocation terminates active access, and MFA enrollment prevents simple replay. Deleting the account or disabling the app organization-wide is disproportionate, and blocking one IP leaves the stolen credential usable from other locations.

Answer

Add the foreign IP address to the firewall blocklist and take no action on the user account

Answer

Disable the SaaS application for all users until the investigation completes

Answer

Delete the user's account from the identity provider to prevent any further logins

Question 5

A security analyst at a healthcare company is reviewing a new Amazon S3 bucket that will store patient records. The compliance officer requires that the data be encrypted at rest and that the company retain control of the encryption keys and their rotation schedule. Which AWS service should the analyst recommend?

Accepted Answer

AWS Key Management Service (AWS KMS) customer managed keys, used with S3 server-side encryption (SSE-KMS).. The compliance officer requires encryption at rest plus customer control of keys and rotation. AWS KMS customer managed keys, combined with S3 server-side encryption using SSE-KMS, deliver both: S3 encrypts objects at rest, and the organization defines and rotates its own KMS keys. SSE-S3 leaves key control with AWS, SSE-C shifts too much operational burden to the customer, and ad hoc client-side keys lack centralized lifecycle management.

Answer

Amazon S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Amazon S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Amazon S3 client-side encryption using an open-source library, with keys stored in the application configuration.

Question 6

A Tier-1 SOC analyst is documenting an incident involving a suspicious PowerShell script executed on a user workstation. Which TWO pieces of information are MOST important to capture in the initial incident ticket to support later investigation? (Choose two.)

Accepted Answer

The full command line and parent process of the PowerShell execution.. To support later investigation of a suspicious PowerShell execution, the ticket should capture the full command line and parent process to understand how it was launched, and the execution timestamp with user account context to build a timeline and assess affected accounts. Irrelevant hardware or cosmetic details do not advance the investigation and should be excluded from Tier-1 documentation.

Answer

The color scheme of the user's desktop wallpaper.

Answer

The make and model of the workstation's monitor.

Answer

The workstation's total available disk space and installed printer drivers.

Question 7

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

Accepted Answer

An Authentication Profile combined with an Admin Role Profile mapping the AD group.. To restrict GUI access to members of an AD group, PAN-OS uses an Authentication Profile (which defines the LDAP/AD server, bind DN, and group mapping) combined with an Admin Role Profile that maps the AD group to a specific role (e.g., superuser, read-only). The Authentication Profile is then attached to the management interface or to an administrator account, and the Admin Role Profile's 'Group' tab binds the AD group name to the role. This enforces that only authenticated users in 'Domain Admins' receive administrative privileges.

Answer

A custom decryption rule enforcing SAML client authentication.

Answer

A standard Security policy rule with an explicit user match condition.

Answer

A GlobalProtect Portal agent configuration.

Question 8

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

Accepted Answer

Trigger the 'Isolate Endpoint' action from the Cortex XDR Incident response tools.. Cortex XDR's incident response tools include a built-in 'Isolate Endpoint' action that can be triggered directly from an incident, immediately cutting the endpoint off from the network except for the Cortex XDR management channel. This is the correct automated response when a compromised account shows impossible-travel authentication, because isolating the host stops lateral movement and further exfiltration. The action is available in the incident response view and can also be automated via playbooks.

Answer

Change the Authentication Profile to drop Kerberos ticket grants.

Answer

Enable strict Zone Protection profiles on the local switch interface.

Answer

Apply a Global Protect Portal lockout via Panorama Device Groups.

Question 9

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password immediately or their account will be locked. The link leads to a website that looks identical to the company's login page. Which type of attack is this?

Accepted Answer

Phishing. The scenario describes a fraudulent email impersonating IT and directing the user to a fake login page, which is a classic phishing attack. Other variants like spear phishing, whaling, and vishing involve different targeting or mediums. The broad category of phishing best fits the described situation.

Answer

Vishing

Answer

Whaling

Answer

Spear phishing

Question 10

A network technician is configuring a small branch office where the ISP provides a single public IPv4 address. Multiple internal hosts must reach the internet simultaneously using that one address. Which technology should the technician implement?

Accepted Answer

Network Address Translation (NAT). NAT lets a router translate private internal addresses to a single public address, tracking each conversation by port so many hosts can share one connection. That matches the branch office situation exactly: the ISP supplies one public IPv4 address, but numerous devices need simultaneous internet access. VLANs, link aggregation, and STP solve segmentation, bandwidth, and loop problems, not address sharing.

Answer

Virtual LAN (VLAN) tagging

Answer

Link Aggregation (LACP)

Answer

Spanning Tree Protocol (STP)

Question 11

A network administrator is troubleshooting a connectivity issue between two hosts on the same VLAN. The hosts are connected to the same switch, but they cannot ping each other. The administrator suspects a Layer 2 problem. Which command should be used on the switch to verify the MAC address table and confirm that the switch has learned the MAC addresses of both hosts?

Accepted Answer

show mac address-table. To diagnose a Layer 2 connectivity issue between hosts on the same VLAN, the administrator should check the switch's MAC address table using the show mac address-table command. This verifies whether the switch has learned the MAC addresses and on which ports they reside. Other commands like show arp or show ip route operate at Layer 3 and are not relevant for this Layer 2 problem.

Answer

show ip route

Answer

show arp

Answer

show interface status

Question 12

An employee at a logistics firm plugs an unfamiliar USB drive found in the parking lot into a corporate laptop. Shortly afterward, the endpoint protection console reports that a process is attempting to encrypt files in the user's documents folder and rename them with a new extension. Which type of malware is MOST likely responsible?

Accepted Answer

Ransomware. Mass encryption of user files with renamed extensions is the hallmark of ransomware, and the removable-media delivery vector is a well-known initial infection path. Rootkits focus on stealth, keyloggers capture input, and worms focus on self-propagation, so none of those labels fits the file-encryption evidence seen in the console.

Answer

Worm

Answer

Rootkit

Answer

Keylogger

Question 13

A junior security analyst at a healthcare company receives a phone call from someone claiming to be the IT help desk. The caller says the analyst's VPN certificate is about to expire and asks the analyst to read back the six-digit code that just appeared in the analyst's authenticator app so the certificate can be renewed remotely. The analyst notices the caller ID shows an internal extension. What should the analyst do first?

Accepted Answer

End the call and verify the request through an independent, known-good channel such as the official help desk number directory.. The scenario is a voice phishing attempt targeting a one-time passcode that functions as a second authentication factor. No legitimate renewal process requires the user to read that code aloud, and caller ID can be spoofed. The safe response is to terminate the interaction and confirm the request through an independently verified help desk contact before taking any action.

Answer

Provide the code but only after asking the caller to state their employee ID and department name.

Answer

Transfer the caller to the security operations center while keeping the line open so the SOC can trace the call.

Answer

Read the six-digit code to the caller because the request came from an internal extension that appears trustworthy.

Question 14

A security analyst at a managed security service provider (MSSP) is triaging a phishing alert that was escalated from a customer's email gateway. The customer's environment includes Microsoft 365 and Palo Alto Networks Cortex XDR. The analyst needs to determine whether the potentially malicious URL in the email was ever clicked by any user in the customer's tenant. Which data source should the analyst query first to efficiently identify any user interaction with the URL?

Accepted Answer

Microsoft 365 Defender advanced hunting using the UrlClickEvents table to see which users clicked the URL and when.. Microsoft 365 Defender advanced hunting's UrlClickEvents table is specifically designed to log user clicks on URLs from emails, Teams messages, and other Office 365 services. It provides the necessary user and timestamp details to quickly determine if any user interacted with the malicious link. This is the most direct and efficient method in a Microsoft 365 environment, avoiding the need to correlate multiple disparate logs.

Answer

Cortex XDR incident view filtered by the email sender's address to identify related alerts.

Answer

Cortex XDR XQL query on the network_story dataset for DNS or HTTP events that match the URL's domain.

Answer

Palo Alto Networks WildFire analysis reports for the URL to see if it was submitted and determined malicious.

Question 15

Which TWO actions can a Security policy rule execute when traffic matches the rule criteria? (Choose two)

Accepted Answer

Deny. In a Security policy rule, the two possible actions that can be executed when traffic matches the rule criteria are Deny (A) and Allow (C). Allow (C) permits the matching traffic to pass through the firewall, and Deny (A) blocks the matching traffic; these are the only two actions a Security policy rule can take on matched traffic. The other options are not Security policy rule actions: Nat (B) is a separate NAT policy function, while Bridge (D) and Route (E) refer to interface or virtual router configuration modes, not rule actions.

Answer

Nat

Answer

Bridge

Answer

Route