Cybersecurity-Apprentice Practice Test 25 — 15 Questions

Question 1

A cloud security engineer is configuring Prisma Cloud's anomaly detection for user behavior in an AWS environment. The engineer wants to reduce false positives from legitimate administrative activity while still detecting credential compromise. Which action best supports this goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the User Behavior Analytics policy to learn normal activity over a baseline period and exclude known automation roles from anomaly evaluation.. Prisma Cloud User Behavior Analytics establishes a learned baseline for each identity and flags deviations from it. Excluding known automation and service roles from evaluation removes predictable high-volume activity that would otherwise trigger alerts, preserving sensitivity to genuine anomalies such as stolen credentials used from a new location or at an unusual time.

Answer

Disable all anomaly detection policies and rely solely on static IAM policy violations to detect credential misuse.

Answer

Increase the CloudTrail log retention period to 365 days so more historical data is available for investigations.

Answer

Set every anomaly detection policy to low severity so alerts are less disruptive to the security team.

Question 2

An enterprise firewall is experiencing high session utilization due to a distributed denial-of-service (DDoS) SYN flood attack targeting a public web server. Which feature on the Palo Alto Networks firewall should an administrator configure to protect the server from resource exhaustion?

Accepted Answer

A DoS Protection profile and policy specifying SYN flood rate-limiting thresholds.. A Palo Alto Networks DoS Protection profile is designed to detect and mitigate denial-of-service attacks, including SYN floods, by applying rate-limiting thresholds and other protections. Configuring a DoS Protection policy with SYN flood rate-limiting thresholds allows the firewall to limit the number of SYN packets per second to the web server, preventing session table exhaustion and resource exhaustion from the SYN flood.

Answer

A Data Filtering profile configured with credit card pattern matching.

Answer

A custom URL Filtering profile with block actions enabled for high-risk categories.

Answer

An SSL Decryption policy configured to strip certificates from inbound web traffic.

Question 3

A security engineer is deploying a Palo Alto Networks firewall in a hybrid cloud environment. The engineer needs to ensure that outbound traffic from the internal network to the internet is inspected for threats and that users are identified by their Active Directory credentials. The firewall is configured with a Trust zone for internal users and an Untrust zone for the internet. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure a Security policy rule from Trust to Untrust that includes a security profile group with antivirus, anti-spyware, and vulnerability protection.. To inspect outbound traffic for threats, a Security policy rule with security profiles is required. To identify users by Active Directory credentials, User-ID must be configured to map IP addresses to usernames. Together, these actions enable threat inspection and user-based policy enforcement for internet-bound traffic.

Answer

Create a NAT policy that translates all Trust zone source addresses to the firewall's Untrust interface address.

Answer

Set up a dedicated management interface in the Management zone and restrict access to it via a Security policy rule.

Answer

Configure a Decryption policy to decrypt all outbound SSL traffic and attach a security profile to the decryption rule.

Question 4

An analyst notices that a specific URL is incorrectly categorized by the Palo Alto Networks URL Filtering database (BrightCloud/PAN-DB). What is the appropriate procedure to request a re-categorization of this URL?

Accepted Answer

Submit a URL categorization review request directly through the Palo Alto Networks URL Filtering review site.. Palo Alto Networks maintains the URL categorization database (PAN-DB) and provides a public review portal where anyone can submit a URL for re-categorization if it is misclassified. Submitting through this official review site triggers a human/automated review, and if approved, the change propagates to firewalls on the next content update cycle. This is the documented, supported procedure for correcting categorization errors.

Answer

Delete all local threat intelligence feeds from the Panorama server.

Answer

Reinstall the firewall firmware to factory default settings.

Answer

Manually edit the PAN-OS kernel routing table.

Question 5

An administrator is designing a Zero Trust network architecture on a Palo Alto Networks firewall. Which TWO best practices should be implemented in the Security policy rulebase? (Choose two)

Accepted Answer

Attach security profiles (Antivirus, Anti-Spyware, Vulnerability Protection) to all allowed traffic rules.. Option B is correct because Zero Trust requires inspecting all permitted traffic, and attaching Antivirus, Anti-Spyware, and Vulnerability Protection security profiles to every allow rule enforces content-level threat prevention rather than trusting traffic based on zone or subnet. Option D is correct because replacing broad port-based rules with explicit App-ID and User-ID based rules enforces least-privilege access by identifying the actual application and the specific user, which is the core of Zero Trust policy in the Palo Alto rulebase. Option A is wrong because bypassing inspection for internal zone-to-zone traffic violates Zero Trust's assume-breach model and leaves lateral movement uninspected. Option C is wrong because relying solely on IP subnet boundaries is traditional perimeter trust, not Zero Trust, which requires identity and application context. Option E is wrong because an inclusive any-any allow rule at the bottom permits all unclassified traffic, directly contradicting least-privilege and implicit-deny principles.

Answer

Bypass inspection for internal zone-to-zone traffic to improve network performance.

Answer

Rely exclusively on IP subnet boundaries for perimeter isolation.

Answer

Create an inclusive 'any-any' allow rule at the bottom of the rulebase for unclassified traffic.

Question 6

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agent installation on Windows requires specific OS-level prerequisites, including servicing stack updates and the Universal C Runtime (UCRT) libraries, which many older or unpatched Windows builds lack. When a GPO push fails with a missing-prerequisites error, verifying these dependencies on target endpoints is the correct first step.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.

Question 7

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Cortex XDR agents report quarantine actions to the Cortex XDR management console, where administrators can review them under Incident Response > Action Center or the Endpoint Management quarantine tab. These views show the file hash, path, endpoint, and the action taken (quarantined, blocked, allowed), providing full auditability of endpoint response actions.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 8

An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?

Accepted Answer

AWS IAM Credential Report and Cloud Provider Asset Configuration Metadata. Prisma Cloud's CSPM (Cloud Security Posture Management) engine detects unused IAM access keys by ingesting the AWS IAM Credential Report — a native AWS report that lists every IAM user, key age, last-used date, and rotation status — and correlating it with Cloud Provider Asset Configuration Metadata collected via read-only API calls. The combination of credential lifecycle data plus resource configuration context is what allows Prisma Cloud to flag keys that exist but have never been used or have not been used within a policy-defined window (e.g., 90 days).

Answer

Container runtime audit logs captured by Admission Controllers

Answer

Flow logs captured by VM-Series virtual firewalls

Answer

WildFire cloud sandbox behavioral analysis reports

Question 9

An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?

Accepted Answer

Device > Admin Roles. Custom Admin Roles in PAN-OS are configured under Device > Admin Roles, where an administrator defines a role name and then selects granular permissions across functional areas (e.g., Policies, Objects, Network, Device, Privacy) and read/write levels. This is the only location that lets you create role-based access control (RBAC) tailored to least privilege for firewall administrators.

Answer

Policies > Access Control

Answer

Device > Setup > Management

Answer

Device > Authentication Profile

Question 10

A network engineer is troubleshooting an issue where a Palo Alto Networks firewall is not installing a static route into the virtual router's forwarding table. The route is configured with a next-hop IP address that is not directly connected to any interface on the firewall. What is the most likely reason the route is not active?

Accepted Answer

The static route's next-hop IP address must be reachable via a connected or other active route for the static route to be installed.. For a static route to be installed in the virtual router's forwarding table, its next-hop must be reachable through an existing active route. If the next-hop is not directly connected and no other route provides a path to it, the static route stays inactive. Ensuring next-hop reachability, often via a connected or default route, is essential for the route to take effect.

Answer

Static routes with a next-hop that is not directly connected are always rejected and must use an interface instead.

Answer

The virtual router must have OSPF enabled for any static route with an indirect next-hop to become active.

Answer

The static route's administrative distance is too high and must be lowered to 1 for the route to be installed.

Question 11

A hospital's IT team is classifying its information assets. A patient-record database stores names, dates of birth, insurance identifiers, and treatment notes. The compliance officer asks the apprentice to label the sensitivity of this data. Which classification best fits this data set?

Accepted Answer

Confidential data, because it contains regulated personally identifiable information. The data set combines identifiers such as name, date of birth, and insurance number with health details, which makes it regulated personally identifiable and protected health information. That data demands the strongest handling controls, so the confidential classification is appropriate. Public, internal, and declassified labels either ignore the privacy harm of exposure or belong to a government classification scheme that does not apply to a hospital's clinical records.

Answer

Declassified data, because the records have already been reviewed by clinicians

Answer

Internal data, because only hospital employees ever access the system

Answer

Public data, because patients may request copies of their own records

Question 12

A security analyst is investigating a potential data exfiltration incident on a Windows endpoint. The analyst wants to collect forensic data from the endpoint, including running processes, network connections, and registry keys, without disrupting the user's work. Which Cortex XDR response action should the analyst use to gather this information remotely?

Accepted Answer

Collect endpoint forensic data. The 'Collect endpoint forensic data' response action is specifically built for remotely gathering forensic artifacts from an endpoint without disrupting the user. It collects a predefined set of data including processes, network connections, and registry keys, making it ideal for this scenario.

Answer

Initiate a live terminal session

Answer

Isolate the endpoint

Answer

Run a script

Question 13

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large outbound transfer to an unknown IP address over port 443. The analyst wants to determine if this is malicious. Which of the following actions should the analyst perform FIRST to gather more context?

Accepted Answer

Check the reputation of the destination IP using threat intelligence sources.. The first step should be to gather context without disrupting the environment. Checking the destination IP's reputation via threat intelligence is quick, non-intrusive, and can immediately indicate if the transfer is likely malicious. Blocking, packet capture, or user interviews are either premature or less efficient for initial triage.

Answer

Block the IP address at the firewall to stop the transfer.

Answer

Interview the user associated with the source IP to ask about the transfer.

Answer

Capture full packet capture of the traffic for later analysis.

Question 14

An administrator needs to ensure that users cannot upload sensitive corporate data containing specific credit card patterns to external cloud storage. Which security profile meets this requirement?

Accepted Answer

Data Filtering Profile. The Data Filtering Profile on Palo Alto Networks firewalls is specifically designed to inspect and control the content of files being uploaded or downloaded, including the ability to detect and block sensitive data patterns such as credit card numbers (matching PCI DSS patterns), Social Security numbers, and custom regex patterns. It operates on file content within allowed applications, making it the correct profile to prevent users from uploading sensitive corporate data containing credit card patterns to external cloud storage.

Answer

URL Filtering Profile

Answer

WildFire Analysis Profile

Answer

Antivirus Profile

Question 15

A company wants to protect its web application from attackers who try to inject malicious scripts that would execute in the browsers of other users viewing the application. Which security control should be implemented to mitigate this risk?

Accepted Answer

Input validation and output encoding. Cross-site scripting is mitigated primarily by properly validating input and encoding output so that user data is not interpreted as code. A WAF can help but is not sufficient alone. Encryption and MFA address different security concerns and do not prevent script injection.

Answer

Secure Sockets Layer (SSL) certificate

Answer

Multi-factor authentication (MFA)

Answer

Web application firewall (WAF) in blocking mode