Cybersecurity-Apprentice Practice Test 2 — 25 Questions

Question 1

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. APT and zero-day protection relies on WildFire cloud sandbox analysis, DNS Security for malicious domain detection, and inline machine learning.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 2

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

Accepted Answer

To centralize log collection, event correlation, and security incident monitoring across disparate enterprise systems.. SIEM systems aggregate, correlate, and analyze log data from multiple sources across the enterprise to detect security incidents and provide audit trails.

Answer

To analyze unknown executable files in an isolated sandbox environment.

Answer

To automatically patch operating system vulnerabilities on endpoints.

Answer

To enforce inline packet inspection and drop malicious TCP packets.

Question 3

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. Vulnerability Protection profiles inspect traffic for known exploit signatures, including vulnerability scans and exploit attempts targeting servers.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 4

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data exfiltration is prevented using Data Filtering profiles, File Blocking profiles, and SSL Decryption to inspect encrypted egress traffic.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 5

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). A static route requires a destination subnet, a next-hop specification (IP address or interface), and a route name/destination identifier.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID

Question 6

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object (or Address Group) allows administrators to group IP addresses, subnets, or ranges under a single label for policy rules.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 7

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

Accepted Answer

An Authentication Profile combined with an Admin Role Profile mapping the AD group.. Integrating PAN-OS with LDAP/RADIUS or SAML using an Authentication Profile linked to an Admin Role Profile maps Active Directory groups to firewall management roles.

Answer

A custom decryption rule enforcing SAML client authentication.

Answer

A standard Security policy rule with an explicit user match condition.

Answer

A GlobalProtect Portal agent configuration.

Question 8

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Securing the management plane involves restricting administrative access via Management Profile source IP whitelisting and ensuring strong administrative authentication settings.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 9

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Quarantined items can be managed and reviewed directly from the Cortex XDR management console under Incident Response or Endpoint views.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 10

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

Accepted Answer

In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.. Cortex XDR allows administrators to create profile exceptions based on hash or behavioral exception rules for specific trusted scripts.

Answer

Change the Agent settings to bypass all SSL decryption rules.

Answer

Disable the Local Analysis module entirely for the target endpoint group.

Answer

Modify the Windows Firewall inbound rules on the local endpoint.

Question 11

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles are configured under Device > Server Profiles > Syslog in the PAN-OS management interface.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 12

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Tier-1 analysts focus on initial alert triage, alert verification, running basic playbooks, and escalating verified threats to Tier-2.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 13

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

Accepted Answer

Check that the connection status shows Connected with a recent heartbeat timestamp.. The connection status in Endpoint Management indicates whether the agent has an active, healthy TLS session with the backend server.

Answer

Ensure the endpoint operating system is running the latest patch level.

Answer

Confirm that the kernel module version matches the BIOS version.

Answer

Verify that the local disk usage is below 10 percent.

Question 14

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

Accepted Answer

Objects > Applications > [Application Name], modifying TCP timeout settings. Application timeouts can be customized under Objects > Applications by creating or editing an application override, or by modifying timeout settings in Device > Setup > Session.

Answer

Network > Interfaces > Advanced > TCP Timeout

Answer

Policies > Security > Timeout Profile

Answer

Device > Setup > Management > Session Settings

Question 15

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agents require specific Windows OS patches (such as Universal C Runtime updates) and proper MSI execution privileges.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.

Question 16

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Accepted Answer

An MTU mismatch between the OSPF neighbors. Being stuck in EXSTART/EXCHANGE state in OSPF typically points to a mismatch in Maximum Transmission Unit (MTU) sizes across the link or interface configuration errors.

Answer

A mismatch in OSPF area ID types (e.g., normal vs. stub)

Answer

Incorrect OSPF hello or dead timer intervals

Answer

Authentication type or password mismatch

Question 17

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures usually stem from expired certificates, SSL inspection proxies intercepting traffic without proper root CA trust, or incorrect proxy settings.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 18

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Accepted Answer

By deploying a compatible legacy agent version that supports older OS APIs while providing core malware and exploit prevention.. Cortex XDR supports legacy operating systems with specific legacy agent versions that provide core prevention capabilities supported by those OS architectures.

Answer

By forcing an automatic in-place upgrade of the legacy Windows server to Windows 11.

Answer

By routing all legacy server traffic through a next-generation firewall proxy instead of installing an agent.

Answer

By disabling all security checks for servers older than five years.

Question 19

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

Accepted Answer

Provides a standardized industry terminology for describing adversary tactics and techniques.. MITRE ATT&CK mapping provides a common framework for understanding adversary tactics, standardizing incident reports, and identifying security coverage gaps.

Answer

Automatically recompiles malicious binary code into safe executable patches.

Answer

Directly replaces the need for endpoint firewalls and network segmentation.

Question 20

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. OSPF neighbors must have matching Area ID, Hello/Dead intervals, and authentication parameters (if enabled) to form an adjacency.

Answer

Process ID

Answer

Router ID