Cybersecurity-Apprentice Practice Test 2 — 25 Questions

Question 1

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The two hosts are on different IP subnets and require a router or Layer 3 device to communicate. IP communication depends on subnet boundaries, not physical topology. Hosts on 172.16.5.0/24 and 172.16.6.0/24 are on separate logical networks even when cabled to the same switch. A host forwards off-subnet traffic to its default gateway, so without a router or Layer 3 switch providing inter-subnet routing, the two hosts cannot exchange packets. Confirming subnet membership and the presence of a Layer 3 path is essential before blaming switching or ACLs.

Answer

The switch is blocking traffic because the MAC address table has not learned the server's MAC address

Answer

The server's /24 mask is too large and causes it to treat the workstation as local

Answer

The workstation is using the wrong default gateway, which prevents ARP from resolving the server

Question 2

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

Accepted Answer

An incorrect peer AS number or incorrect peer IP address configuration. BGP peers stuck in the Idle state means the router has not even begun the TCP connection or has repeatedly failed to establish one, which most commonly results from a misconfigured peer IP address or peer AS number. If the peer address is wrong, the TCP session to port 179 never forms; if the peer AS number is wrong, the OPEN message is rejected and the session tears down back to Idle. Both are fundamental peer configuration errors that prevent the BGP finite state machine from progressing.

Answer

An AS-path loop detection trigger

Answer

MD5 authentication password mismatch during OPEN message exchange

Answer

BGP route reflection timer expiration

Question 3

A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?

Accepted Answer

The technique is code injection, and the agent blocked the write operation and may have terminated the injecting process.. Writing to another process's memory is a hallmark of code injection, often used by malware to execute code in the context of a trusted process. Behavioral Threat Protection detects this activity and can block the write operation, preventing the injection. Depending on the configured policy, the agent may also terminate the injecting process. The other options misidentify the technique or the agent's response.

Answer

The technique is privilege escalation, and the agent escalated the alert to the cloud for analysis.

Answer

The technique is DLL side-loading, and the agent quarantined the DLL file.

Answer

The technique is process hollowing, and the agent terminated the target process.

Question 4

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

Accepted Answer

172.16.10.32 and 172.16.10.63. With a subnet mask of 255.255.255.224 (/27), the subnet increment is 32. The address 172.16.10.33 falls within the subnet starting at 172.16.10.32. Therefore, the network address is 172.16.10.32 and the broadcast address is 172.16.10.63. The correct answer is 172.16.10.32 and 172.16.10.63.

Answer

172.16.10.0 and 172.16.10.31

Answer

172.16.10.0 and 172.16.10.63

Answer

172.16.10.33 and 172.16.10.62

Question 5

A new security analyst at a retail company receives a help desk ticket stating that an employee clicked a link in an email and a browser window opened asking for their corporate username and password. The page looks identical to the company's single sign-on portal, but the URL is misspelled. The analyst must classify this event. Which category BEST describes this activity?

Accepted Answer

Phishing. The deceptive email link and counterfeit single sign-on page are designed to capture the employee's credentials, which is the defining behavior of phishing. The other categories describe availability attacks, post-compromise escalation, or database manipulation, none of which match the evidence. Correct classification drives the proper response: reset the user's credentials, block the URL, and reinforce awareness training.

Answer

Denial of service

Answer

SQL injection

Answer

Privilege escalation

Question 6

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. DNS-based C2 is detected and blocked by the Anti-Spyware profile, which includes DNS sinkhole functionality. When a DNS query matches a known malicious domain in the Palo Alto DNS signature database, the firewall can sinkhole the response (returning a bogus IP) to prevent the internal host from reaching the C2 server. Attaching the Anti-Spyware profile to the security rule enables this automatic blocking.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 7

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

Accepted Answer

Apply policy tags to group related policies and use those tags in alert rules to control which findings are surfaced to each business unit.. Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Answer

Disable all policies that have not generated an alert in the last 30 days to reduce the number of active policies.

Answer

Increase the scan frequency of the cloud accounts to every five minutes so that duplicate alerts are generated for each scan cycle.

Answer

Enable auto-remediation for every high-severity policy so that all findings are fixed without human review.

Question 8

A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?

Accepted Answer

Private IP addresses. The 192.168.1.0/24 range falls within the RFC 1918 private address space, specifically 192.168.0.0/16. Private addresses are not routable on the public Internet and require network address translation to communicate externally. Public addresses are globally routable, multicast addresses serve groups, and loopback addresses refer to the local host, so only the private designation fits the administrator's observation.

Answer

Public IP addresses

Answer

Multicast addresses

Answer

Loopback addresses

Question 9

A junior security analyst is reviewing Prisma Cloud alerts for an Amazon S3 bucket that was made publicly accessible. The analyst needs to quickly understand the potential impact and prioritize remediation. Which Prisma Cloud capability should the analyst use first?

Accepted Answer

The alert's resource configuration details and the associated compliance standard violations.. Prisma Cloud alerts include the offending resource's configuration and the compliance standards it violates, which directly answer what is wrong and why it matters. This built-in context lets an analyst triage a public S3 bucket quickly, determine business impact, and decide on remediation steps without switching to external tools.

Answer

The Prisma Cloud Compute radar view to inspect the bucket's container image layers.

Answer

The AWS Cost Explorer to determine whether the bucket is incurring unexpected charges.

Answer

The AWS Trusted Advisor console to view the S3 bucket permissions check.

Question 10

A small company runs its customer web portal on a single Amazon EC2 instance. The security lead must decide who is responsible for patching the guest operating system, according to the AWS shared responsibility model. Who is responsible?

Accepted Answer

The customer, because the customer controls the guest operating system, applications, and data on the instance.. Under the AWS shared responsibility model, AWS is responsible for security of the cloud (physical hosts, hypervisor, network), while the customer is responsible for security in the cloud. For a customer-managed EC2 instance, the guest operating system, applications, and data fall to the customer. Patching the guest OS is therefore the customer's obligation, not AWS's, a partner's, or a 50/50 split.

Answer

The AWS Support team, because the instance was launched from an AWS-provided Amazon Machine Image.

Answer

AWS, because EC2 is an Infrastructure as a Service offering and AWS manages the hypervisor and guest OS.

Answer

A shared 50/50 split, with AWS patching the kernel and the customer patching user-space applications.

Question 11

A Tier-1 SOC analyst is preparing to escalate a confirmed malware infection on a finance workstation to the Tier-2 team. Which TWO pieces of information are most essential to include in the escalation ticket to enable effective response? (Choose two.)

Accepted Answer

The affected host's name, IP address, and the user account currently logged in. A useful escalation must identify the affected asset and user, and it must convey the technical detection evidence so the responder can validate and scope the incident quickly. Host identifiers enable correlation and containment, while process tree, hashes, and C2 indicators provide the investigative starting point. Bulk data, environment inventories, and personal preferences do not advance response.

Answer

The full raw packet capture of all traffic from the workstation for the past 24 hours

Answer

A list of every security tool deployed across the entire organization and their version numbers

Answer

The analyst's personal opinion about which team member should handle the case

Question 12

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. Option B (Hello and Dead timer intervals) is correct because OSPF neighbors must agree on the Hello interval and Dead interval on the interface; mismatched timers prevent Hello packets from being accepted and the adjacency never reaches 2-Way/Full. Option D (Authentication type and password) is correct because if authentication is configured, both routers must use the same authentication type (e.g., MD5 or SHA) and matching key/password, otherwise OSPF packets fail authentication and are discarded. Option E (Area ID) is correct because two OSPF routers can only form an adjacency if their interfaces belong to the same OSPF area, since the Area ID is carried in the Hello packet and must match. Option A (Process ID) is not required to match because the OSPF process ID is locally significant to the router and is not carried in Hello packets. Option C (Router ID) is not required to match because each OSPF router must have a unique Router ID within the OSPF domain; duplicate Router IDs actually cause adjacency problems rather than being a requirement.

Answer

Process ID

Answer

Router ID

Question 13

A security administrator is configuring Cortex XDR agent settings for a group of Linux servers. The administrator wants to ensure that the agent does not interfere with a custom application that performs legitimate but unusual system calls, which are currently being flagged as malicious by the agent's behavioral threat protection. What should the administrator do to prevent the agent from blocking this application while maintaining security?

Accepted Answer

Create a Behavioral Threat Protection exception for the application's process name and hash.. Creating a Behavioral Threat Protection exception for the application's process name and hash is the correct approach. It allows the legitimate application to run without interference while keeping behavioral threat protection active for other processes. This balances security and functionality.

Answer

Add the application to the allow list in the Exploit Protection module.

Answer

Configure the agent to run in 'Report Only' mode for Behavioral Threat Protection.

Answer

Disable Behavioral Threat Protection entirely on the Linux servers.

Question 14

A small company is moving its first workload to Microsoft Azure and wants to use Prisma Cloud to monitor the environment. The administrator needs to grant Prisma Cloud read access to the Azure subscription so that it can collect resource configuration and evaluate policies. Which action should the administrator take?

Accepted Answer

Create an Azure service principal with a Reader role assignment on the subscription and provide its credentials to Prisma Cloud.. Onboarding an Azure subscription into Prisma Cloud requires an identity that can read resource configuration across the subscription. A service principal assigned the Reader role at the subscription scope provides exactly that read-only access through Azure Resource Manager, allowing Prisma Cloud to collect configuration and evaluate policies without granting permissions to change resources.

Answer

Generate a shared access signature token for the storage account and enter it into the Prisma Cloud console.

Answer

Assign the Global Administrator directory role to a user account and use that account for the Prisma Cloud integration.

Answer

Install the Prisma Cloud Compute Defender agent on every virtual machine in the subscription.

Question 15

A security analyst is reviewing a web server log and sees the following entry: `GET /products.php?id=1' OR '1'='1`. The analyst suspects an injection attack. Which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The payload `' OR '1'='1` is a textbook SQL injection attempt. It aims to alter the logic of a database query by injecting a tautology. The other attack types would involve different payloads and mechanisms, such as script tags for XSS, shell commands for command injection, or forged requests for CSRF.

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 16

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID inspection in PAN-OS security policy rules identifies applications regardless of port or protocol, including tunneling apps that disguise themselves as web traffic. By matching on the actual application signature rather than port 80/443, the firewall can detect and block the hidden tunnels.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 17

A SOC analyst is triaging a phishing report submitted by an employee. The email contains a link to a credential-harvesting page that mimics the organization's webmail portal. The analyst has confirmed the URL is malicious. Which action should the analyst take to protect other users while preserving evidence?

Accepted Answer

Add the malicious URL to the web proxy blocklist, hunt for other recipients, and reset credentials for users who clicked.. A confirmed phishing URL requires immediate containment that stops further clicks and remediates users who already submitted credentials. Blocking the URL, hunting for other recipients, and resetting compromised credentials accomplishes both goals while preserving evidence. Replying to the attacker, mass-forwarding the live email, or only blocking the sender domain leaves credential compromise unaddressed and can increase exposure.

Answer

Forward the phishing email to all employees as a training example and ask them to delete it.

Answer

Block the sender's domain at the email gateway and delete all copies of the message from user mailboxes.

Answer

Reply to the phishing email warning the sender to stop and ask them to remove the malicious link.

Question 18

A SOC analyst is reviewing a firewall log where an internal host repeatedly connected to an external IP address on TCP port 4444 every 60 seconds for several hours. The connections transferred only a few bytes each time. Which characteristic most strongly suggests this is command-and-control beaconing rather than normal user traffic?

Accepted Answer

The connections occur at a highly regular interval with small, consistent payloads. Command-and-control beaconing is defined by automation: the implant contacts its controller on a schedule and exchanges just enough data to receive instructions or confirm liveness. A fixed interval such as every 60 seconds combined with consistently small transfers is far more indicative than port choice, DNS usage, or hosting provider. Those contextual details can support an investigation, but the behavioral regularity is what elevates the traffic from benign to suspicious.

Answer

The external address belongs to a cloud hosting provider rather than an ISP

Answer

The destination port is a well-known service port such as 443

Answer

The internal host resolved the external address through DNS before connecting

Question 19

A security engineer is deploying a new containerized workload in a Kubernetes cluster that is monitored by Prisma Cloud Compute. The engineer needs to ensure that the container cannot escalate privileges by gaining additional capabilities beyond those explicitly granted. Which Kubernetes security context setting should be configured to meet this requirement?

Accepted Answer

Set allowPrivilegeEscalation to false in the container's securityContext.. The allowPrivilegeEscalation setting directly controls whether a process can gain more privileges than its parent. When set to false, it blocks common escalation techniques such as setuid binaries and file capabilities. Prisma Cloud Compute can enforce this setting through its runtime policies, ensuring containers adhere to least privilege.

Answer

Set readOnlyRootFilesystem to true in the container's securityContext.

Answer

Set privileged to true in the container's securityContext.

Answer

Set runAsNonRoot to true in the container's securityContext.

Question 20

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

Accepted Answer

Exploit Protection module monitoring common application memory spaces and blocking anomalous execution flows.. The Exploit Protection module in Cortex XDR monitors common application memory spaces (e.g., browsers, Office, Java) and blocks exploitation techniques such as memory corruption, ROP chains, and shellcode execution before a file is dropped. Because fileless attacks execute directly in memory via vulnerable services, Exploit Protection is specifically designed to detect and block these anomalous execution flows at the exploitation stage.

Answer

Scheduled weekly full disk scans using YARA rules.

Answer

Antivirus signature database matching against known file hashes.

Answer

Browser extension security hardening policies.