Cybersecurity-Apprentice Practice Test 3 — 25 Questions

Question 1

An administrator is setting up a Site-to-Site IPsec VPN tunnel on a Palo Alto Networks firewall. The VPN tunnel comes up, but traffic from the local subnet cannot reach the remote subnet. Upon checking the IPsec SA status, the phase 2 security associations are active. What is the most likely cause of the traffic failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A mismatch in Proxy IDs between the local and remote peers. IPsec Phase 2 SAs being active means the tunnel is established, but if traffic fails, proxy IDs (or IKEv2 selectors) might not match, or security rules/routing are misconfigured.

Answer

Lifetime expiration in Phase 1 negotiation

Answer

DHCP relay configuration on the tunnel interface

Answer

Phase 1 Encryption algorithm mismatch (e.g., AES-256 vs AES-128)

Question 2

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

Accepted Answer

VLAN tagging and subinterface bindings on the Virtual Wire object. Virtual Wire objects support VLAN normalization or VLAN tagging options, and subinterfaces or VWire tags must match expected frame tags.

Answer

DHCP relay agent configuration

Answer

Virtual Router next-hop IP addresses

Answer

NAT Destination translation rules

Question 3

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles utilize PAN-DB to categorize and control web browsing traffic.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 4

An administrator needs to test DNS resolution from the Palo Alto Networks firewall command line interface (CLI) to ensure the management plane can reach external name servers. Which command should be used?

Accepted Answer

ping host [hostname]. The 'ping host' or operational command utility allows testing connectivity and DNS resolution from the firewall.

Answer

test dns-server [hostname]

Answer

nslookup target [hostname]

Answer

show dns-cache

Question 5

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

Accepted Answer

Static IP. Source NAT translation can utilize dynamic IP and port (DIPP), dynamic IP, or static IP configurations.

Answer

VLAN Subinterface Tag

Answer

Port Forwarding Pool

Question 6

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

Accepted Answer

SAML. PAN-OS supports multiple authentication methods including RADIUS, LDAP, SAML, Kerberos, and local database authentication.

Answer

IPsec Pre-Shared Key exchange exclusively without user credentials

Answer

WPA3 Enterprise 802.1X

Answer

SNMPv3 localized USM passwords

Question 7

A network security analyst is troubleshooting intermittent packet drops on a high-speed trunk interface connected to a core switch. The interface is configured as Layer 3 with 1 Gbps speed and full duplex. The switch port is also set to 1 Gbps full duplex. However, FCS (Frame Check Sequence) errors are incrementing rapidly. What is the most probable cause?

Accepted Answer

Physical layer issues such as damaged cabling, bad SFP transceivers, or electromagnetic interference. Incrementing FCS errors and CRC errors on an Ethernet interface typically indicate physical layer issues such as bad cabling, duplex mismatches (though both set to full), or physical media degradation.

Answer

An incorrect Zone Protection Profile flooding threshold

Answer

A mismatch in Virtual Router metric values

Answer

Incorrect TCP MSS adjustment on the Layer 3 interface

Question 8

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

Accepted Answer

A metric higher than 10 (e.g., 20). To configure a backup static route (floating static route), the metric/preference value must be higher than the primary route.

Answer

A metric lower than 10 (e.g., 5)

Answer

A metric of 0

Answer

The exact same metric of 10 to enable equal-cost multi-path (ECMP)

Question 9

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

Accepted Answer

App-ID based Security policy rules. App-ID allows administrators to identify and control specific applications regardless of port and protocol, making it the correct choice for application-level restrictions.

Answer

Static routing tables

Answer

MAC address ACLs

Answer

Port-based IP/Port filtering rules

Question 10

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

Accepted Answer

The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.. A 'zone mismatch' drop indicates that the packet's incoming interface does not belong to the security zone expected by the session or route lookup.

Answer

The security rule destination zone does not match the source zone.

Answer

The NAT policy is translating the packet to an unassigned IP address.

Answer

The Virtual Router has two default routes pointing to different interfaces.

Question 11

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Accepted Answer

The next-hop IP address advertised by the BGP peer is unreachable in the routing table.. BGP route selection depends on attributes like weight, local preference, AS-path length, origin, and MED. If a route is not best, it fails one of these decision criteria or has an unreachable next hop.

Answer

The firewall's management plane CPU is exceeding 90% utilization.

Answer

The BGP peer is configured in a different autonomous system.

Answer

The Virtual Router does not have OSPF enabled.

Question 12

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS profile and QoS policy rule are applied on the egress physical interface where traffic leaves the firewall, to manage bandwidth allocation properly.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 13

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 14

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

Accepted Answer

Active sessions are synchronized to the passive peer, allowing seamless traffic continuity without dropping connections.. With HA session synchronization enabled, active stateful TCP and UDP sessions are synchronized to the peer firewall, preventing dropped connections during a failover.

Answer

All active user sessions are immediately terminated and must re-authenticate.

Answer

Management IP addresses are duplicated on both units simultaneously.

Answer

The passive firewall boots up from power-off state to take over.

Question 15

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

Accepted Answer

Reset the user password in Active Directory via integration command.. Compromised credential playbooks typically involve resetting the user's password in Active Directory, revoking active sessions, and notifying the user or manager.

Answer

Factory reset all enterprise core routing switches.

Answer

Format the physical hard drive of the Active Directory Domain Controller.

Question 16

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' CLI command allows administrators to simulate or test source, destination, user, and application parameters against the security policy rules.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions

Question 17

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

Accepted Answer

Offloading security profile pattern matching to dedicated hardware security processors (ASICs/FPGAs).. Hardware offloading and dedicated Single-Pass Parallel Software Architecture (SP3) or hardware acceleration processors (such as security processors on higher-end firewalls) handle signature and pattern matching efficiently.

Answer

Disabling stateful inspection globally across all zones.

Answer

Converting all Layer 3 interfaces to loopback interfaces.

Answer

Configuring static routing to bypass the dataplane entirely.

Question 18

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

Accepted Answer

A Decryption policy rule configured with the 'Forward Proxy' action.. SSL Forward Proxy requires a Decryption policy rule, a Decryption profile (with Forward Proxy action), and a trusted Forward Trust Certificate signed by an internal CA.

Answer

An external BGP routing peer for prefix exchange.

Answer

A GlobalProtect Gateway license installed on the management plane.

Question 19

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID uses application decoding, heuristics, and signature matching to identify apps regardless of port, and App-ID signatures accurately detect tunneling protocols.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 20

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

Accepted Answer

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.. App-ID initially identifies traffic based on initial packets (port/heuristics), and as payload decryption or deeper signature inspection occurs (e.g., SSL handshake or HTTP parsing), App-ID re-evaluates and updates the session application.

Answer

The firewall rebooted mid-session, causing the application cache to reset.

Answer

Static routing tables dynamically updated the next-hop gateway.

Answer

NAT rules translated the source port, forcing an application renegotiation.