Cybersecurity-Apprentice Practice Test 3 — 25 Questions

Question 1

A help desk technician receives a ticket stating that a Cortex XDR agent on a Windows laptop displays a red status in the console and the user cannot access the corporate VPN. The technician confirms the laptop has internet access and can browse external websites. The technician needs to restore the agent's management connection so the security team can see the device again. Which step should the technician take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confirm the Cortex XDR agent service is running and check whether the endpoint can resolve and reach the required cloud service hostnames.. With internet access confirmed, the most likely causes are a stopped agent service or blocked resolution and reachability of the Cortex XDR cloud hostnames. Checking the service and cloud endpoint reachability is quick, non-destructive, and directly restores the management connection so the security team can see the device.

Answer

Reimage the laptop and return it to the user with a fresh operating system image.

Answer

Uninstall the VPN client because it is likely conflicting with the Cortex XDR agent.

Answer

Disable Windows Update on the laptop to prevent driver changes from affecting the agent.

Question 2

An administrator configures a Security policy rule to block access to known malicious websites categorized by PAN-DB. Which profile must be attached to the rule?

Accepted Answer

URL Filtering Profile. URL Filtering profiles on Palo Alto Networks firewalls enforce category- and reputation-based blocking using PAN-DB, the cloud-hosted URL categorization database. To block access to sites categorized as malicious, the URL Filtering profile must be attached to the Security policy rule. Without it, the rule has no URL category enforcement mechanism.

Answer

WildFire Analysis Profile

Answer

Decryption Profile

Answer

Vulnerability Protection Profile

Question 3

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

Accepted Answer

Process execution events. The Cortex XDR agent collects rich endpoint telemetry for behavioral analytics and threat hunting, and process execution events (A) are core because they capture process creation, command lines, parent-child relationships, and related metadata used by the causality chain and Behavioral Threat Protection. Network connection events (B) are also collected, recording endpoint network activity such as connections, ports, and remote IPs so the agent can correlate network behavior with process activity for threat detection and investigation. File modification and creation events (C) are likewise collected, tracking file writes, creations, and related file operations that are essential for detecting malware drops, ransomware behavior, and persistence. The remaining options do not belong: physical datacenter environmental temperature readings (D) are facility/environmental monitoring data not gathered by an endpoint agent, and monitored Wi-Fi router SSID signal strengths (E) are wireless infrastructure metrics outside the Cortex XDR agent's endpoint telemetry scope.

Answer

Physical datacenter environmental temperature readings

Answer

Monitored Wi-Fi router SSID signal strengths

Question 4

A security analyst notices that a production Amazon RDS database is reachable from the internet on port 3306. The database sits in a private subnet, and the analyst must identify which configuration change most likely introduced this exposure. Which AWS component should the analyst review first?

Accepted Answer

The RDS security group inbound rules. Security groups are stateful instance-level firewalls, and an inbound rule that allows port 3306 from 0.0.0.0/0 is the classic cause of an RDS database becoming internet-reachable. Network ACLs, parameter groups, and backup retention do not grant network access in this manner, so the security group rules are the correct place to look first.

Answer

The RDS automated backup retention window

Answer

The RDS parameter group settings

Answer

The network ACL associated with the private subnet

Question 5

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?

Accepted Answer

Enable Causation Analysis and expanded forensic data collection in the Agent Settings profile for that endpoint group.. Cortex XDR's Causation Analysis and expanded forensic data collection, configured in the Agent Settings profile for the endpoint group, is the feature designed to capture detailed process, file, and network telemetry around a specific application's behavior. This gives the administrator the forensic data needed to determine whether the application's behavior is truly malicious or a false positive.

Answer

Increase the firewall packet capture buffer size to 1 GB.

Answer

Configure a URL filtering block page bypass.

Answer

Enable administrative debug logging on the local syslog server.

Question 6

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

Accepted Answer

URL Filtering Profile. URL Filtering Profiles are specifically designed to control web access by categorizing URLs and domains, allowing administrators to block access to known malicious, phishing, and other risky categories. When attached to a security rule that governs outbound web traffic, the profile enforces these block actions based on the destination URL. This directly addresses the requirement to prevent employees from visiting malicious and phishing domains.

Answer

Denial of Service (DoS) Protection Profile

Answer

File Blocking Profile

Answer

WildFire Analysis Profile

Question 7

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

Accepted Answer

In the Tag field of the Layer 2 interface configuration. For a Layer 2 subinterface on a Palo Alto Networks firewall, the VLAN tag is specified in the Tag field of the Layer 2 interface configuration. This field binds the subinterface to a specific 802.1Q VLAN ID so the firewall can process tagged frames correctly. The Tag field is the only place where the VLAN ID is defined for a Layer 2 subinterface.

Answer

Within the DHCP Server IP pool configuration

Answer

In the Virtual Router general settings

Answer

Inside the Zone Protection Profile assigned to the interface

Question 8

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. A Vulnerability Protection Profile is the correct feature because it inspects traffic against a signature database that includes reconnaissance and scanning signatures (e.g., port scans, host sweeps). Setting the action to drop or reset-both actively blocks the scanner rather than merely alerting. This directly addresses automated vulnerability scanning tools hitting the database server.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 9

A junior security analyst is learning about cloud security posture management (CSPM) with Prisma Cloud. The analyst asks a senior colleague to explain the primary purpose of CSPM. Which statement best describes the primary purpose of Prisma Cloud's CSPM capabilities?

Accepted Answer

To continuously monitor cloud environments for misconfigurations and compliance violations.. Prisma Cloud CSPM continuously monitors cloud environments for misconfigurations and compliance violations. It scans resources, evaluates them against policies and standards, and alerts on issues. This helps organizations identify and remediate risks like public buckets, open ports, and missing encryption, ensuring a secure and compliant cloud posture.

Answer

To encrypt data at rest in cloud storage services automatically.

Answer

To provide runtime protection for containers and hosts by blocking malicious processes.

Answer

To manage user identities and access permissions across multiple cloud providers.

Question 10

A security analyst is investigating a potential security incident in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user recently created a new access key. Which AWS service should the analyst query to find this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures all API activity in an AWS account, including IAM actions. To find who created an access key, the analyst can search CloudTrail logs for the CreateAccessKey event. Other services like AWS Config, GuardDuty, and IAM Access Analyzer serve different purposes and do not provide the necessary audit details.

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Answer

AWS Config

Question 11

A security team uses Prisma Cloud to monitor an AWS environment. They notice that a newly created S3 bucket is not appearing in Prisma Cloud's resource inventory. The bucket was created 10 minutes ago. The team confirms that the AWS account is onboarded and other resources are visible. What is the MOST likely reason for the delay?

Accepted Answer

Prisma Cloud performs periodic API-based scans, and the next scan has not yet run.. Prisma Cloud CSPM discovers resources by polling cloud provider APIs on a schedule. Newly created resources appear after the next scan cycle, which may take minutes to hours depending on configuration. A manual scan can be triggered to update inventory immediately. Permissions or region issues would cause broader visibility gaps, not a single delayed bucket.

Answer

The S3 bucket is in a region that is not enabled in the Prisma Cloud account settings.

Answer

Prisma Cloud requires an agent to be installed on the S3 bucket to collect data.

Answer

The IAM role used by Prisma Cloud lacks permission to list S3 buckets.

Question 12

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

Accepted Answer

The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.. The 'Discard due to zone mismatch' counter indicates that the packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state. In Palo Alto Networks firewalls, zones are used to enforce security policies, and if a packet ingresses on an interface in one zone but the routing or session lookup expects it to be in another zone, the firewall drops it. This counter specifically tracks such zone mismatches.

Answer

The security rule destination zone does not match the source zone.

Answer

The NAT policy is translating the packet to an unassigned IP address.

Answer

The Virtual Router has two default routes pointing to different interfaces.

Question 13

A security analyst is investigating a suspected network intrusion. The analyst needs to capture full packet payloads for offline analysis and has physical access to a SPAN port on a switch. Which tool should be used to capture the traffic?

Accepted Answer

tcpdump. tcpdump is a packet capture tool that can record full packet payloads from an interface, including a SPAN port, and save them to a pcap file. NetFlow, SNMP, and Syslog provide metadata or logs but not raw packet content. Therefore, tcpdump is the correct tool for capturing traffic for offline analysis.

Answer

Syslog

Answer

NetFlow

Answer

SNMP

Question 14

A SOC analyst is documenting an incident in which an attacker gained initial access through a phishing email and then created a new local administrator account on a compromised workstation. The analyst must record evidence that supports both the initial access vector and the persistence mechanism. Which TWO artifacts should the analyst collect to support the investigation? (Choose two.)

Accepted Answer

The original email headers and the URL from the phishing message. Documenting this intrusion requires evidence for each phase. The phishing email headers and URL establish the initial access vector, while Windows Security account-management events prove the rogue administrator account was created and identify the responsible actor. Asset tags and desktop appearance are inventory or cosmetic details, and memory from an uninvolved machine cannot speak to actions on the compromised host.

Answer

A full memory dump of the analyst's own triage laptop

Answer

The physical asset tag number of the compromised workstation

Answer

The workstation's current wallpaper and desktop shortcut layout

Question 15

An incident responder is investigating a suspected lateral movement attack where an attacker utilized stolen Kerberos tickets (Pass-the-Ticket). Which log source in Cortex XSIAM or Windows event collection is essential for detecting abnormal Kerberos service ticket requests (Event ID 4769)?

Accepted Answer

Windows Security Event Logs (specifically Event ID 4769 for Kerberos service tickets).. Event ID 4769 is generated on domain controllers whenever a Kerberos service ticket (TGS) is requested, and it is the authoritative record for detecting Pass-the-Ticket activity. Because Pass-the-Ticket abuses valid stolen TGS tickets rather than forging credentials, the only reliable detection point is the Kerberos service ticket request telemetry captured in the Windows Security Event Log. Cortex XSIAM ingests these Windows Security events via its Windows agent or broker, allowing correlation of anomalous 4769 patterns such as unusual service names, encryption downgrades (RC4), or source hosts that never performed a TGT request (4768).

Answer

Prisma Access Cloud DNS query logs.

Answer

PAN-OS GlobalProtect Gateway connection logs.

Answer

Cortex XDR Device Control logs for USB storage insertions.

Question 16

A network security engineer is configuring a new Palo Alto Networks firewall. The company policy requires that all outbound web traffic from the internal network be inspected for threats, but the firewall must not decrypt traffic to banking or healthcare websites due to privacy regulations. The engineer creates a decryption policy rule to exclude those categories. What should the engineer do next to ensure that the excluded traffic is still scanned for threats?

Accepted Answer

Apply a security profile group to the security policy rule that allows the traffic, and ensure the decryption policy rule has no decryption profile.. Threat inspection is performed by security profiles attached to security policy rules. Decryption policy rules only control whether traffic is decrypted. To inspect non-decrypted traffic, the security policy rule allowing that traffic must have the appropriate security profiles applied. The decryption policy rule should exclude the categories without a decryption profile.

Answer

Enable SSL decryption for all traffic and rely on the decryption profile to exempt those categories.

Answer

Attach a vulnerability protection profile to the decryption policy rule.

Answer

Create a separate security policy rule that denies all traffic to banking and healthcare categories.

Question 17

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). The three required parameters for a PAN-OS static route entry are the Route Name (E), the Destination subnet (D), and the Next-hop (C). Option E is correct because every static route in a Virtual Router must be given a unique name to identify it in the routing table and configuration. Option D is correct because a static route must specify the destination IP prefix (network/mask) that the route matches. Option C is correct because the route must define where to forward matching traffic, either via a next-hop IP address or an egress interface. Options A and B are incorrect because BGP AS numbers and OSPF Area IDs are parameters for dynamic routing protocols, not for a static route entry.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID

Question 18

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

Accepted Answer

Principle of Least Privilege. The Principle of Least Privilege (PoLP) states that users and applications should be granted only the minimum access rights necessary to perform their authorized tasks. This directly matches the question's description. PoLP is a foundational cybersecurity principle that reduces the attack surface and limits the potential damage from compromised accounts.

Answer

Zero Trust Architecture

Answer

Defense-in-Depth

Answer

Separation of Duties

Question 19

Which security control is primarily responsible for inspecting decrypted web traffic for known viruses, trojans, and worms entering the network?

Accepted Answer

Antivirus Profile. An Antivirus Profile on a next-generation firewall (e.g., Palo Alto Networks) is the security control specifically designed to inspect decrypted traffic streams for known viruses, trojans, and worms. It uses signature-based detection against a continuously updated threat database to identify and block malicious payloads as they traverse the firewall. This is distinct from URL, data, and zone protection profiles, which address different threat vectors.

Answer

Zone Protection Profile

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Question 20

Which TWO methods are valid ways to access the Command Line Interface (CLI) of a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Serial Console connection using a terminal emulator. Option A is correct because a serial console connection using a terminal emulator (typically 9600-8-N-1 on the console/RJ-45 or USB console port) provides direct out-of-band CLI access to the firewall, which is essential for initial configuration and recovery when network access is unavailable. Option D is correct because SSH to the firewall's management IP address on TCP port 22 is the standard in-band method for remotely accessing the CLI, and it is permitted only on the management interface per Palo Alto Networks' management-plane design. Option B is incorrect because FTP on port 21 is a file transfer protocol and does not provide an interactive CLI session. Option C is incorrect because Telnet is not a supported management protocol on Palo Alto Networks firewalls, and CLI management access is restricted to the management interface, not arbitrary data plane interfaces. Option E is incorrect because an HTTPS session on port 443 accesses the web-based management UI (PAN-OS web interface), not the Command Line Interface.

Answer

FTP file transfer session on port 21

Answer

Telnet connection to any data plane interface

Answer

HTTPS web browser session on port 443