Cybersecurity-Apprentice Practice Test 4 — 25 Questions

Question 1

A Tier-1 SOC analyst receives an alert from the SIEM indicating a possible brute-force attack against the domain controller. The analyst needs to follow the standard incident response process. According to NIST SP 800-61, which phase of the incident response lifecycle involves determining whether an event is actually an incident and its scope?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detection and Analysis. The Detection and Analysis phase is where analysts validate alerts, determine if an event qualifies as an incident, and assess its scope. This matches the scenario where the analyst must decide if the brute-force alert is a real incident. Other phases occur before or after this critical validation step.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 2

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

Accepted Answer

To automatically analyze unknown files and samples submitted by endpoints to determine if they are malicious.. WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service. Within Cortex XDR, it automatically detonates and analyzes unknown files and samples submitted by endpoints in a sandboxed environment, returning verdicts (malicious, benign, grayware) and generating signatures that are shared across the ecosystem. This gives endpoints protection against zero-day and evasive malware that signature-based detection would miss.

Answer

To provide local disk defragmentation services.

Answer

To enforce multi-factor authentication for endpoint login sessions.

Answer

To manage firewall security policies across multiple tenants.

Question 3

A SOC analyst is investigating a potential data exfiltration incident. The analyst observes that a workstation has been communicating with an external IP address using DNS queries that contain long, random-looking subdomains. The volume of these queries is high, and the subdomains change frequently. Which type of attack is most likely occurring?

Accepted Answer

DNS tunneling for data exfiltration. The scenario describes a workstation sending numerous DNS queries with long, random subdomains to an external IP. This behavior is typical of DNS tunneling, where attackers encode stolen data into DNS queries to bypass network defenses. The high volume and changing subdomains indicate data exfiltration over DNS, making DNS tunneling the most likely attack.

Answer

Domain Generation Algorithm (DGA) communication

Answer

Fast flux DNS

Answer

DNS cache poisoning

Question 4

A cloud security analyst is reviewing the shared responsibility model for a public cloud environment. The analyst needs to identify which security tasks are the responsibility of the cloud customer. Which of the following is a customer responsibility?

Accepted Answer

Configuring security groups and network ACLs. In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes configuring virtual network controls like security groups and network ACLs. The provider is responsible for security 'of' the cloud, including physical and infrastructure security.

Answer

Patching the hypervisor and host operating system

Answer

Maintaining the global network backbone

Answer

Managing the physical security of data centers

Question 5

Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)

Accepted Answer

Apple macOS. The standard Cortex XDR agent is officially supported on Apple macOS (option C), since Palo Alto Networks provides a native macOS endpoint agent for both Intel and Apple Silicon systems. It is also officially supported on Microsoft Windows 10 and Windows 11 (option D), which are core supported desktop platforms for the Cortex XDR agent. Options A and B are incorrect because embedded automotive CAN bus microcontrollers and commercial airliner avionics flight control firmware are specialized real-time/embedded environments not supported by the standard Cortex XDR agent. Option E is incorrect because consumer smart refrigerator operating systems are embedded IoT platforms outside the agent's supported OS matrix.

Answer

Embedded automotive CAN bus microcontrollers

Answer

Commercial airliner avionics flight control firmware

Answer

Consumer smart refrigerator operating systems

Question 6

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

Accepted Answer

Offloading security profile pattern matching to dedicated hardware security processors (ASICs/FPGAs).. Offloading security profile pattern matching to dedicated hardware such as ASICs or FPGAs moves regex inspection off the general-purpose dataplane CPU, dramatically reducing utilization while maintaining inspection depth. Supported PAN-OS hardware models include dedicated security processors specifically designed for this workload. This is the correct optimization for CPU spikes caused by extensive regex inspections.

Answer

Disabling stateful inspection globally across all zones.

Answer

Converting all Layer 3 interfaces to loopback interfaces.

Answer

Configuring static routing to bypass the dataplane entirely.

Question 7

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

Accepted Answer

show counter global filter packet-drop yes. The command 'show counter global filter packet-drop yes' displays global counters related to packet drops in real time, allowing the administrator to see if the firewall is dropping packets and the reason (e.g., security policy deny, threat, etc.). This is the standard PAN-OS CLI troubleshooting command for verifying drop counters. It filters the global counter output to show only drop-related counters, which is exactly what is needed to diagnose a security rule denial.

Answer

show system resources

Answer

show session all

Answer

show interface all

Question 8

A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?

Accepted Answer

BIOC alerts detect suspicious sequences of system events and behaviors rather than matching known file signatures.. BIOC (Behavioral Indicator of Compromise) alerts are generated by the Cortex XDR Behavioral Analytics engine, which correlates sequences of endpoint events (process creation, file writes, registry changes, network connections) against behavioral rules rather than static file signatures. This allows detection of fileless malware, living-off-the-land techniques, and novel attack chains that signature-based AV would miss. Standard malware alerts, by contrast, rely on hash or signature matching.

Answer

BIOC alerts are generated exclusively by network firewall threat logs.

Answer

BIOC alerts only trigger when a user manually initiates a full system scan.

Answer

BIOC alerts require an active WildFire cloud subscription to function locally.

Question 9

A network engineer is analyzing a packet capture and observes that a workstation sends a TCP segment with the SYN flag and a destination port of 443 to a web server. The server responds with SYN-ACK, and the workstation completes the handshake with ACK. Shortly after, the workstation sends a segment with the RST flag. Which statement best describes what the RST segment indicates in this scenario?

Accepted Answer

The workstation is abruptly terminating the TCP connection or rejecting further data.. The RST flag in TCP signals an abrupt reset, terminating a connection or rejecting traffic. After a successful three-way handshake, a RST from the workstation means it is closing the session immediately or refusing further segments, often due to an application crash or a packet arriving at a closed port. FIN, by contrast, indicates graceful closure, and retransmissions or TLS negotiation use different mechanisms entirely.

Answer

The workstation is retransmitting a lost segment to the server.

Answer

The workstation is requesting a graceful, orderly shutdown of the session.

Answer

The workstation is negotiating encryption parameters for the session.

Question 10

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. WildFire forwards a sample only when the firewall cannot identify the file by hash in the WildFire global cloud cache and the file type matches the forwarding rules configured in the WildFire analysis profile. This prevents redundant uploads of already-known files and limits submissions to file types the administrator has explicitly enabled (e.g., PE, PDF, Office, APK). The firewall computes the SHA-256 hash, checks the local cache and the WildFire cloud, and only uploads on a cache miss.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 11

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

Accepted Answer

Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.. SSL Forward Proxy decryption is the Palo Alto feature designed to inspect outbound HTTPS traffic from internal users. The firewall acts as a man-in-the-middle: it presents a certificate signed by its Forward Trust Certificate to the client, then establishes its own TLS session to the destination server. For browsers to accept this substitution silently, the Forward Trust Certificate (or its issuing CA) must be installed as a trusted root in the client trust stores.

Answer

Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.

Answer

Deploy SSH Proxy decryption rules to intercept TLS handshakes.

Answer

Enable SSL Inbound Inspection using the public certificate of the destination web server.

Question 12

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

Accepted Answer

Prisma Cloud Cloud Security Posture Management (CSPM) Compliance Dashboard. Prisma Cloud's Cloud Security Posture Management (CSPM) Compliance Dashboard is purpose-built to continuously assess cloud resources across AWS, Azure, GCP, and others against regulatory and industry standards including HIPAA, PCI-DSS, GDPR, and CIS Benchmarks. It surfaces misconfigurations such as unencrypted storage buckets and maps them to specific compliance controls, giving the compliance officer out-of-the-box reporting.

Answer

WildFire threat intelligence feed

Answer

Prisma Cloud Application Security IDE Plugin

Answer

Prisma Access Cloud Secure Web Gateway

Question 13

During a routine audit, a SOC supervisor wants to ensure that all administrative logins to Panorama and managed firewalls are centrally tracked and securely archived. Which log type in the PAN-OS logging architecture records administrator login sessions and configuration changes?

Accepted Answer

Configuration and System logs.. In PAN-OS, Configuration logs record administrator configuration changes, and System logs record administrator login/logout sessions and system events. Together, the Configuration and System log types provide the centralized tracking and secure archiving of administrative logins and config changes that the SOC supervisor requires.

Answer

WildFire Submission and Analysis logs.

Answer

Data Filtering and GTP logs.

Answer

Threat and URL Filtering logs.

Question 14

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

Accepted Answer

Prisma Cloud Auto-Remediation via Cloud Functions / Webhooks. Prisma Cloud Auto-Remediation uses cloud-native functions (such as AWS Lambda) or webhooks to automatically respond to policy violations, including remediating public S3 buckets by applying block-public-access settings or modifying bucket ACLs/policies. This is the feature designed specifically for automated remediation workflows.

Answer

Prisma Access Remote Network connector

Answer

VM-Series firewall active-passive high availability failover

Answer

WildFire automated sample submission

Question 15

A security analyst at a healthcare company needs to confirm that its cloud storage buckets comply with the HIPAA security rule. The company uses Prisma Cloud to monitor its AWS environment. Which Prisma Cloud capability should the analyst use to continuously evaluate the configuration of those S3 buckets against HIPAA controls?

Accepted Answer

Prisma Cloud Compliance Standards and Reports. Prisma Cloud Compliance Standards and Reports provide out-of-the-box mapping to regulations like HIPAA. By enabling the HIPAA standard, the analyst can continuously monitor S3 buckets for violations such as missing encryption or public access. This gives a clear, auditable view of compliance posture, which is essential for protecting ePHI in AWS.

Answer

Prisma Cloud anomaly detection policies for user behavior

Answer

Prisma Cloud alert rules based on severity

Answer

Prisma Cloud Compute runtime defense rules

Question 16

A security analyst is reviewing a Cortex XDR alert on a Windows workstation where the agent reported a process that spawned from a Microsoft Word document, wrote a copy of itself into the user's Startup folder, and then contacted an external IP address. The analyst confirms the file hash is not present in any threat intelligence feed and the file signature is unsigned. Which Cortex XDR capability most directly generated this detection?

Accepted Answer

Behavioral Threat Protection monitoring process activity on the endpoint. The alert describes a behavior chain rather than a known file or an exploit technique. Behavioral Threat Protection is the Cortex XDR module that continuously monitors process, file, and network activity on the endpoint and correlates suspicious sequences such as an Office process spawning a child that achieves persistence and then beacons externally. Because the hash is unknown and unsigned, signature and reputation-based modules cannot explain the detection.

Answer

Exploit Protection blocking a memory corruption attempt in Word

Answer

Malware Protection matching the dropped file against a local signature database

Answer

WildFire cloud analysis of the dropped executable

Question 17

A Cortex XDR administrator is configuring an endpoint protection policy for a group of Windows servers that host a custom in-house database application. The application frequently writes large temporary files and spawns child processes during batch jobs. The administrator wants to reduce false positives without disabling protection entirely. Which TWO policy actions should the administrator take? (Choose two.)

Accepted Answer

Add the application's executable and its working directory to the Behavioral Threat Protection exclusions for the server policy. Reducing false positives on a trusted server requires narrowly scoped exclusions rather than weakening protection globally. Excluding the specific application executable and its working directory from Behavioral Threat Protection stops the benign process-spawning and file-writing pattern from being flagged, while a malware exclusion on the temporary directory prevents repeated scanning of churning trusted files. Both actions preserve the modules for all other activity on the host.

Answer

Disable the Malware, Exploit, and Behavioral Threat Protection modules entirely on the server policy

Answer

Set the agent to Report mode for all modules so detections are logged but nothing is blocked

Answer

Lower the agent's scan schedule frequency so temporary files are only scanned once per day

Question 18

A security administrator is configuring the Cortex XDR agent on a new Windows endpoint. The administrator wants to ensure that the agent can detect and block known malicious files by comparing file hashes against a cloud-based database. Which prevention module should be enabled?

Accepted Answer

Malware Prevention. Malware Prevention is the Cortex XDR module specifically designed to detect and block known malicious files using signature and hash-based checks, including cloud lookups. The other modules address different threat vectors: Exploit Prevention targets memory exploits, Behavioral Threat Protection analyzes process behavior, and Device Control manages peripherals. Only Malware Prevention directly satisfies the requirement to compare file hashes against a cloud database.

Answer

Behavioral Threat Protection

Answer

Exploit Prevention

Answer

Device Control

Question 19

A security analyst is investigating a suspicious process on a Windows endpoint protected by Cortex XDR. The analyst wants to see the full command line, parent process, and network connections associated with that process. Which Cortex XDR console feature should the analyst use?

Accepted Answer

Incident response investigation view. The incident response investigation view offers a detailed process tree with command lines, parent processes, and network connections, enabling deep forensic analysis. Other console areas provide summary or configuration data, not the granular process details required.

Answer

Alerts table

Answer

Policy audit log

Answer

Threat intelligence dashboard

Question 20

A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to modify the memory of another process on a critical server. The analyst wants to determine whether the Cortex XDR agent blocked the attempt or only logged it. Which field in the Cortex XDR alert details should the analyst examine to confirm the action taken by the agent?

Accepted Answer

The 'Action' field in the alert details, which shows 'Blocked' or 'Reported'.. In Cortex XDR, the 'Action' field in alert details explicitly states whether the agent blocked or merely reported the activity. For a memory modification attempt, this field will show 'Blocked' if prevention was enforced, or 'Reported' if the module was in monitor mode. This is the authoritative indicator of the agent's response, making it the correct field to examine.

Answer

The 'Severity' field in the alert details, which indicates the potential impact.

Answer

The 'MITRE Technique' field in the alert details, which maps the activity to a tactic.

Answer

The 'Process Name' field in the alert details, which identifies the offending process.