Cybersecurity-Apprentice Practice Test 4 — 25 Questions

Question 1

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire portal allows security professionals to manually search file hashes to view historical analysis reports and verdicts.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 2

A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?

Accepted Answer

Navigate to Cortex XSIAM > Settings > Data Sources to review agent and collector ingestion health metrics.. Cortex XSIAM provides dedicated data source monitoring and health dashboards to track ingestion rates, parsing errors, and collector status.

Answer

Open the Threat Intelligence management page and verify API token validity.

Answer

Review the GlobalProtect Gateway logs for active tunnel handshakes.

Answer

Check the Panorama > Setup > Operations > Export Panorama Configuration menu.

Question 3

An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?

Accepted Answer

Create an exception rule in Cortex XDR using the alert details to filter out the scanner's specific parameters.. Cortex XDR allows analysts to tune alerts by creating exception rules based on alert criteria such as specific hosts, file paths, or command lines.

Answer

Delete the default Security Policy rule on the firewall governing internal subnets.

Answer

Disable the entire Local Analysis module globally across all endpoint security profiles.

Answer

Restart the Cortex XDR Agent daemon on the vulnerability scanner host.

Question 4

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

Accepted Answer

Configure the SIEM server profile to export logs using CEF (Common Event Format) or JSON formatting.. When configuring SIEM integrations or log forwarding profiles in Palo Alto Networks products, administrators can specify standard formats such as CEF or JSON for seamless ingestion.

Answer

Disable all header encryption and export logs using raw ASCII carriage returns only.

Answer

Rewrite the PAN-OS kernel to natively output syslog in Microsoft Word DOCX format.

Answer

Convert all log files into uncompressed raw bitmap graphics prior to export.

Question 5

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

Accepted Answer

Review the Cortex XDR Causality Chain and Timeline view for the affected endpoint.. The Cortex XDR Causality Chain and BIOC (Behavioral Indicator of Compromise) timeline provide a graphical and chronological representation of process activity.

Answer

Run a vulnerability scan against the endpoint using Panorama compliance tools.

Answer

Examine the DHCP lease table on the core routing switch.

Answer

Export the firewall Traffic Log CSV and sort by destination port numbers.

Question 6

An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)

Accepted Answer

SNMP Trap destination. PAN-OS Log Forwarding Profiles support multiple destination types including Syslog, SNMP Trap, Email, and HTTP/HTTPS (such as Cortex Data Lake or API endpoints).

Answer

Bluetooth peer-to-peer relay

Answer

Local BIOS firmware flash memory

Question 7

A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?

Accepted Answer

config from cloud.resource where type = 'aws-ec2-instance' and root.volume.encryption = false. Config RQL queries follow the pattern 'config from cloud.resource where type = ''aws-ec2-instance'' ...'.

Answer

vulnerability from container where crit > 0

Answer

network from cloud.traffic where source.type = 'ec2' and destination.encrypted = false

Answer

event from cloud.audit where operation = 'RunInstances' and encrypted = false

Question 8

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

Accepted Answer

Administration > Access Control > Trusted IP. Prisma Cloud allows administrators to configure trusted IP restrictions under Administration > Access Control to secure access to the console.

Answer

Cloud Accounts > Add Account > Network Security

Answer

Inventory > Asset Explorer > Filters

Answer

Compute > Defend > Access Rules

Question 9

An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?

Accepted Answer

Prisma Cloud Compute Container Firewall / Network Radar. Prisma Cloud Compute provides container firewall capabilities that inspect traffic between pods and enforce layer 3/4 and layer 7 network segmentation rules.

Answer

Prisma Access GlobalProtect gateway

Answer

AWS Security Hub cross-region aggregator

Answer

Prisma Cloud Compute App-Embedded Defender

Question 10

A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)

Accepted Answer

Establishment of network connections to known malicious IP addresses or unexpected ports. Prisma Cloud Compute monitors container runtime activity, detecting unauthorized process execution, file system tampering, and suspicious outbound network connections.

Answer

Physical server hardware temperature anomalies

Answer

AWS IAM policy changes in the underlying cloud management control plane

Question 11

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

Accepted Answer

Prisma Cloud CSPM Resource Configuration Scan. Prisma Cloud CSPM (Cloud Security Posture Management) continuously scans cloud resource configurations to identify misconfigurations and compliance violations against frameworks like CIS.

Answer

WildFire cloud-based analysis service

Answer

Prisma Cloud Compute Defender

Answer

VM-Series firewall URL filtering profile

Question 12

An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?

Accepted Answer

It eliminates the need to install and maintain software agents on target virtual machines while maintaining visibility.. Agentless scanning takes EBS snapshots of instances to analyze OS packages, vulnerabilities, and configurations without requiring software installation inside the running operating system.

Answer

It enables active SSL decryption of all inbound TLS traffic on public load balancers.

Answer

It provides real-time layer 7 container runtime process execution blocking.

Answer

It replaces the need for cloud provider API integrations entirely.

Question 13

A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)

Accepted Answer

Resource configuration history tracking changes to IAM policies and security groups (Config RQL). Detecting compromised cloud credentials and privilege escalation involves analyzing cloud audit logs, resource configuration states, and user behavior analytics.

Answer

Automatic kernel-level defragmentation of enterprise database storage volumes

Answer

GlobalProtect client certificate revocation list distribution

Question 14

An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?

Accepted Answer

AWS IAM Credential Report and Cloud Provider Asset Configuration Metadata. Prisma Cloud evaluates AWS IAM credential report data and cloud audit logs to identify inactive or unused access keys.

Answer

Container runtime audit logs captured by Admission Controllers

Answer

Flow logs captured by VM-Series virtual firewalls

Answer

WildFire cloud sandbox behavioral analysis reports

Question 15

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

Accepted Answer

Use the twistcli utility in the CI/CD pipeline to scan images before registry push. Integrating Prisma Cloud into CI/CD pipelines is achieved by utilizing the twistcli utility to scan container images during the build phase and fail the build if vulnerabilities exceed defined thresholds.

Answer

Enable AWS GuardDuty anomaly detection on the container registry repository

Answer

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Answer

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes

Question 16

A security analyst receives a Prisma Cloud alert regarding suspicious API activity in an AWS account, indicating potential credential compromise. Which Prisma Cloud module generated this alert by analyzing cloud provider audit logs for anomalous behavior?

Accepted Answer

Prisma Cloud Cloud Detection and Response (CDR) / Identity Security. Prisma Cloud CDR (Cloud Detection and Response) or UEBA capabilities analyze cloud audit logs (like CloudTrail) to detect anomalous and malicious user behavior.

Answer

Prisma Access Remote Browser Isolation

Answer

Prisma Cloud Container Vulnerability Management

Answer

Prisma Cloud Web Application and API Security (WAAS)

Question 17

An administrator needs to onboard a new Google Cloud Platform (GCP) organization into Prisma Cloud with least-privilege permissions. Which GCP authentication method does Prisma Cloud recommend and support for secure API integration?

Accepted Answer

GCP Service Account with Custom IAM Role granting required read permissions at the Organization level. Prisma Cloud integrates with GCP using a Service Account associated with Workload Identity or custom IAM roles assigned at the Organization level with predefined read-only security permissions.

Answer

Hardcoded GCP user account credentials with project owner role

Answer

GCP Cloud SQL database master password sharing

Answer

Pre-shared symmetric API keys embedded in Cloud Functions

Question 18

Under the shared responsibility model in cloud computing, the customer retains responsibility for securing specific layers regardless of whether the service is IaaS, PaaS, or SaaS. Which TWO items are always the customer's responsibility? (Choose two)

Accepted Answer

Data classification, labeling, and encryption key management. Regardless of the cloud model, customer data and identity/access management are always the responsibility of the customer.

Answer

Physical server hardware recycling and disk sanitization

Answer

Underlying cloud provider hypervisor and virtualization software patches

Answer

Physical data center perimeter security fences and guards

Question 19

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

Accepted Answer

The Incidents tab in the Cortex XDR management console.. Cortex XDR provides an Incident view that aggregates related alerts into a single incident, mapped directly to the MITRE ATT and CK framework to help analysts understand the threat lifecycle.

Answer

The Dashboards tab under System Settings on the firewall.

Answer

The User-ID Agent status page.

Answer

The ACC (Application Command Center) threat map on Panorama.

Question 20

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

Accepted Answer

Principle of Least Privilege. The principle of least privilege ensures that entities have only the permissions required to complete their jobs, minimizing the attack surface.

Answer

Zero Trust Architecture

Answer

Defense-in-Depth

Answer

Separation of Duties