Cybersecurity-Apprentice Practice Test 5 — 25 Questions

Question 1

An organization is preparing for a security audit and wants to ensure robust defense-in-depth measures are active on their Palo Alto Networks firewalls. Which TWO security profiles protect against protocol manipulation, evasion techniques, and vulnerability exploitation? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection profiles defend against software vulnerabilities and exploits, while Anti-Spyware profiles detect and block command-and-control traffic and evasion techniques.

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Answer

File Blocking Profile

Question 2

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

Accepted Answer

Ensure the operation mode parameter is set to prevent rather than detect or disable.. The prevention module must be explicitly enabled in the agent installation settings to ensure full enforcement immediately upon installation.

Answer

Disable the self-defense mechanism during MSI deployment.

Answer

Configure the proxy bypass list for local loopback communication.

Answer

Set the heartbeat interval to 60 seconds.

Question 3

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

Accepted Answer

To automatically analyze unknown files and samples submitted by endpoints to determine if they are malicious.. WildFire acts as the cloud-based threat analysis engine that analyzes unknown files and provides accurate verdicts.

Answer

To provide local disk defragmentation services.

Answer

To enforce multi-factor authentication for endpoint login sessions.

Answer

To manage firewall security policies across multiple tenants.

Question 4

Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)

Accepted Answer

Endpoint management platforms such as Microsoft Intune or SCCM.. Administrators can deploy the Cortex XDR agent via Active Directory GPO, third-party software deployment tools (SCCM/Intune), or manual installation scripts.

Answer

Broadcasting the installation package over commercial FM radio frequencies.

Answer

Injecting the MSI payload via unauthenticated network printer port scans.

Question 5

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR allows administrators to configure isolation exceptions that specify permitted IP addresses or ports for isolated endpoints.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 6

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

Accepted Answer

Zero-day malware and ransomware payloads delivered via web downloads or email attachments.. Next-Generation Firewalls mitigate ransomware delivered via malicious downloads (via WildFire/Antivirus) and phishing/credential theft (via URL Filtering and Credential Enforcement).

Answer

Unauthorized physical access to server racks within the data datacenter.

Answer

Fiber-optic cable attenuation caused by excessive distance bending.

Answer

Hardware physical interface failure caused by power surge transients.

Question 7

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

Accepted Answer

Traffic log. Threat logs record security events such as spyware, viruses, and vulnerability exploits, while Traffic logs record session start and end details, including allow, deny, and drop actions.

Answer

System log

Answer

Config log

Answer

Threat log

Question 8

An organization is deploying a comprehensive threat prevention strategy using Palo Alto Networks Security Profiles. Which THREE security profile types are available out-of-the-box to inspect data plane traffic for specific threat vectors? (Choose three)

Accepted Answer

Anti-Spyware. Palo Alto Networks Threat Prevention includes Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire Analysis security profiles.

Answer

Packet Filter

Answer

Session Timeout

Question 9

An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?

Accepted Answer

Device > Admin Roles. Custom Admin Roles are configured under Device > Admin Roles. This allows administrators to define granular read, write, or none permissions for specific tabs, menus, and tasks.

Answer

Policies > Access Control

Answer

Device > Setup > Management

Answer

Device > Authentication Profile

Question 10

An enterprise firewall is experiencing high session utilization due to a distributed denial-of-service (DDoS) SYN flood attack targeting a public web server. Which feature on the Palo Alto Networks firewall should an administrator configure to protect the server from resource exhaustion?

Accepted Answer

A DoS Protection profile and policy specifying SYN flood rate-limiting thresholds.. DoS Protection profiles and policies allow administrators to set thresholds for SYN floods, UDP floods, and other volumetric attacks to protect specific zones, IPs, or devices.

Answer

A Data Filtering profile configured with credit card pattern matching.

Answer

A custom URL Filtering profile with block actions enabled for high-risk categories.

Answer

An SSL Decryption policy configured to strip certificates from inbound web traffic.

Question 11

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

Accepted Answer

Behavioral Threat Protection. Local Analysis and Exploit/Behavioral Threat Protection guard against process injection and memory-based attacks.

Answer

URL Filtering profile

Answer

Data Loss Prevention (DLP) engine

Answer

DNS Security subscription

Question 12

An organization is deploying a zero-trust network architecture using Palo Alto Networks firewalls. The security team needs to ensure that internal user traffic destined for sensitive database servers is strictly inspected for application-layer threats. Which security mechanism must be enforced to achieve Layer 7 visibility and control?

Accepted Answer

Implement App-ID to identify the specific application and apply a Security policy rule with threat prevention profiles.. Port-based rules only look at layer 4 ports, whereas App-ID performs deep packet inspection to identify the exact application regardless of port, enabling effective Layer 7 security.

Answer

Rely entirely on traditional layer 3 network routing protocols to isolate database subnets.

Answer

Disable NAT rules to ensure internal IP addresses remain hidden from external networks.

Answer

Enforce explicit port-based allow rules combined with static IP subnetting.

Question 13

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

Accepted Answer

Exploit Protection module monitoring common application memory spaces and blocking anomalous execution flows.. Local Analysis and Exploit Protection prevent memory-based and fileless attack techniques like heap spraying or DLL injection.

Answer

Scheduled weekly full disk scans using YARA rules.

Answer

Antivirus signature database matching against known file hashes.

Answer

Browser extension security hardening policies.

Question 14

Which THREE features are provided by the Cortex XDR agent to protect endpoints against modern malware and advanced threats? (Choose three)

Accepted Answer

Local Analysis utilizing machine learning models to detect unknown malware.. Cortex XDR agents provide local analysis, behavioral threat protection, and exploit protection among other security modules.

Answer

Deep Packet Inspection for BGP routing protocol convergence.

Answer

Automatic generation of RAID disk arrays for local fault tolerance.

Question 15

Which TWO types of files or threats are typically inspected and analyzed by the WildFire cloud service when integrated with Cortex XDR? (Choose two)

Accepted Answer

Suspicious Microsoft Office documents containing embedded macros or scripts.. WildFire analyzes suspicious executable files, documents with macros, scripts, and unknown binaries submitted by endpoints.

Answer

Default operating system desktop background wallpaper images in PNG format.

Answer

Uncompressed family vacation audio MP3 recordings.

Answer

Standard plain text grocery shopping lists without executable content.

Question 16

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?

Accepted Answer

Enable Causation Analysis and expanded forensic data collection in the Agent Settings profile for that endpoint group.. Granular agent settings allow administrators to adjust data collection profiles and enable enhanced forensics or BIOC rules.

Answer

Increase the firewall packet capture buffer size to 1 GB.

Answer

Configure a URL filtering block page bypass.

Answer

Enable administrative debug logging on the local syslog server.

Question 17

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

Accepted Answer

Ensure outbound TCP port 443 traffic is permitted to the Cortex XDR backend FQDNs.. Cortex XDR agents require outbound HTTPS (port 443) connectivity to Cortex XDR cloud backend URLs and proper DNS resolution.

Answer

Check that local DHCP leases are renewed every 30 seconds.

Answer

Confirm that inbound SSH port 22 is open on all endpoint host firewalls.

Answer

Verify that SNMP v3 trap listeners are active on port 162.

Question 18

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

Accepted Answer

The receiver's buffer is full and it is requesting the sender to pause transmission.. A TCP zero window size indicates that the receiver's buffer is full and it cannot currently accept any more data, temporarily pausing transmission.

Answer

The maximum segment size (MSS) negotiation has failed during the three-way handshake.

Answer

An asymmetric routing loop has caused sequence numbers to go out of sync.

Answer

The firewall has blocked the session due to a security profile match.

Question 19

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

Accepted Answer

Configure Syslog forwarding or use the Cortex XDR streaming API to export alerts and BIOC data to the SIEM.. Cortex XDR provides integration via Syslog forwarding or REST APIs to stream alerts and logs to third-party SIEM platforms.

Answer

Configure NetFlow export on the local endpoint network interface card.

Answer

Export daily CSV reports from the Cortex XDR console via email.

Answer

Enable SNMP trap generation inside the local Windows Event Viewer settings.

Question 20

An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?

Accepted Answer

In the Cortex XDR management console under Endpoint Management > Agent Settings.. Agent settings and profiles dictate which protection modules are active for specific endpoint groups.

Answer

In the Active Directory Domain Controller Group Policy Management Editor.

Answer

In the firewall Security Policy rulebase.

Answer

In the global DNS Server configuration utility.