Cybersecurity-Apprentice Practice Test 3 — 10 Questions

Question 1

A SOC analyst is investigating a malware alert on an endpoint. The analyst wants to understand the behavior of the malware to determine its capabilities. The analyst has a malware sample and needs to analyze it in a safe environment. Which action should the analyst take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Submit the malware sample to a sandbox for automated analysis.. Malware analysis should always be performed in an isolated environment to prevent accidental execution and spread. A sandbox provides a safe, automated way to observe malware behavior, including its network communications and system changes. Submitting the sample to a sandbox is the correct action, as it balances safety with the need for detailed behavioral analysis.

Answer

Run the malware on a personal laptop with antivirus disabled.

Answer

Execute the malware on a production workstation to observe its behavior.

Answer

Upload the malware sample to a public file-sharing site for analysis by others.

Question 2

An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)

Accepted Answer

IP Address. Option A (IP Address) is correct because a Layer 3 interface on a Palo Alto Networks firewall must be assigned an IPv4 or IPv6 address (or be configured as DHCP client) to participate in a routed network and forward traffic between subnets. Option B (Security Zone) is correct because every Layer 3 interface must be bound to a security zone, which defines the trust level and the security policy rules that govern traffic entering and leaving that interface. Option C (DHCP Server Scope) is incorrect because a DHCP server scope is only needed if the firewall itself is acting as a DHCP server for clients, not for basic Layer 3 routed operation. Option D (MAC Address Override) is incorrect because overriding the interface MAC address is an optional feature for specific scenarios like ISP requirements or HA, not a mandatory parameter. Option E (Virtual Wire Pair Identifier) is incorrect because virtual wire pairs are used for Layer 2 transparent (tap) deployments, not for Layer 3 routed interfaces.

Answer

DHCP Server Scope

Answer

MAC Address Override

Answer

Virtual Wire Pair Identifier

Question 3

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR network isolation blocks all traffic except management communication by default. To allow a specific forensic server to reach an isolated endpoint, the responder configures IP-based isolation exceptions in the Cortex XDR profile (or via the isolation policy), whitelisting the forensic server's IP so its traffic is permitted while all other traffic remains blocked. This preserves containment while enabling evidence collection.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 4

A Cortex XDR administrator is configuring endpoint protection for a group of Windows servers that run a custom Java application. The application uses a Just-In-Time (JIT) compiler that frequently generates dynamic code, and the administrator observes that Exploit Protection is blocking the application's normal execution. What is the most appropriate action to resolve this while maintaining security?

Accepted Answer

Create an exception for the Java application's executable in the Exploit Protection module.. A targeted exception for the Java application's executable in Exploit Protection is the correct balance, allowing the legitimate JIT compiler to function while preserving exploit prevention for other processes. Global disable or module changes are too broad and do not address the specific compatibility issue. Upgrading the agent alone may not resolve the JIT-generated code detection. Scoped exceptions are the standard remediation for legitimate applications that trigger exploit prevention.

Answer

Move the servers to a different endpoint group with Behavioral Threat Protection disabled.

Answer

Upgrade the Cortex XDR agent to the latest version.

Answer

Disable Exploit Protection globally for all endpoints in the organization.

Question 5

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)

Accepted Answer

Enable the Prisma Cloud Config assessment feature for each cloud account.. To detect publicly accessible storage buckets, Prisma Cloud must have read-only access to storage services and the Config assessment feature must be enabled. These two actions allow Prisma Cloud to query bucket configurations and evaluate them against security policies. Compute agents, audit logs, and webhooks do not provide the necessary configuration data.

Answer

Deploy Prisma Cloud Compute agents on all virtual machines.

Answer

Configure CloudTrail, Azure Activity Log, and GCP Audit Logs to send logs to Prisma Cloud.

Answer

Set up a Prisma Cloud webhook to receive alerts from cloud providers.

Question 6

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

Accepted Answer

The two hosts are on different IP subnets and require a router or Layer 3 device to communicate. IP communication depends on subnet boundaries, not physical topology. Hosts on 172.16.5.0/24 and 172.16.6.0/24 are on separate logical networks even when cabled to the same switch. A host forwards off-subnet traffic to its default gateway, so without a router or Layer 3 switch providing inter-subnet routing, the two hosts cannot exchange packets. Confirming subnet membership and the presence of a Layer 3 path is essential before blaming switching or ACLs.

Answer

The switch is blocking traffic because the MAC address table has not learned the server's MAC address

Answer

The server's /24 mask is too large and causes it to treat the workstation as local

Answer

The workstation is using the wrong default gateway, which prevents ARP from resolving the server

Question 7

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

Accepted Answer

An incorrect peer AS number or incorrect peer IP address configuration. BGP peers stuck in the Idle state means the router has not even begun the TCP connection or has repeatedly failed to establish one, which most commonly results from a misconfigured peer IP address or peer AS number. If the peer address is wrong, the TCP session to port 179 never forms; if the peer AS number is wrong, the OPEN message is rejected and the session tears down back to Idle. Both are fundamental peer configuration errors that prevent the BGP finite state machine from progressing.

Answer

An AS-path loop detection trigger

Answer

MD5 authentication password mismatch during OPEN message exchange

Answer

BGP route reflection timer expiration

Question 8

A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?

Accepted Answer

The technique is code injection, and the agent blocked the write operation and may have terminated the injecting process.. Writing to another process's memory is a hallmark of code injection, often used by malware to execute code in the context of a trusted process. Behavioral Threat Protection detects this activity and can block the write operation, preventing the injection. Depending on the configured policy, the agent may also terminate the injecting process. The other options misidentify the technique or the agent's response.

Answer

The technique is privilege escalation, and the agent escalated the alert to the cloud for analysis.

Answer

The technique is DLL side-loading, and the agent quarantined the DLL file.

Answer

The technique is process hollowing, and the agent terminated the target process.

Question 9

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

Accepted Answer

172.16.10.32 and 172.16.10.63. With a subnet mask of 255.255.255.224 (/27), the subnet increment is 32. The address 172.16.10.33 falls within the subnet starting at 172.16.10.32. Therefore, the network address is 172.16.10.32 and the broadcast address is 172.16.10.63. The correct answer is 172.16.10.32 and 172.16.10.63.

Answer

172.16.10.0 and 172.16.10.31

Answer

172.16.10.0 and 172.16.10.63

Answer

172.16.10.33 and 172.16.10.62

Question 10

A new security analyst at a retail company receives a help desk ticket stating that an employee clicked a link in an email and a browser window opened asking for their corporate username and password. The page looks identical to the company's single sign-on portal, but the URL is misspelled. The analyst must classify this event. Which category BEST describes this activity?

Accepted Answer

Phishing. The deceptive email link and counterfeit single sign-on page are designed to capture the employee's credentials, which is the defining behavior of phishing. The other categories describe availability attacks, post-compromise escalation, or database manipulation, none of which match the evidence. Correct classification drives the proper response: reset the user's credentials, block the URL, and reinforce awareness training.

Answer

Denial of service

Answer

SQL injection

Answer

Privilege escalation