Cybersecurity-Apprentice Practice Test 3 — 10 Questions

Question 1

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

App-ID. App-ID uses multiple classification mechanisms, including signature matching, heuristics, and SSL decryption analysis, to identify applications regardless of port.

Answer

Data-ID

Answer

Device-ID

Answer

User-ID

Question 2

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

Accepted Answer

show counter global filter packet-drop yes. The command 'show counter global filter packet-drop yes' allows administrators to view global packet drop counters in real time, which is essential for troubleshooting traffic drops on the firewall.

Answer

show system resources

Answer

show session all

Answer

show interface all

Question 3

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust principles include continuous verification, least privilege access, inspecting and logging all traffic, and assuming breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 4

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Accepted Answer

A DoS Protection Profile configured with random early drop or classified rate limiting.. Zone Protection profiles or DoS Protection profiles protect against volumetric attacks and flood conditions originating from single or multiple IP sources.

Answer

A custom URL Filtering profile blocking the login page URL category.

Answer

An Antivirus Profile with signature auto-update enabled every minute.

Answer

A Data Filtering Profile configured to scan for weak passwords.

Question 5

An administrator is configuring a File Blocking profile to prevent users from downloading potentially dangerous file types. However, users legitimately need to download password-protected archive files (such as .zip files encrypted with passwords) for business operations. How should the administrator configure the profile to handle encrypted archives safely?

Accepted Answer

Configure the File Blocking profile to detect and block 'encrypted-zip' and 'encrypted-rar' file types.. File Blocking profiles can be configured to detect and block or alert on encrypted archives (like password-protected .zip files) because attackers often use them to bypass payload inspection.

Answer

Enable WildFire inline machine learning to guess user archive passwords.

Answer

Set the URL Filtering profile action to bypass inspection for all archive file extensions.

Answer

Attach an Antivirus profile set to automatically decrypt password-protected ZIP files using a dictionary attack.

Question 6

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. APT and zero-day protection relies on WildFire cloud sandbox analysis, DNS Security for malicious domain detection, and inline machine learning.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 7

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

Accepted Answer

To centralize log collection, event correlation, and security incident monitoring across disparate enterprise systems.. SIEM systems aggregate, correlate, and analyze log data from multiple sources across the enterprise to detect security incidents and provide audit trails.

Answer

To analyze unknown executable files in an isolated sandbox environment.

Answer

To automatically patch operating system vulnerabilities on endpoints.

Answer

To enforce inline packet inspection and drop malicious TCP packets.

Question 8

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. Vulnerability Protection profiles inspect traffic for known exploit signatures, including vulnerability scans and exploit attempts targeting servers.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 9

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data exfiltration is prevented using Data Filtering profiles, File Blocking profiles, and SSL Decryption to inspect encrypted egress traffic.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 10

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). A static route requires a destination subnet, a next-hop specification (IP address or interface), and a route name/destination identifier.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID