Cybersecurity-Apprentice Practice Test 2 — 30 Questions

Question 1

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object (or Address Group) allows administrators to group IP addresses, subnets, or ranges under a single label for policy rules.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 2

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

Accepted Answer

An Authentication Profile combined with an Admin Role Profile mapping the AD group.. Integrating PAN-OS with LDAP/RADIUS or SAML using an Authentication Profile linked to an Admin Role Profile maps Active Directory groups to firewall management roles.

Answer

A custom decryption rule enforcing SAML client authentication.

Answer

A standard Security policy rule with an explicit user match condition.

Answer

A GlobalProtect Portal agent configuration.

Question 3

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Securing the management plane involves restricting administrative access via Management Profile source IP whitelisting and ensuring strong administrative authentication settings.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 4

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Quarantined items can be managed and reviewed directly from the Cortex XDR management console under Incident Response or Endpoint views.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 5

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

Accepted Answer

In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.. Cortex XDR allows administrators to create profile exceptions based on hash or behavioral exception rules for specific trusted scripts.

Answer

Change the Agent settings to bypass all SSL decryption rules.

Answer

Disable the Local Analysis module entirely for the target endpoint group.

Answer

Modify the Windows Firewall inbound rules on the local endpoint.

Question 6

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles are configured under Device > Server Profiles > Syslog in the PAN-OS management interface.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 7

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Tier-1 analysts focus on initial alert triage, alert verification, running basic playbooks, and escalating verified threats to Tier-2.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 8

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

Accepted Answer

Check that the connection status shows Connected with a recent heartbeat timestamp.. The connection status in Endpoint Management indicates whether the agent has an active, healthy TLS session with the backend server.

Answer

Ensure the endpoint operating system is running the latest patch level.

Answer

Confirm that the kernel module version matches the BIOS version.

Answer

Verify that the local disk usage is below 10 percent.

Question 9

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

Accepted Answer

Objects > Applications > [Application Name], modifying TCP timeout settings. Application timeouts can be customized under Objects > Applications by creating or editing an application override, or by modifying timeout settings in Device > Setup > Session.

Answer

Network > Interfaces > Advanced > TCP Timeout

Answer

Policies > Security > Timeout Profile

Answer

Device > Setup > Management > Session Settings

Question 10

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agents require specific Windows OS patches (such as Universal C Runtime updates) and proper MSI execution privileges.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.

Question 11

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Accepted Answer

An MTU mismatch between the OSPF neighbors. Being stuck in EXSTART/EXCHANGE state in OSPF typically points to a mismatch in Maximum Transmission Unit (MTU) sizes across the link or interface configuration errors.

Answer

A mismatch in OSPF area ID types (e.g., normal vs. stub)

Answer

Incorrect OSPF hello or dead timer intervals

Answer

Authentication type or password mismatch

Question 12

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures usually stem from expired certificates, SSL inspection proxies intercepting traffic without proper root CA trust, or incorrect proxy settings.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 13

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Accepted Answer

By deploying a compatible legacy agent version that supports older OS APIs while providing core malware and exploit prevention.. Cortex XDR supports legacy operating systems with specific legacy agent versions that provide core prevention capabilities supported by those OS architectures.

Answer

By forcing an automatic in-place upgrade of the legacy Windows server to Windows 11.

Answer

By routing all legacy server traffic through a next-generation firewall proxy instead of installing an agent.

Answer

By disabling all security checks for servers older than five years.

Question 14

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

Accepted Answer

Provides a standardized industry terminology for describing adversary tactics and techniques.. MITRE ATT&CK mapping provides a common framework for understanding adversary tactics, standardizing incident reports, and identifying security coverage gaps.

Answer

Automatically recompiles malicious binary code into safe executable patches.

Answer

Directly replaces the need for endpoint firewalls and network segmentation.

Question 15

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. OSPF neighbors must have matching Area ID, Hello/Dead intervals, and authentication parameters (if enabled) to form an adjacency.

Answer

Process ID

Answer

Router ID

Question 16

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Layer 3. PAN-OS physical interfaces can be configured in several modes, including Layer 3, Layer 2, Virtual Wire, and Tap.

Answer

WAN Accelerator

Answer

Switchport Trunk

Answer

Promiscuous Bridge

Question 17

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

Accepted Answer

An Interface Management Profile assigned to the interface. Management Profile (or Interface Management Profile) allows administrators to permit or deny specific management traffic like ping, SSH, or HTTPS on specific interfaces.

Answer

A Security Policy rule with an application of 'ping'

Answer

A Zone Protection Profile applied to the egress zone

Answer

The Device > Setup > Management tab

Question 18

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

Accepted Answer

Add a Vulnerability Protection Profile exception for that specific Signature ID.. Vulnerability Protection Profile exceptions allow administrators to exempt specific signature IDs from action (e.g., set to allow or disabled) while keeping the rest of the profile active.

Answer

Change the global firewall operating mode from operational to maintenance mode.

Answer

Disable the Anti-Spyware Profile assigned to the zone.

Answer

Delete the default vulnerability signature from the PAN-OS software base.

Question 19

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

Accepted Answer

Network > Virtual Routers > [Virtual Router Name] > Static Routes. Static routes are configured under Network > Virtual Routers, selecting the specific virtual router instance, and then adding a static route entry.

Answer

Device > Setup > Operations > Routing

Answer

Network > Interfaces > Ethernet > Static Route

Answer

Policies > Routing > Static

Question 20

An administrator configures Dynamic NAT on a Palo Alto Networks firewall using a pool of public IP addresses. After implementation, some internal clients intermittently fail to establish outbound connections. Upon reviewing traffic logs, the administrator notes that the NAT translation pool has exhausted all available ports for a specific source IP. Which feature should be enabled or adjusted to prevent this port exhaustion?

Accepted Answer

Add additional public IP addresses to the NAT translation pool or enable DIPP block allocation.. Port exhaustion in dynamic IP and port NAT can be mitigated by adding more IP addresses to the NAT pool, enabling destination IP translation, or adjusting port allocation settings.

Answer

Change the NAT type from Source NAT to Static Destination NAT.

Answer

Enable Universal NAT without port mapping.

Answer

Disable stateful inspection on the security rule.