Cybersecurity-Apprentice Practice Test 4 — 10 Questions

Question 1

Which object type should an administrator create in PAN-OS to group multiple internal server IP addresses together for simplified Security policy management?

Accepted Answer

Address Object. An Address Object (or Address Group) allows administrators to group IP addresses, subnets, or ranges under a single label for policy rules.

Answer

External Dynamic List

Answer

Application Group

Answer

Service Object

Question 2

An administrator wants to restrict administrative access to the firewall GUI so that only members of the 'Domain Admins' group can log in using their Active Directory credentials. Which authentication method should be configured?

Accepted Answer

An Authentication Profile combined with an Admin Role Profile mapping the AD group.. Integrating PAN-OS with LDAP/RADIUS or SAML using an Authentication Profile linked to an Admin Role Profile maps Active Directory groups to firewall management roles.

Answer

A custom decryption rule enforcing SAML client authentication.

Answer

A standard Security policy rule with an explicit user match condition.

Answer

A GlobalProtect Portal agent configuration.

Question 3

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Securing the management plane involves restricting administrative access via Management Profile source IP whitelisting and ensuring strong administrative authentication settings.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 4

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Quarantined items can be managed and reviewed directly from the Cortex XDR management console under Incident Response or Endpoint views.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 5

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

Accepted Answer

In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.. Cortex XDR allows administrators to create profile exceptions based on hash or behavioral exception rules for specific trusted scripts.

Answer

Change the Agent settings to bypass all SSL decryption rules.

Answer

Disable the Local Analysis module entirely for the target endpoint group.

Answer

Modify the Windows Firewall inbound rules on the local endpoint.

Question 6

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles are configured under Device > Server Profiles > Syslog in the PAN-OS management interface.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 7

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Tier-1 analysts focus on initial alert triage, alert verification, running basic playbooks, and escalating verified threats to Tier-2.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 8

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

Accepted Answer

Check that the connection status shows Connected with a recent heartbeat timestamp.. The connection status in Endpoint Management indicates whether the agent has an active, healthy TLS session with the backend server.

Answer

Ensure the endpoint operating system is running the latest patch level.

Answer

Confirm that the kernel module version matches the BIOS version.

Answer

Verify that the local disk usage is below 10 percent.

Question 9

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

Accepted Answer

Objects > Applications > [Application Name], modifying TCP timeout settings. Application timeouts can be customized under Objects > Applications by creating or editing an application override, or by modifying timeout settings in Device > Setup > Session.

Answer

Network > Interfaces > Advanced > TCP Timeout

Answer

Policies > Security > Timeout Profile

Answer

Device > Setup > Management > Session Settings

Question 10

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agents require specific Windows OS patches (such as Universal C Runtime updates) and proper MSI execution privileges.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.