Cybersecurity-Apprentice Practice Test 4 — 10 Questions

Question 1

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anti-Spyware Profile with DNS Sinkhole. DNS-based C2 is detected and blocked by the Anti-Spyware profile, which includes DNS sinkhole functionality. When a DNS query matches a known malicious domain in the Palo Alto DNS signature database, the firewall can sinkhole the response (returning a bogus IP) to prevent the internal host from reaching the C2 server. Attaching the Anti-Spyware profile to the security rule enables this automatic blocking.

Answer

URL Filtering Profile

Answer

Vulnerability Protection Profile

Answer

Antivirus Profile

Question 2

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

Accepted Answer

Apply policy tags to group related policies and use those tags in alert rules to control which findings are surfaced to each business unit.. Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Answer

Disable all policies that have not generated an alert in the last 30 days to reduce the number of active policies.

Answer

Increase the scan frequency of the cloud accounts to every five minutes so that duplicate alerts are generated for each scan cycle.

Answer

Enable auto-remediation for every high-severity policy so that all findings are fixed without human review.

Question 3

A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?

Accepted Answer

Private IP addresses. The 192.168.1.0/24 range falls within the RFC 1918 private address space, specifically 192.168.0.0/16. Private addresses are not routable on the public Internet and require network address translation to communicate externally. Public addresses are globally routable, multicast addresses serve groups, and loopback addresses refer to the local host, so only the private designation fits the administrator's observation.

Answer

Public IP addresses

Answer

Multicast addresses

Answer

Loopback addresses

Question 4

A junior security analyst is reviewing Prisma Cloud alerts for an Amazon S3 bucket that was made publicly accessible. The analyst needs to quickly understand the potential impact and prioritize remediation. Which Prisma Cloud capability should the analyst use first?

Accepted Answer

The alert's resource configuration details and the associated compliance standard violations.. Prisma Cloud alerts include the offending resource's configuration and the compliance standards it violates, which directly answer what is wrong and why it matters. This built-in context lets an analyst triage a public S3 bucket quickly, determine business impact, and decide on remediation steps without switching to external tools.

Answer

The Prisma Cloud Compute radar view to inspect the bucket's container image layers.

Answer

The AWS Cost Explorer to determine whether the bucket is incurring unexpected charges.

Answer

The AWS Trusted Advisor console to view the S3 bucket permissions check.

Question 5

A small company runs its customer web portal on a single Amazon EC2 instance. The security lead must decide who is responsible for patching the guest operating system, according to the AWS shared responsibility model. Who is responsible?

Accepted Answer

The customer, because the customer controls the guest operating system, applications, and data on the instance.. Under the AWS shared responsibility model, AWS is responsible for security of the cloud (physical hosts, hypervisor, network), while the customer is responsible for security in the cloud. For a customer-managed EC2 instance, the guest operating system, applications, and data fall to the customer. Patching the guest OS is therefore the customer's obligation, not AWS's, a partner's, or a 50/50 split.

Answer

The AWS Support team, because the instance was launched from an AWS-provided Amazon Machine Image.

Answer

AWS, because EC2 is an Infrastructure as a Service offering and AWS manages the hypervisor and guest OS.

Answer

A shared 50/50 split, with AWS patching the kernel and the customer patching user-space applications.

Question 6

A Tier-1 SOC analyst is preparing to escalate a confirmed malware infection on a finance workstation to the Tier-2 team. Which TWO pieces of information are most essential to include in the escalation ticket to enable effective response? (Choose two.)

Accepted Answer

The affected host's name, IP address, and the user account currently logged in. A useful escalation must identify the affected asset and user, and it must convey the technical detection evidence so the responder can validate and scope the incident quickly. Host identifiers enable correlation and containment, while process tree, hashes, and C2 indicators provide the investigative starting point. Bulk data, environment inventories, and personal preferences do not advance response.

Answer

The full raw packet capture of all traffic from the workstation for the past 24 hours

Answer

A list of every security tool deployed across the entire organization and their version numbers

Answer

The analyst's personal opinion about which team member should handle the case

Question 7

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. Option B (Hello and Dead timer intervals) is correct because OSPF neighbors must agree on the Hello interval and Dead interval on the interface; mismatched timers prevent Hello packets from being accepted and the adjacency never reaches 2-Way/Full. Option D (Authentication type and password) is correct because if authentication is configured, both routers must use the same authentication type (e.g., MD5 or SHA) and matching key/password, otherwise OSPF packets fail authentication and are discarded. Option E (Area ID) is correct because two OSPF routers can only form an adjacency if their interfaces belong to the same OSPF area, since the Area ID is carried in the Hello packet and must match. Option A (Process ID) is not required to match because the OSPF process ID is locally significant to the router and is not carried in Hello packets. Option C (Router ID) is not required to match because each OSPF router must have a unique Router ID within the OSPF domain; duplicate Router IDs actually cause adjacency problems rather than being a requirement.

Answer

Process ID

Answer

Router ID

Question 8

A security administrator is configuring Cortex XDR agent settings for a group of Linux servers. The administrator wants to ensure that the agent does not interfere with a custom application that performs legitimate but unusual system calls, which are currently being flagged as malicious by the agent's behavioral threat protection. What should the administrator do to prevent the agent from blocking this application while maintaining security?

Accepted Answer

Create a Behavioral Threat Protection exception for the application's process name and hash.. Creating a Behavioral Threat Protection exception for the application's process name and hash is the correct approach. It allows the legitimate application to run without interference while keeping behavioral threat protection active for other processes. This balances security and functionality.

Answer

Add the application to the allow list in the Exploit Protection module.

Answer

Configure the agent to run in 'Report Only' mode for Behavioral Threat Protection.

Answer

Disable Behavioral Threat Protection entirely on the Linux servers.

Question 9

A small company is moving its first workload to Microsoft Azure and wants to use Prisma Cloud to monitor the environment. The administrator needs to grant Prisma Cloud read access to the Azure subscription so that it can collect resource configuration and evaluate policies. Which action should the administrator take?

Accepted Answer

Create an Azure service principal with a Reader role assignment on the subscription and provide its credentials to Prisma Cloud.. Onboarding an Azure subscription into Prisma Cloud requires an identity that can read resource configuration across the subscription. A service principal assigned the Reader role at the subscription scope provides exactly that read-only access through Azure Resource Manager, allowing Prisma Cloud to collect configuration and evaluate policies without granting permissions to change resources.

Answer

Generate a shared access signature token for the storage account and enter it into the Prisma Cloud console.

Answer

Assign the Global Administrator directory role to a user account and use that account for the Prisma Cloud integration.

Answer

Install the Prisma Cloud Compute Defender agent on every virtual machine in the subscription.

Question 10

A security analyst is reviewing a web server log and sees the following entry: `GET /products.php?id=1' OR '1'='1`. The analyst suspects an injection attack. Which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The payload `' OR '1'='1` is a textbook SQL injection attempt. It aims to alter the logic of a database query by injecting a tautology. The other attack types would involve different payloads and mechanisms, such as script tags for XSS, shell commands for command injection, or forged requests for CSRF.

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Answer

Command injection