Cybersecurity-Apprentice Practice Test 5 — 10 Questions

Question 1

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID inspection in PAN-OS security policy rules identifies applications regardless of port or protocol, including tunneling apps that disguise themselves as web traffic. By matching on the actual application signature rather than port 80/443, the firewall can detect and block the hidden tunnels.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 2

A SOC analyst is triaging a phishing report submitted by an employee. The email contains a link to a credential-harvesting page that mimics the organization's webmail portal. The analyst has confirmed the URL is malicious. Which action should the analyst take to protect other users while preserving evidence?

Accepted Answer

Add the malicious URL to the web proxy blocklist, hunt for other recipients, and reset credentials for users who clicked.. A confirmed phishing URL requires immediate containment that stops further clicks and remediates users who already submitted credentials. Blocking the URL, hunting for other recipients, and resetting compromised credentials accomplishes both goals while preserving evidence. Replying to the attacker, mass-forwarding the live email, or only blocking the sender domain leaves credential compromise unaddressed and can increase exposure.

Answer

Forward the phishing email to all employees as a training example and ask them to delete it.

Answer

Block the sender's domain at the email gateway and delete all copies of the message from user mailboxes.

Answer

Reply to the phishing email warning the sender to stop and ask them to remove the malicious link.

Question 3

A SOC analyst is reviewing a firewall log where an internal host repeatedly connected to an external IP address on TCP port 4444 every 60 seconds for several hours. The connections transferred only a few bytes each time. Which characteristic most strongly suggests this is command-and-control beaconing rather than normal user traffic?

Accepted Answer

The connections occur at a highly regular interval with small, consistent payloads. Command-and-control beaconing is defined by automation: the implant contacts its controller on a schedule and exchanges just enough data to receive instructions or confirm liveness. A fixed interval such as every 60 seconds combined with consistently small transfers is far more indicative than port choice, DNS usage, or hosting provider. Those contextual details can support an investigation, but the behavioral regularity is what elevates the traffic from benign to suspicious.

Answer

The external address belongs to a cloud hosting provider rather than an ISP

Answer

The destination port is a well-known service port such as 443

Answer

The internal host resolved the external address through DNS before connecting

Question 4

A security engineer is deploying a new containerized workload in a Kubernetes cluster that is monitored by Prisma Cloud Compute. The engineer needs to ensure that the container cannot escalate privileges by gaining additional capabilities beyond those explicitly granted. Which Kubernetes security context setting should be configured to meet this requirement?

Accepted Answer

Set allowPrivilegeEscalation to false in the container's securityContext.. The allowPrivilegeEscalation setting directly controls whether a process can gain more privileges than its parent. When set to false, it blocks common escalation techniques such as setuid binaries and file capabilities. Prisma Cloud Compute can enforce this setting through its runtime policies, ensuring containers adhere to least privilege.

Answer

Set readOnlyRootFilesystem to true in the container's securityContext.

Answer

Set privileged to true in the container's securityContext.

Answer

Set runAsNonRoot to true in the container's securityContext.

Question 5

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

Accepted Answer

Exploit Protection module monitoring common application memory spaces and blocking anomalous execution flows.. The Exploit Protection module in Cortex XDR monitors common application memory spaces (e.g., browsers, Office, Java) and blocks exploitation techniques such as memory corruption, ROP chains, and shellcode execution before a file is dropped. Because fileless attacks execute directly in memory via vulnerable services, Exploit Protection is specifically designed to detect and block these anomalous execution flows at the exploitation stage.

Answer

Scheduled weekly full disk scans using YARA rules.

Answer

Antivirus signature database matching against known file hashes.

Answer

Browser extension security hardening policies.

Question 6

A security operations center (SOC) analyst receives an alert about a potential data exfiltration attempt. The analyst needs to determine which internal host is communicating with a known malicious IP address and what application is being used. Which PAN-OS feature should the analyst use to quickly correlate the traffic and identify the host and application?

Accepted Answer

Traffic logs filtered by the malicious IP address as destination.. Traffic logs in PAN-OS capture session details including source and destination IP addresses, applications, and ports. By filtering traffic logs for sessions where the destination IP matches the known malicious address, the analyst can immediately see the internal source IP and the application in use. This provides the fastest correlation without needing additional tools. Other logs like Threat or WildFire may not have the necessary session context or may not be generated if no threat signature is triggered.

Answer

User-ID logs to map the IP address to a username.

Answer

WildFire analysis reports for the internal host.

Answer

Threat logs filtered by the malicious IP address as source.

Question 7

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

Accepted Answer

Deploying WAAS as a Defender module integrated with proxy or ingress annotations / container injection. Prisma Cloud WAAS in Kubernetes is deployed as a Defender module that integrates with the ingress controller or a reverse proxy, using annotations and container injection to inspect north-south and east-west traffic. This is the documented supported deployment for containerized microservices behind an ingress. The other options describe unrelated or nonexistent integrations.

Answer

Enabling WAAS via Azure Security Center native policy extension

Answer

Installing WAAS directly onto the physical AWS Nitro security chip

Answer

Configuring AWS Shield Advanced route table scrubbing rules

Question 8

A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?

Accepted Answer

Navigate to Cortex XSIAM > Settings > Data Sources to review agent and collector ingestion health metrics.. Cortex XSIAM's Settings > Data Sources section provides ingestion health metrics for agents, collectors, and brokers, showing whether logs are being received, parsed, and whether any data is being dropped. This is the correct place to verify log collector health and parsing status. It gives visibility into throughput, errors, and source status across all integrated data sources.

Answer

Open the Threat Intelligence management page and verify API token validity.

Answer

Review the GlobalProtect Gateway logs for active tunnel handshakes.

Answer

Check the Panorama > Setup > Operations > Export Panorama Configuration menu.

Question 9

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Accepted Answer

The next-hop IP address advertised by the BGP peer is unreachable in the routing table.. The most common reason a BGP route appears in the RIB-in but is not selected as best is that the next-hop IP address is unreachable. BGP best-path selection requires a valid, reachable next hop; if the next hop cannot be resolved in the routing table (or via a connected/static route), the route is marked as not best and not installed in the forwarding table.

Answer

The firewall's management plane CPU is exceeding 90% utilization.

Answer

The BGP peer is configured in a different autonomous system.

Answer

The Virtual Router does not have OSPF enabled.

Question 10

A SOC analyst notices that an internal server is making repeated DNS queries for randomly generated domain names, and the queries are failing with NXDOMAIN responses. The server is not scheduled to run any new applications. Which type of malicious activity does this pattern MOST likely indicate?

Accepted Answer

A domain generation algorithm used by malware for command-and-control.. Repeated NXDOMAIN responses for randomly generated domains from an unscheduled internal server is a classic indicator of a domain generation algorithm used by malware to find its command-and-control infrastructure. The analyst should treat the host as potentially compromised, isolate it, and investigate for malware. DNS tunneling, load balancing health checks, and resolver DoS do not match the random failing query pattern.

Answer

A misconfigured application performing a DNS-based load balancing health check.

Answer

A DNS tunneling exfiltration channel encoding stolen data in query strings.

Answer

A denial-of-service attack against the internal DNS resolver.