Cybersecurity-Apprentice Practice Questions 1 — 50 Questions

Question 1

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical host hardware and virtualization hypervisor. In an IaaS model, the cloud provider manages the physical data center, physical hardware, networking infrastructure, and virtualization hypervisor.

Answer

Application runtime libraries and code

Answer

Identity and Access Management (IAM) role assignments

Answer

Guest operating system security patches

Question 2

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

Accepted Answer

Prisma Cloud Cloud Security Posture Management (CSPM) Compliance Dashboard. Prisma Cloud CSPM includes pre-built compliance dashboards and reports mapping resource configurations to regulatory frameworks like HIPAA and PCI-DSS.

Answer

WildFire threat intelligence feed

Answer

Prisma Cloud Application Security IDE Plugin

Answer

Prisma Access Cloud Secure Web Gateway

Question 3

A security architect is designing an enterprise logging strategy where all Prisma Cloud audit alerts, vulnerability findings, and compliance violations must be streamed to a third-party SIEM (such as Splunk). Which Prisma Cloud feature should be configured to achieve real-time log export?

Accepted Answer

Prisma Cloud Alert Integrations / Webhooks / SIEM Connectors. Prisma Cloud supports native Integrations (specifically Alert Notifications configured to send JSON payloads via Webhooks, AWS SQS, or pre-built SIEM integrations) to stream findings to external SIEMs.

Answer

Manual CSV export from the Prisma Cloud Asset Inventory dashboard

Answer

GlobalProtect syslog forwarding profiles on VM-Series firewalls

Answer

Twistcli command-line batch reporting scripts executed via cron

Question 4

When onboarding multi-account cloud environments into Prisma Cloud, administrators can choose from several integration methods. Which THREE advantages are gained by setting up centralized cloud account onboarding and role aggregation? (Choose three)

Accepted Answer

Simplifies IAM role maintenance by leveraging organization-level trust relationships. Centralized onboarding simplifies management, ensures consistent security policies, and reduces administrative overhead across large multi-account enterprise structures.

Answer

Enables VM-Series firewalls to route BGP updates directly to the ISP

Answer

Allows Prisma Cloud to directly reboot physical data center servers during hardware failures

Question 5

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

Accepted Answer

Prisma Cloud Auto-Remediation via Cloud Functions / Webhooks. Prisma Cloud RQL (Resource Query Language) alerts can trigger remediation functions via Webhooks or native integrations such as AWS Lambda.

Answer

Prisma Access Remote Network connector

Answer

VM-Series firewall active-passive high availability failover

Answer

WildFire automated sample submission

Question 6

An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)

Accepted Answer

Secret detection to prevent credentials from being hardcoded in serverless source code. Prisma Cloud protects serverless functions by scanning function code and packages for vulnerabilities, protecting against injection attacks, and monitoring runtime behavior.

Answer

Configuring enterprise BGP peering sessions between cloud VPCs and on-premises routers

Answer

Providing dedicated physical server rack space in AWS data centers

Question 7

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

Accepted Answer

Prisma Cloud Application Security. Prisma Cloud Application Security (formerly Prisma Cloud IaC Security) integrates into developer workflows and repositories to scan templates like Terraform and CloudFormation before deployment.

Answer

Prisma Cloud Agentless Scanning

Answer

Prisma Cloud Runtime Defender DaemonSet

Answer

VM-Series Virtual Next-Generation Firewall

Question 8

A security architect is configuring CloudTrail integration for Prisma Cloud across multiple AWS accounts managed through AWS Organizations. Which account deployment method should be used to ensure centralized log ingestion and security posture visibility?

Accepted Answer

Establish a master CloudTrail setup in the management account paired with cross-account IAM roles for Prisma Cloud access. For multi-account AWS environments, utilizing an AWS CloudTrail organizational trail deployed via a StackSets template allows Prisma Cloud to ingest logs efficiently through a designated monitoring account.

Answer

Deploy VM-Series firewalls in every VPC to inspect CloudTrail API payloads locally

Answer

Rely entirely on Prisma Cloud Compute Defenders installed on AWS EC2 instances

Answer

Configure independent CloudTrail logging directly inside each individual member account without cross-account roles

Question 9

An enterprise security team deploys Prisma Cloud Compute across their Kubernetes clusters to enforce security policies. A developer attempts to deploy a privileged pod that violates runtime security policies. Which Prisma Cloud component intercepts and blocks this deployment at the admission controller level?

Accepted Answer

Prisma Cloud Admission Controller Webhook. Prisma Cloud integrates with Kubernetes admission controllers to intercept requests to the API server and block non-compliant pod deployments before they run.

Answer

Prisma Cloud Defender DaemonSet

Answer

Prisma Cloud Console

Answer

AWS IAM policy simulator

Question 10

A security analyst is reviewing compliance posture using Prisma Cloud Compute and needs to secure cloud workloads. According to the shared responsibility model for a containerized application running on AWS Elastic Kubernetes Service (EKS), who is responsible for patching the container OS base image?

Accepted Answer

The customer application development team. When deploying containers, the base image and application dependencies are managed by the customer, whereas the underlying node OS and cluster control plane are managed by the cloud provider or shared.

Answer

The Linux Foundation

Answer

Amazon Web Services

Answer

Prisma Cloud Defender daemonset

Question 11

An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?

Accepted Answer

Classification and protection of data stored within the cloud storage buckets. Regardless of whether a cloud deployment is IaaS, PaaS, or SaaS, the security of data, endpoints, and user access management always remains the responsibility of the customer.

Answer

Physical security of the underlying data center facilities

Answer

Configuration of host-level firewalls in a managed PaaS database

Answer

Hypervisor patching and firmware updates in AWS EC2 instances

Question 12

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

Accepted Answer

Deploying WAAS as a Defender module integrated with proxy or ingress annotations / container injection. Prisma Cloud WAAS can be deployed as part of the Defender injection, sidecar, or integrated into supported API gateways and ingress controllers.

Answer

Enabling WAAS via Azure Security Center native policy extension

Answer

Installing WAAS directly onto the physical AWS Nitro security chip

Answer

Configuring AWS Shield Advanced route table scrubbing rules

Question 13

An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Continuous cloud resource configuration auditing against security benchmarks. Prisma Cloud CSPM focuses on continuous cloud configuration monitoring, compliance reporting, and asset visibility across multi-cloud environments.

Answer

Active runtime container memory dumping and kernel rootkit prevention

Answer

Line-rate Layer 7 decryption of TLS encrypted inbound web traffic

Answer

Remote user secure web gateway DNS tunneling prevention

Question 14

An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)

Accepted Answer

Scanning Terraform, AWS CloudFormation, and Kubernetes YAML templates for misconfigurations. Prisma Cloud Application Security scans infrastructure as code templates, open source dependencies, and CI/CD pipelines to find vulnerabilities before deployment.

Answer

Performing active real-time DDoS mitigation on public BGP routing tables

Answer

Enforcing hardware token multi-factor authentication for corporate VPN users

Question 15

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Proactive risk management includes vulnerability assessments, threat modeling, and indicators of compromise (IOC) monitoring.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 16

What is the primary purpose of deploying a Threat Intelligence platform (TIP) alongside traditional security controls?

Accepted Answer

To aggregate, correlate, and operationalize threat intelligence feeds from multiple external and internal sources.. Threat Intelligence platforms aggregate, normalize, and operationalize threat feeds from multiple sources to improve detection and response.

Answer

To automatically isolate compromised VLANs on network switches using 802.1X.

Answer

To encrypt data at rest on enterprise database servers.

Answer

To provide zero-day malware sandbox detonation for Windows executables.

Question 17

A security analyst receives an alert from Cortex XDR indicating that a suspicious PowerShell script was executed on an employee workstation. Which underlying security telemetry mechanism enabled Cortex XDR to capture the exact process execution tree and command-line arguments?

Accepted Answer

The Cortex XDR endpoint agent monitoring OS kernel events and process behaviors.. The Cortex XDR agent monitors endpoint kernel activities, process creations, and system calls to build detailed execution trees and forensics.

Answer

The GlobalProtect client log export feature.

Answer

The firewall URL Filtering profile inspecting HTTP POST request parameters.

Answer

The User-ID Windows-based User Mapping daemon via WMI polling.

Question 18

A network administrator notices that a critical internal host is continuously communicating with an external Command and Control (C2) server. To mitigate this risk instantly without disrupting all outbound traffic, where should the administrator check to verify if WildFire or Anti-Spyware signatures are actively blocking this specific traffic pattern?

Accepted Answer

Objects > Security Profiles > Anti-Spyware. The Anti-Spyware profile detects and blocks C2 communications and DNS queries associated with malware. Checking the Security policy rule to ensure an Anti-Spyware profile is attached is essential.

Answer

Network > Zones

Answer

Network > Interfaces

Answer

Device > High Availability

Question 19

An administrator notices that traffic between two internal subnets connected to the same Palo Alto Networks firewall is not being inspected by security policies. The interfaces for both subnets are configured as Layer 3. What is the most likely reason for this behavior?

Accepted Answer

There is no explicit Security Policy rule allowing traffic between the two zones.. Traffic between two different Layer 3 interfaces or zones requires an explicit inter-zone Security Policy rule to allow and inspect traffic. If no rule permits it, or if it's implicitly denied, it drops. If intra-zone traffic is being bypassed, intra-zone settings or same-zone handling must be checked, but for inter-subnet (different zones), explicit rules are required.

Answer

Layer 3 interfaces cannot route traffic between internal subnets without an external router.

Answer

The interfaces must be converted to Virtual Wire mode for internal inspection.

Answer

NAT must be configured for all internal-to-internal routing.

Question 20

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

Accepted Answer

GlobalProtect. GlobalProtect is the Palo Alto Networks secure access solution that provides secure remote access via VPN tunnels to endpoints.

Answer

WildFire

Answer

AutoFocus

Answer

Traps agent