Cybersecurity-Apprentice Practice Questions 1 — 50 Questions

Question 1

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Option A is correct because regular vulnerability assessments and penetration testing proactively identify exploitable weaknesses in systems and applications before attackers can leverage them, directly supporting risk assessment and remediation prioritization. Option B is correct because ingesting and monitoring Indicators of Compromise (IOCs) such as malicious IPs, domains, file hashes, and URLs from trusted threat intelligence feeds enables early detection of active threats and enriches SIEM/EDR correlation. Option D is correct because threat modeling during application design (e.g., using STRIDE or PASTA) anticipates attack vectors and informs security requirements before code is written, which is a core proactive risk management practice. Option C is incorrect because removing user access controls violates least privilege and dramatically increases risk rather than managing it. Option E is incorrect because permanently disabling logging destroys the audit trail and telemetry needed for detection, investigation, and compliance, and log overflow should instead be handled via retention policies, rotation, and capacity planning.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 2

A security analyst is examining network traffic logs and notices that an internal host is sending a large number of SYN packets to multiple external IP addresses on port 80, but never completing the TCP handshake. The analyst suspects a SYN flood attack originating from the internal host. Which security feature should the analyst configure on the firewall to mitigate this type of attack?

Accepted Answer

Zone Protection profile with SYN flood protection enabled on the internal zone.. Zone Protection profiles are designed to defend against network-layer attacks such as SYN floods, ICMP floods, and port scans. Enabling SYN flood protection on the zone where the internal host resides allows the firewall to monitor and limit SYN packet rates, using techniques like SYN cookies or random early drop. This mitigates the attack without blocking all traffic from the host, preserving legitimate connectivity.

Answer

QoS profile with a maximum bandwidth limit for the internal host.

Answer

Security policy rule that denies all outbound traffic from the internal host.

Answer

DoS Protection profile applied to the Security policy rule allowing the traffic.

Question 3

A network engineer configures Equal-Cost Multi-Path (ECMP) routing on a Palo Alto Networks virtual router with two paths to the same destination. By default, how does PAN-OS select which path to use for a given session?

Accepted Answer

Based on a hash of session parameters (IP addresses, ports, and protocol). PAN-OS uses a session-based hash of the 5-tuple (source IP, destination IP, source port, destination port, protocol) to select one of the ECMP next-hops for a flow. Because the hash is deterministic per session, all packets belonging to the same session take the same path, preserving stateful inspection and avoiding out-of-order delivery. This is the default ECMP behaviour in a PAN-OS virtual router.

Answer

Round-robin packet by packet

Answer

Random selection for every individual packet

Answer

Based on the lowest interface latency measured by ICMP probes

Question 4

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

Accepted Answer

Review the Cortex XDR Causality Chain and Timeline view for the affected endpoint.. The Cortex XDR Causality Chain and Timeline view reconstructs the full sequence of events — process creation, network connections, file writes, registry changes — linked by causality (parent-child process relationships) for a specific endpoint and alert. This is the purpose-built investigative surface for understanding malware execution flow chronologically. It lets the analyst pivot from the initial alert to root cause and downstream impact in one view.

Answer

Run a vulnerability scan against the endpoint using Panorama compliance tools.

Answer

Examine the DHCP lease table on the core routing switch.

Answer

Export the firewall Traffic Log CSV and sort by destination port numbers.

Question 5

An administrator is hardening a Linux web server that faces the internet. The goal is to reduce the attack surface by ensuring only the ports required for HTTPS management and web traffic are reachable, while all other inbound connection attempts are silently dropped. Which control should be implemented on the server itself?

Accepted Answer

A host-based firewall configured to allow only TCP 443 and the management port, with a default deny policy. A host-based firewall with a default deny policy and explicit allow rules for the required ports enforces reachability at the server itself. It permits HTTPS web traffic and management access while silently dropping every other inbound connection attempt, which is the precise way to shrink the attack surface of an internet-facing host.

Answer

Full disk encryption on the server's data volume

Answer

An intrusion detection system running in promiscuous mode on the server

Answer

A web application firewall placed in front of the server

Question 6

A junior security administrator is asked to verify that the Cortex XDR agent on a Windows endpoint is able to receive updated prevention policies from the cloud. The administrator checks the agent status in the Cortex XDR console and sees that the endpoint is listed as 'Connected' but the last policy update was over 30 days ago. Which action should the administrator take first to ensure the agent receives the latest policies?

Accepted Answer

Check the endpoint's group assignment and policy rules in the Cortex XDR console.. Policy updates in Cortex XDR are managed through endpoint groups and the policies applied to them. If an endpoint is connected but not receiving updates, the most likely cause is misassignment to a group with outdated or no policies. Checking the group and policy configuration is the correct first troubleshooting step, as it is non-disruptive and targets the actual mechanism for policy distribution.

Answer

Manually update the agent software to the latest version.

Answer

Restart the Windows endpoint to force a policy sync.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Question 7

A university campus network uses a Cisco Catalyst switch stack for its student residence halls. Network operations notices that students are plugging personal wireless routers into wall jacks, causing loops and DHCP conflicts. The team wants a control that limits each wall jack to a single learned MAC address and shuts the port down (err-disabled) if a second MAC is seen. Which feature should be configured on the access ports?

Accepted Answer

Port security with a maximum of one MAC address and violation mode shutdown. Port security is the Layer 2 control that caps the number of source MAC addresses an interface can learn. Configuring the maximum to one with the shutdown violation mode err-disables the access port the moment a second MAC appears. This precisely stops students from attaching personal routers that bridge multiple devices and generate loops on the residence hall wall jacks.

Answer

Dynamic ARP Inspection on the student VLAN

Answer

BPDU Guard enabled on the access ports

Answer

DHCP snooping with a trusted uplink

Question 8

A cloud operations team at a healthcare company stores patient records in an Amazon S3 bucket. An auditor asks the security administrator to confirm that the data is encrypted at rest and that the organization controls the encryption keys. Which AWS service should the administrator use to meet this requirement?

Accepted Answer

AWS Key Management Service (AWS KMS) customer managed keys. Customer managed keys in AWS KMS allow an organization to define key policies, enable automatic rotation, and audit key usage through CloudTrail, while S3 server-side encryption with SSE-KMS protects objects at rest. Because the auditor demands organizational control of the keys, S3 managed keys, TLS certificates, and data discovery tooling do not meet the stated requirement.

Answer

Amazon S3 default encryption with Amazon S3 managed keys (SSE-S3)

Answer

AWS Certificate Manager (ACM) public certificates

Answer

Amazon Macie sensitive data discovery jobs

Question 9

A small business wants to let remote employees reach an internal file server without exposing it directly to the internet. The administrator plans to place a device at the network edge that terminates encrypted tunnels from employee laptops and forwards their traffic onto the internal LAN. Which technology best fits this requirement?

Accepted Answer

A remote-access VPN concentrator that terminates client tunnels. A remote-access VPN concentrator is designed to terminate encrypted tunnels from individual clients and place their traffic onto the internal network. It gives roaming employees access to internal resources such as a file server while keeping that server unreachable directly from the internet, which is exactly the edge design described.

Answer

A reverse proxy placed in front of the file server

Answer

A network address translation rule on the edge router

Answer

A site-to-site IPsec VPN between two branch offices

Question 10

A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?

Accepted Answer

A runtime rule that blocks the execution of specific processes, such as /bin/sh, within the container.. Preventing a shell from executing after a container starts is a runtime enforcement task. Prisma Cloud Compute runtime rules can block specific processes by name or path, so a rule that denies /bin/sh stops interactive shell access while leaving the application process unaffected. Configuration and vulnerability checks do not enforce behavior at runtime.

Answer

A vulnerability rule that flags images containing shell binaries with known CVEs.

Answer

An admission controller rule that rejects pods whose security context allows privilege escalation.

Answer

A compliance policy that checks whether the container image is built from a minimal base image.

Question 11

An organization wants to ensure that sensitive data stored on employee laptops remains confidential even if a laptop is lost or stolen. The data must be unreadable without the correct credentials. Which security control should be implemented?

Accepted Answer

Full-disk encryption. Full-disk encryption ensures that data at rest is encrypted and cannot be read without the proper key. This directly protects confidentiality if a laptop is lost or stolen. The other options are detective or preventive controls for other purposes but do not encrypt data on the device.

Answer

File integrity monitoring

Answer

Security information and event management (SIEM)

Answer

Data loss prevention (DLP)

Question 12

A SOC analyst notices that several endpoint alerts share the same file hash and were triggered on different hosts within a short period. Before escalating, the analyst wants to confirm whether this hash is known malware and gather context about its behavior. Which resource should the analyst consult first for this enrichment?

Accepted Answer

A threat intelligence platform or malware analysis service that maps the hash to known campaigns and behaviors. File hashes are ideal pivot points for enrichment because they are stable identifiers. A threat intelligence or malware analysis service maps a hash to known families, campaigns, and behaviors, which lets the analyst assess severity and escalate with context. Quarantine folders, change tickets, and network traffic dashboards serve other purposes and do not directly answer whether the hash is a known threat.

Answer

The firewall's application command center for outbound session volume trends

Answer

The organization's change management ticketing system for recent software deployments

Answer

The endpoint agent's local quarantine folder on each affected host

Question 13

An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?

Accepted Answer

Create a profile exception using the specific file hash or behavioral signature parameters identified in the alert.. The correct best practice is to create a profile exception scoped to the specific file hash or behavioral signature identified in the alert. This suppresses the false positive without weakening protection for other files or behaviors. Cortex XDR supports exceptions at the profile level (e.g., Malware, Exploit, Restriction profiles) so the legitimate admin tool is allowlisted only where needed. This preserves detection fidelity while eliminating recurring noise.

Answer

Uninstall the Cortex XDR agent from all endpoints in that department.

Answer

Delete the alert from the incident queue without taking action.

Answer

Set the entire Cortex XDR agent fleet to Audit mode permanently.

Question 14

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures between the Cortex XDR agent and the management server almost always point to a trust or interception issue. If a proxy or firewall performs TLS inspection (decryption) and the Cortex XDR root certificate is not installed in the agent's trust store, the agent rejects the proxy's re-signed certificate and the handshake fails, which matches the observed symptoms.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 15

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust rejects the idea of a trusted internal network, so Option B is correct because inspecting and logging all traffic on every port and protocol with App-ID and Threat Prevention ensures no flow is blindly trusted and that application-layer visibility and threat detection apply universally. Option C is correct because Zero Trust requires micro-segmentation, and using zones and virtual routers on Palo Alto firewalls creates granular micro-perimeters that contain lateral movement between workloads. Option E is correct because Zero Trust enforces least-privilege access decisions based on user identity, application, and content rather than IP address or network location, which is exactly what Palo Alto's User-ID and App-ID enable. Option A is wrong because implicitly trusting internal-zone traffic is the traditional castle-and-moat assumption that Zero Trust explicitly eliminates. Option D is wrong because relying only on perimeter firewalls and leaving internal lateral traffic uninspected contradicts Zero Trust's requirement to inspect east-west traffic and assume breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 16

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

Accepted Answer

The Incidents tab in the Cortex XDR management console.. The Incidents tab in the Cortex XDR management console is where correlated alerts are grouped into incidents, enriched with causality chains, and mapped to MITRE ATT&CK techniques — including Command and Control (TA0011) tactics such as T1071 Application Layer Protocol and T1571 Non-Standard Port. Analysts use this view to see which endpoints are communicating with known C2 infrastructure and to pivot into the causal chain for investigation.

Answer

The Dashboards tab under System Settings on the firewall.

Answer

The User-ID Agent status page.

Answer

The ACC (Application Command Center) threat map on Panorama.

Question 17

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

Accepted Answer

An Interface Management Profile assigned to the interface. To allow a Palo Alto Networks firewall interface to respond to ICMP echo requests (ping) for diagnostics, an Interface Management Profile must be created and assigned to that interface. The profile explicitly enables management services like Ping, Telnet, SSH, HTTP, HTTPS, and SNMP on the interface.

Answer

A Security Policy rule with an application of 'ping'

Answer

A Zone Protection Profile applied to the egress zone

Answer

The Device > Setup > Management tab

Question 18

A new cybersecurity apprentice is asked to classify the following event: an employee receives an email that appears to come from the IT department, asking them to click a link and reset their password immediately or their account will be disabled. The link leads to a fake login page that captures credentials. Which type of attack best describes this scenario?

Accepted Answer

Phishing. The scenario describes a deceptive email that impersonates IT and pressures the user to enter credentials on a fake page. This is a phishing attack, which relies on social engineering rather than technical exploitation. The other choices describe different attack categories that do not match the observed behavior.

Answer

Man-in-the-middle (MITM)

Answer

SQL injection

Answer

Denial-of-service (DoS)

Question 19

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire Portal provides a public and private cloud analysis search interface where analysts can manually submit or look up a file hash (MD5, SHA-1, or SHA-256) to see whether WildFire has previously analyzed it and what verdict was returned. This is the standard manual hash lookup method in the Palo Alto Networks ecosystem. It is distinct from automated WildFire forwarding configured on firewalls.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 20

A security engineer is hardening an Amazon EC2 instance that hosts a public-facing web application. The engineer wants to reduce the attack surface at the network and host layers. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Attach a security group that allows inbound traffic only on ports 80 and 443 from the internet, and restrict all other inbound ports.. Hardening an EC2 instance requires both network-level and host-level reductions in exposure. A restrictive security group limits which inbound ports are reachable from the internet, while removing unnecessary services and packages eliminates host-level entry points. Monitoring and backup actions, such as CloudTrail, AMIs, and CloudWatch, support detection and recovery but do not shrink the attack surface.

Answer

Create an Amazon Machine Image (AMI) backup of the instance before making changes.

Answer

Enable AWS CloudTrail to record all API calls made in the account.

Answer

Enable detailed monitoring in Amazon CloudWatch for the instance.