Cybersecurity-Apprentice Practice Test 7 — 10 Questions

Question 1

An administrator is troubleshooting a scenario where BGP routes learned from a peer are not being installed in the Virtual Router's routing table. Upon checking the BGP routing table ('show routing protocol bgp rib-in'), the routes are visible, but they are marked as not best. What is the most common reason for a learned BGP route not to be selected as the best path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The next-hop IP address advertised by the BGP peer is unreachable in the routing table.. BGP route selection depends on attributes like weight, local preference, AS-path length, origin, and MED. If a route is not best, it fails one of these decision criteria or has an unreachable next hop.

Answer

The firewall's management plane CPU is exceeding 90% utilization.

Answer

The BGP peer is configured in a different autonomous system.

Answer

The Virtual Router does not have OSPF enabled.

Question 2

A network administrator needs to prioritize VoIP traffic over bulk file transfers using QoS on a PAN-OS firewall. Where must the QoS profile be applied to shape the traffic effectively?

Accepted Answer

On the egress interface pointing toward the WAN connection.. QoS profile and QoS policy rule are applied on the egress physical interface where traffic leaves the firewall, to manage bandwidth allocation properly.

Answer

On the ingress interface where the bulk file traffic enters the firewall.

Answer

As a global setting inside the Device Management configuration tab.

Answer

Inside the Zone Protection Profile attached to the internal zone.

Question 3

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. The firewall forwards a file for analysis when the file's hash is not found in the local cache or cloud cache, and the file type matches the WildFire analysis profile settings.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 4

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

Accepted Answer

Active sessions are synchronized to the passive peer, allowing seamless traffic continuity without dropping connections.. With HA session synchronization enabled, active stateful TCP and UDP sessions are synchronized to the peer firewall, preventing dropped connections during a failover.

Answer

All active user sessions are immediately terminated and must re-authenticate.

Answer

Management IP addresses are duplicated on both units simultaneously.

Answer

The passive firewall boots up from power-off state to take over.

Question 5

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

Accepted Answer

Reset the user password in Active Directory via integration command.. Compromised credential playbooks typically involve resetting the user's password in Active Directory, revoking active sessions, and notifying the user or manager.

Answer

Factory reset all enterprise core routing switches.

Answer

Format the physical hard drive of the Active Directory Domain Controller.

Question 6

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' CLI command allows administrators to simulate or test source, destination, user, and application parameters against the security policy rules.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions

Question 7

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

Accepted Answer

Offloading security profile pattern matching to dedicated hardware security processors (ASICs/FPGAs).. Hardware offloading and dedicated Single-Pass Parallel Software Architecture (SP3) or hardware acceleration processors (such as security processors on higher-end firewalls) handle signature and pattern matching efficiently.

Answer

Disabling stateful inspection globally across all zones.

Answer

Converting all Layer 3 interfaces to loopback interfaces.

Answer

Configuring static routing to bypass the dataplane entirely.

Question 8

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

Accepted Answer

A Decryption policy rule configured with the 'Forward Proxy' action.. SSL Forward Proxy requires a Decryption policy rule, a Decryption profile (with Forward Proxy action), and a trusted Forward Trust Certificate signed by an internal CA.

Answer

An external BGP routing peer for prefix exchange.

Answer

A GlobalProtect Gateway license installed on the management plane.

Question 9

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

Accepted Answer

Application-based Security policy rules leveraging App-ID inspection.. App-ID uses application decoding, heuristics, and signature matching to identify apps regardless of port, and App-ID signatures accurately detect tunneling protocols.

Answer

Destination IP-based static routing entries.

Answer

SNMP trap forwarding configured on the management interface.

Answer

DHCP relay agent settings on the internal interfaces.

Question 10

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

Accepted Answer

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.. App-ID initially identifies traffic based on initial packets (port/heuristics), and as payload decryption or deeper signature inspection occurs (e.g., SSL handshake or HTTP parsing), App-ID re-evaluates and updates the session application.

Answer

The firewall rebooted mid-session, causing the application cache to reset.

Answer

Static routing tables dynamically updated the next-hop gateway.

Answer

NAT rules translated the source port, forcing an application renegotiation.