Cybersecurity-Apprentice Practice Test 7 — 10 Questions

Question 1

A security team uses Prisma Cloud to monitor an AWS environment. They notice that a newly created S3 bucket is not appearing in Prisma Cloud's resource inventory. The bucket was created 10 minutes ago. The team confirms that the AWS account is onboarded and other resources are visible. What is the MOST likely reason for the delay?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Cloud performs periodic API-based scans, and the next scan has not yet run.. Prisma Cloud CSPM discovers resources by polling cloud provider APIs on a schedule. Newly created resources appear after the next scan cycle, which may take minutes to hours depending on configuration. A manual scan can be triggered to update inventory immediately. Permissions or region issues would cause broader visibility gaps, not a single delayed bucket.

Answer

The S3 bucket is in a region that is not enabled in the Prisma Cloud account settings.

Answer

Prisma Cloud requires an agent to be installed on the S3 bucket to collect data.

Answer

The IAM role used by Prisma Cloud lacks permission to list S3 buckets.

Question 2

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

Accepted Answer

The packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state.. The 'Discard due to zone mismatch' counter indicates that the packet arrived on an interface belonging to a different zone than what is expected by the routing table or existing session state. In Palo Alto Networks firewalls, zones are used to enforce security policies, and if a packet ingresses on an interface in one zone but the routing or session lookup expects it to be in another zone, the firewall drops it. This counter specifically tracks such zone mismatches.

Answer

The security rule destination zone does not match the source zone.

Answer

The NAT policy is translating the packet to an unassigned IP address.

Answer

The Virtual Router has two default routes pointing to different interfaces.

Question 3

A security analyst is investigating a suspected network intrusion. The analyst needs to capture full packet payloads for offline analysis and has physical access to a SPAN port on a switch. Which tool should be used to capture the traffic?

Accepted Answer

tcpdump. tcpdump is a packet capture tool that can record full packet payloads from an interface, including a SPAN port, and save them to a pcap file. NetFlow, SNMP, and Syslog provide metadata or logs but not raw packet content. Therefore, tcpdump is the correct tool for capturing traffic for offline analysis.

Answer

Syslog

Answer

NetFlow

Answer

SNMP

Question 4

A SOC analyst is documenting an incident in which an attacker gained initial access through a phishing email and then created a new local administrator account on a compromised workstation. The analyst must record evidence that supports both the initial access vector and the persistence mechanism. Which TWO artifacts should the analyst collect to support the investigation? (Choose two.)

Accepted Answer

The original email headers and the URL from the phishing message. Documenting this intrusion requires evidence for each phase. The phishing email headers and URL establish the initial access vector, while Windows Security account-management events prove the rogue administrator account was created and identify the responsible actor. Asset tags and desktop appearance are inventory or cosmetic details, and memory from an uninvolved machine cannot speak to actions on the compromised host.

Answer

A full memory dump of the analyst's own triage laptop

Answer

The physical asset tag number of the compromised workstation

Answer

The workstation's current wallpaper and desktop shortcut layout

Question 5

An incident responder is investigating a suspected lateral movement attack where an attacker utilized stolen Kerberos tickets (Pass-the-Ticket). Which log source in Cortex XSIAM or Windows event collection is essential for detecting abnormal Kerberos service ticket requests (Event ID 4769)?

Accepted Answer

Windows Security Event Logs (specifically Event ID 4769 for Kerberos service tickets).. Event ID 4769 is generated on domain controllers whenever a Kerberos service ticket (TGS) is requested, and it is the authoritative record for detecting Pass-the-Ticket activity. Because Pass-the-Ticket abuses valid stolen TGS tickets rather than forging credentials, the only reliable detection point is the Kerberos service ticket request telemetry captured in the Windows Security Event Log. Cortex XSIAM ingests these Windows Security events via its Windows agent or broker, allowing correlation of anomalous 4769 patterns such as unusual service names, encryption downgrades (RC4), or source hosts that never performed a TGT request (4768).

Answer

Prisma Access Cloud DNS query logs.

Answer

PAN-OS GlobalProtect Gateway connection logs.

Answer

Cortex XDR Device Control logs for USB storage insertions.

Question 6

A network security engineer is configuring a new Palo Alto Networks firewall. The company policy requires that all outbound web traffic from the internal network be inspected for threats, but the firewall must not decrypt traffic to banking or healthcare websites due to privacy regulations. The engineer creates a decryption policy rule to exclude those categories. What should the engineer do next to ensure that the excluded traffic is still scanned for threats?

Accepted Answer

Apply a security profile group to the security policy rule that allows the traffic, and ensure the decryption policy rule has no decryption profile.. Threat inspection is performed by security profiles attached to security policy rules. Decryption policy rules only control whether traffic is decrypted. To inspect non-decrypted traffic, the security policy rule allowing that traffic must have the appropriate security profiles applied. The decryption policy rule should exclude the categories without a decryption profile.

Answer

Enable SSL decryption for all traffic and rely on the decryption profile to exempt those categories.

Answer

Attach a vulnerability protection profile to the decryption policy rule.

Answer

Create a separate security policy rule that denies all traffic to banking and healthcare categories.

Question 7

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). The three required parameters for a PAN-OS static route entry are the Route Name (E), the Destination subnet (D), and the Next-hop (C). Option E is correct because every static route in a Virtual Router must be given a unique name to identify it in the routing table and configuration. Option D is correct because a static route must specify the destination IP prefix (network/mask) that the route matches. Option C is correct because the route must define where to forward matching traffic, either via a next-hop IP address or an egress interface. Options A and B are incorrect because BGP AS numbers and OSPF Area IDs are parameters for dynamic routing protocols, not for a static route entry.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID

Question 8

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

Accepted Answer

Principle of Least Privilege. The Principle of Least Privilege (PoLP) states that users and applications should be granted only the minimum access rights necessary to perform their authorized tasks. This directly matches the question's description. PoLP is a foundational cybersecurity principle that reduces the attack surface and limits the potential damage from compromised accounts.

Answer

Zero Trust Architecture

Answer

Defense-in-Depth

Answer

Separation of Duties

Question 9

Which security control is primarily responsible for inspecting decrypted web traffic for known viruses, trojans, and worms entering the network?

Accepted Answer

Antivirus Profile. An Antivirus Profile on a next-generation firewall (e.g., Palo Alto Networks) is the security control specifically designed to inspect decrypted traffic streams for known viruses, trojans, and worms. It uses signature-based detection against a continuously updated threat database to identify and block malicious payloads as they traverse the firewall. This is distinct from URL, data, and zone protection profiles, which address different threat vectors.

Answer

Zone Protection Profile

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Question 10

Which TWO methods are valid ways to access the Command Line Interface (CLI) of a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Serial Console connection using a terminal emulator. Option A is correct because a serial console connection using a terminal emulator (typically 9600-8-N-1 on the console/RJ-45 or USB console port) provides direct out-of-band CLI access to the firewall, which is essential for initial configuration and recovery when network access is unavailable. Option D is correct because SSH to the firewall's management IP address on TCP port 22 is the standard in-band method for remotely accessing the CLI, and it is permitted only on the management interface per Palo Alto Networks' management-plane design. Option B is incorrect because FTP on port 21 is a file transfer protocol and does not provide an interactive CLI session. Option C is incorrect because Telnet is not a supported management protocol on Palo Alto Networks firewalls, and CLI management access is restricted to the management interface, not arbitrary data plane interfaces. Option E is incorrect because an HTTPS session on port 443 accesses the web-based management UI (PAN-OS web interface), not the Command Line Interface.

Answer

FTP file transfer session on port 21

Answer

Telnet connection to any data plane interface

Answer

HTTPS web browser session on port 443