Cybersecurity-Apprentice Practice Test 8 — 10 Questions

Question 1

A company is preparing an incident response plan. The security team wants to ensure that when a critical server is compromised, they can determine what happened, contain the threat, and restore normal operations. The team is defining the phases of the incident response lifecycle. Which sequence correctly represents the standard incident response phases?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preparation, Detection and Analysis, Containment Eradication and Recovery, Post-Incident Activity. The standard incident response lifecycle begins with preparation, then detection and analysis, followed by containment, eradication, and recovery, and ends with post-incident activity. Preparation ensures tools and plans are ready, analysis confirms and scopes the incident, containment limits damage, eradication removes the threat, recovery restores service, and the post-incident review improves future response.

Answer

Preparation, Containment, Detection and Analysis, Post-Incident Activity, Recovery

Answer

Containment, Preparation, Detection and Analysis, Recovery, Post-Incident Activity

Answer

Detection and Analysis, Preparation, Recovery, Containment, Post-Incident Activity

Question 2

A SOC analyst receives an alert from Cortex XSIAM indicating a possible brute-force attack against a user account. The analyst wants to quickly see the raw log events that triggered the alert. Which Cortex XSIAM component should the analyst use to view the underlying log data?

Accepted Answer

Log Search. Log Search in Cortex XSIAM is the component that enables analysts to query and view raw log events. By searching for the user account and relevant time frame, the analyst can see the exact events that triggered the brute-force alert. This is essential for verifying the alert and understanding the attack details.

Answer

Automation Rules

Answer

Incident View

Answer

Threat Intelligence

Question 3

A security analyst receives an alert from Cortex XDR indicating that a suspicious PowerShell script was executed on an employee workstation. Which underlying security telemetry mechanism enabled Cortex XDR to capture the exact process execution tree and command-line arguments?

Accepted Answer

The Cortex XDR endpoint agent monitoring OS kernel events and process behaviors.. Cortex XDR relies on its lightweight endpoint agent (the Cortex XDR agent) that hooks into OS kernel-level events—such as process creation, image loads, and command-line arguments—to build a detailed process execution tree. This telemetry is captured via kernel callbacks (e.g., Windows ETW, Linux eBPF) and sent to the Cortex XDR management console for analysis. Only an endpoint agent with kernel visibility can reconstruct the exact parent-child process relationships and full command-line arguments, which is why option A is correct.

Answer

The GlobalProtect client log export feature.

Answer

The firewall URL Filtering profile inspecting HTTP POST request parameters.

Answer

The User-ID Windows-based User Mapping daemon via WMI polling.

Question 4

An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?

Accepted Answer

Causation Analysis view showing the graphical chain of events originating from the root cause process.. Cortex XDR's Causation Analysis view reconstructs the attack chain by graphically linking events to the root cause process, showing how initial access led to lateral movement and persistence. It is specifically designed to answer 'how did this happen?' by tracing process ancestry and related activity across endpoints, which is exactly what the incident response team needs to visualize the full APT lifecycle.

Answer

Windows Event Viewer custom filtered operational logs.

Answer

Network packet capture waveform analyzer.

Answer

Global Threat Intelligence map showing country-of-origin IP addresses.

Question 5

A cloud security engineer is configuring Prisma Cloud to monitor a multi-cloud environment consisting of AWS, Azure, and Google Cloud. The engineer wants to ensure that Prisma Cloud can continuously assess the security posture of resources across all three providers. Which TWO actions are required to onboard these cloud accounts for posture management? (Choose two.)

Accepted Answer

Create a read-only role or service principal in each cloud account with the necessary permissions for Prisma Cloud to inventory resources.. To onboard cloud accounts for posture management, Prisma Cloud needs read-only API credentials and the accounts added to the console. Then, enabling compliance standards activates policy evaluation. These two actions ensure Prisma Cloud can discover resources and assess them against security benchmarks, providing continuous multi-cloud visibility.

Answer

Deploy Prisma Cloud Compute agents on every virtual machine in each cloud account.

Answer

Set up a VPN connection between each cloud environment and the Prisma Cloud console.

Answer

Install the Prisma Cloud app from each cloud provider's marketplace.

Question 6

A Tier-1 SOC analyst receives an alert from the SIEM indicating a possible brute-force attack against the domain controller. The analyst needs to follow the standard incident response process. According to NIST SP 800-61, which phase of the incident response lifecycle involves determining whether an event is actually an incident and its scope?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase is where analysts validate alerts, determine if an event qualifies as an incident, and assess its scope. This matches the scenario where the analyst must decide if the brute-force alert is a real incident. Other phases occur before or after this critical validation step.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 7

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

Accepted Answer

To automatically analyze unknown files and samples submitted by endpoints to determine if they are malicious.. WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service. Within Cortex XDR, it automatically detonates and analyzes unknown files and samples submitted by endpoints in a sandboxed environment, returning verdicts (malicious, benign, grayware) and generating signatures that are shared across the ecosystem. This gives endpoints protection against zero-day and evasive malware that signature-based detection would miss.

Answer

To provide local disk defragmentation services.

Answer

To enforce multi-factor authentication for endpoint login sessions.

Answer

To manage firewall security policies across multiple tenants.

Question 8

A SOC analyst is investigating a potential data exfiltration incident. The analyst observes that a workstation has been communicating with an external IP address using DNS queries that contain long, random-looking subdomains. The volume of these queries is high, and the subdomains change frequently. Which type of attack is most likely occurring?

Accepted Answer

DNS tunneling for data exfiltration. The scenario describes a workstation sending numerous DNS queries with long, random subdomains to an external IP. This behavior is typical of DNS tunneling, where attackers encode stolen data into DNS queries to bypass network defenses. The high volume and changing subdomains indicate data exfiltration over DNS, making DNS tunneling the most likely attack.

Answer

Domain Generation Algorithm (DGA) communication

Answer

Fast flux DNS

Answer

DNS cache poisoning

Question 9

A cloud security analyst is reviewing the shared responsibility model for a public cloud environment. The analyst needs to identify which security tasks are the responsibility of the cloud customer. Which of the following is a customer responsibility?

Accepted Answer

Configuring security groups and network ACLs. In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes configuring virtual network controls like security groups and network ACLs. The provider is responsible for security 'of' the cloud, including physical and infrastructure security.

Answer

Patching the hypervisor and host operating system

Answer

Maintaining the global network backbone

Answer

Managing the physical security of data centers

Question 10

Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)

Accepted Answer

Apple macOS. The standard Cortex XDR agent is officially supported on Apple macOS (option C), since Palo Alto Networks provides a native macOS endpoint agent for both Intel and Apple Silicon systems. It is also officially supported on Microsoft Windows 10 and Windows 11 (option D), which are core supported desktop platforms for the Cortex XDR agent. Options A and B are incorrect because embedded automotive CAN bus microcontrollers and commercial airliner avionics flight control firmware are specialized real-time/embedded environments not supported by the standard Cortex XDR agent. Option E is incorrect because consumer smart refrigerator operating systems are embedded IoT platforms outside the agent's supported OS matrix.

Answer

Embedded automotive CAN bus microcontrollers

Answer

Commercial airliner avionics flight control firmware

Answer

Consumer smart refrigerator operating systems