Cybersecurity-Apprentice Practice Test 9 — 10 Questions

Question 1

An administrator observes that CPU utilization on the dataplane is spiking due to extensive regular expression inspections in security profiles. Which feature can be leveraged to optimize inspection performance on supported hardware models?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Offloading security profile pattern matching to dedicated hardware security processors (ASICs/FPGAs).. Offloading security profile pattern matching to dedicated hardware such as ASICs or FPGAs moves regex inspection off the general-purpose dataplane CPU, dramatically reducing utilization while maintaining inspection depth. Supported PAN-OS hardware models include dedicated security processors specifically designed for this workload. This is the correct optimization for CPU spikes caused by extensive regex inspections.

Answer

Disabling stateful inspection globally across all zones.

Answer

Converting all Layer 3 interfaces to loopback interfaces.

Answer

Configuring static routing to bypass the dataplane entirely.

Question 2

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

Accepted Answer

show counter global filter packet-drop yes. The command 'show counter global filter packet-drop yes' displays global counters related to packet drops in real time, allowing the administrator to see if the firewall is dropping packets and the reason (e.g., security policy deny, threat, etc.). This is the standard PAN-OS CLI troubleshooting command for verifying drop counters. It filters the global counter output to show only drop-related counters, which is exactly what is needed to diagnose a security rule denial.

Answer

show system resources

Answer

show session all

Answer

show interface all

Question 3

A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?

Accepted Answer

BIOC alerts detect suspicious sequences of system events and behaviors rather than matching known file signatures.. BIOC (Behavioral Indicator of Compromise) alerts are generated by the Cortex XDR Behavioral Analytics engine, which correlates sequences of endpoint events (process creation, file writes, registry changes, network connections) against behavioral rules rather than static file signatures. This allows detection of fileless malware, living-off-the-land techniques, and novel attack chains that signature-based AV would miss. Standard malware alerts, by contrast, rely on hash or signature matching.

Answer

BIOC alerts are generated exclusively by network firewall threat logs.

Answer

BIOC alerts only trigger when a user manually initiates a full system scan.

Answer

BIOC alerts require an active WildFire cloud subscription to function locally.

Question 4

A network engineer is analyzing a packet capture and observes that a workstation sends a TCP segment with the SYN flag and a destination port of 443 to a web server. The server responds with SYN-ACK, and the workstation completes the handshake with ACK. Shortly after, the workstation sends a segment with the RST flag. Which statement best describes what the RST segment indicates in this scenario?

Accepted Answer

The workstation is abruptly terminating the TCP connection or rejecting further data.. The RST flag in TCP signals an abrupt reset, terminating a connection or rejecting traffic. After a successful three-way handshake, a RST from the workstation means it is closing the session immediately or refusing further segments, often due to an application crash or a packet arriving at a closed port. FIN, by contrast, indicates graceful closure, and retransmissions or TLS negotiation use different mechanisms entirely.

Answer

The workstation is retransmitting a lost segment to the server.

Answer

The workstation is requesting a graceful, orderly shutdown of the session.

Answer

The workstation is negotiating encryption parameters for the session.

Question 5

An administrator configures a WildFire analysis profile and attaches it to a Security policy rule. Under what condition does the firewall forward a sample to the WildFire cloud?

Accepted Answer

When the file hash is unknown to the global cloud cache and matches configured file type forwarding rules.. WildFire forwards a sample only when the firewall cannot identify the file by hash in the WildFire global cloud cache and the file type matches the forwarding rules configured in the WildFire analysis profile. This prevents redundant uploads of already-known files and limits submissions to file types the administrator has explicitly enabled (e.g., PE, PDF, Office, APK). The firewall computes the SHA-256 hash, checks the local cache and the WildFire cloud, and only uploads on a cache miss.

Answer

Whenever a session exceeds maximum packet length thresholds.

Answer

Only when an Antivirus signature explicitly fails to scan the file.

Answer

Every time any user downloads a standard PDF document.

Question 6

An administrator wants to inspect HTTPS traffic originating from an internal network segment without triggering certificate warnings on user browsers. What is the mandatory deployment prerequisite on the Palo Alto Networks firewall?

Accepted Answer

Configure an SSL Forward Proxy profile and ensure the firewall's Forward Trust Certificate is trusted by the client endpoints.. SSL Forward Proxy decryption is the Palo Alto feature designed to inspect outbound HTTPS traffic from internal users. The firewall acts as a man-in-the-middle: it presents a certificate signed by its Forward Trust Certificate to the client, then establishes its own TLS session to the destination server. For browsers to accept this substitution silently, the Forward Trust Certificate (or its issuing CA) must be installed as a trusted root in the client trust stores.

Answer

Install a self-signed certificate generated solely by the firewall on all endpoints as a trusted root CA.

Answer

Deploy SSH Proxy decryption rules to intercept TLS handshakes.

Answer

Enable SSL Inbound Inspection using the public certificate of the destination web server.

Question 7

A compliance officer needs to verify whether cloud storage buckets across AWS and Azure meet corporate encryption standards. Which Prisma Cloud module provides out-of-the-box compliance reporting against standards such as HIPAA and PCI-DSS?

Accepted Answer

Prisma Cloud Cloud Security Posture Management (CSPM) Compliance Dashboard. Prisma Cloud's Cloud Security Posture Management (CSPM) Compliance Dashboard is purpose-built to continuously assess cloud resources across AWS, Azure, GCP, and others against regulatory and industry standards including HIPAA, PCI-DSS, GDPR, and CIS Benchmarks. It surfaces misconfigurations such as unencrypted storage buckets and maps them to specific compliance controls, giving the compliance officer out-of-the-box reporting.

Answer

WildFire threat intelligence feed

Answer

Prisma Cloud Application Security IDE Plugin

Answer

Prisma Access Cloud Secure Web Gateway

Question 8

During a routine audit, a SOC supervisor wants to ensure that all administrative logins to Panorama and managed firewalls are centrally tracked and securely archived. Which log type in the PAN-OS logging architecture records administrator login sessions and configuration changes?

Accepted Answer

Configuration and System logs.. In PAN-OS, Configuration logs record administrator configuration changes, and System logs record administrator login/logout sessions and system events. Together, the Configuration and System log types provide the centralized tracking and secure archiving of administrative logins and config changes that the SOC supervisor requires.

Answer

WildFire Submission and Analysis logs.

Answer

Data Filtering and GTP logs.

Answer

Threat and URL Filtering logs.

Question 9

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

Accepted Answer

Prisma Cloud Auto-Remediation via Cloud Functions / Webhooks. Prisma Cloud Auto-Remediation uses cloud-native functions (such as AWS Lambda) or webhooks to automatically respond to policy violations, including remediating public S3 buckets by applying block-public-access settings or modifying bucket ACLs/policies. This is the feature designed specifically for automated remediation workflows.

Answer

Prisma Access Remote Network connector

Answer

VM-Series firewall active-passive high availability failover

Answer

WildFire automated sample submission

Question 10

A security analyst at a healthcare company needs to confirm that its cloud storage buckets comply with the HIPAA security rule. The company uses Prisma Cloud to monitor its AWS environment. Which Prisma Cloud capability should the analyst use to continuously evaluate the configuration of those S3 buckets against HIPAA controls?

Accepted Answer

Prisma Cloud Compliance Standards and Reports. Prisma Cloud Compliance Standards and Reports provide out-of-the-box mapping to regulations like HIPAA. By enabling the HIPAA standard, the analyst can continuously monitor S3 buckets for violations such as missing encryption or public access. This gives a clear, auditable view of compliance posture, which is essential for protecting ePHI in AWS.

Answer

Prisma Cloud anomaly detection policies for user behavior

Answer

Prisma Cloud alert rules based on severity

Answer

Prisma Cloud Compute runtime defense rules