Cybersecurity-Apprentice Practice Test 9 — 10 Questions

Question 1

An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SNMP Trap destination. PAN-OS Log Forwarding Profiles support multiple destination types including Syslog, SNMP Trap, Email, and HTTP/HTTPS (such as Cortex Data Lake or API endpoints).

Answer

Bluetooth peer-to-peer relay

Answer

Local BIOS firmware flash memory

Question 2

A security engineer is writing a custom RQL (Resource Query Language) search in Prisma Cloud to find all AWS EC2 instances that do not have encryption enabled on their root volumes. Which RQL query syntax is correct?

Accepted Answer

config from cloud.resource where type = 'aws-ec2-instance' and root.volume.encryption = false. Config RQL queries follow the pattern 'config from cloud.resource where type = ''aws-ec2-instance'' ...'.

Answer

vulnerability from container where crit > 0

Answer

network from cloud.traffic where source.type = 'ec2' and destination.encrypted = false

Answer

event from cloud.audit where operation = 'RunInstances' and encrypted = false

Question 3

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

Accepted Answer

Administration > Access Control > Trusted IP. Prisma Cloud allows administrators to configure trusted IP restrictions under Administration > Access Control to secure access to the console.

Answer

Cloud Accounts > Add Account > Network Security

Answer

Inventory > Asset Explorer > Filters

Answer

Compute > Defend > Access Rules

Question 4

An enterprise has strict compliance requirements requiring visibility into network traffic flows between Kubernetes pods across different namespaces. Which Prisma Cloud Compute feature should be enabled to monitor and enforce layer 7 network segmentation rules inside the cluster?

Accepted Answer

Prisma Cloud Compute Container Firewall / Network Radar. Prisma Cloud Compute provides container firewall capabilities that inspect traffic between pods and enforce layer 3/4 and layer 7 network segmentation rules.

Answer

Prisma Access GlobalProtect gateway

Answer

AWS Security Hub cross-region aggregator

Answer

Prisma Cloud Compute App-Embedded Defender

Question 5

A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)

Accepted Answer

Establishment of network connections to known malicious IP addresses or unexpected ports. Prisma Cloud Compute monitors container runtime activity, detecting unauthorized process execution, file system tampering, and suspicious outbound network connections.

Answer

Physical server hardware temperature anomalies

Answer

AWS IAM policy changes in the underlying cloud management control plane

Question 6

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

Accepted Answer

Prisma Cloud CSPM Resource Configuration Scan. Prisma Cloud CSPM (Cloud Security Posture Management) continuously scans cloud resource configurations to identify misconfigurations and compliance violations against frameworks like CIS.

Answer

WildFire cloud-based analysis service

Answer

Prisma Cloud Compute Defender

Answer

VM-Series firewall URL filtering profile

Question 7

An administrator is reviewing Prisma Cloud agentless scanning capabilities for AWS EC2 instances. What is the primary advantage of utilizing agentless scanning compared to deploying the traditional Defender agent on every workload?

Accepted Answer

It eliminates the need to install and maintain software agents on target virtual machines while maintaining visibility.. Agentless scanning takes EBS snapshots of instances to analyze OS packages, vulnerabilities, and configurations without requiring software installation inside the running operating system.

Answer

It enables active SSL decryption of all inbound TLS traffic on public load balancers.

Answer

It provides real-time layer 7 container runtime process execution blocking.

Answer

It replaces the need for cloud provider API integrations entirely.

Question 8

A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)

Accepted Answer

Resource configuration history tracking changes to IAM policies and security groups (Config RQL). Detecting compromised cloud credentials and privilege escalation involves analyzing cloud audit logs, resource configuration states, and user behavior analytics.

Answer

Automatic kernel-level defragmentation of enterprise database storage volumes

Answer

GlobalProtect client certificate revocation list distribution

Question 9

An auditor notices that a cloud account onboarded to Prisma Cloud has generated numerous alerts for unused IAM access keys. Which underlying Prisma Cloud data source is evaluated to detect this condition?

Accepted Answer

AWS IAM Credential Report and Cloud Provider Asset Configuration Metadata. Prisma Cloud evaluates AWS IAM credential report data and cloud audit logs to identify inactive or unused access keys.

Answer

Container runtime audit logs captured by Admission Controllers

Answer

Flow logs captured by VM-Series virtual firewalls

Answer

WildFire cloud sandbox behavioral analysis reports

Question 10

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

Accepted Answer

Use the twistcli utility in the CI/CD pipeline to scan images before registry push. Integrating Prisma Cloud into CI/CD pipelines is achieved by utilizing the twistcli utility to scan container images during the build phase and fail the build if vulnerabilities exceed defined thresholds.

Answer

Enable AWS GuardDuty anomaly detection on the container registry repository

Answer

Configure Prisma Cloud CSPM to delete unencrypted container registries automatically via AWS Lambda

Answer

Install the Prisma Cloud Defender DaemonSet on the CI/CD build runner worker nodes