Cybersecurity-Apprentice Cybersecurity Fundamentals Practice Test 2 — 15 Questions

Question 1

A security engineer is configuring User-ID on a Palo Alto Networks firewall to ensure granular security policies can be enforced based on Active Directory group membership. Which TWO methods can the firewall use to map IP addresses to usernames? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Captive Portal authentication for unmapped client IP addresses.. PAN-OS User-ID can map IP addresses to usernames using various mechanisms including User-ID Agents, Syslog parsing, Windows-based session tracking, and Captive Portal.

Answer

Direct NetFlow v9 export collection from edge routers.

Answer

DNS zone transfer requests sent directly to primary domain controllers.

Answer

Static ARP table polling via SNMP v3 queries to core switches.

Question 2

An organization is preparing for a security audit and wants to ensure robust defense-in-depth measures are active on their Palo Alto Networks firewalls. Which TWO security profiles protect against protocol manipulation, evasion techniques, and vulnerability exploitation? (Choose two)

Accepted Answer

Vulnerability Protection Profile. The Vulnerability Protection Profile (C) is correct because it inspects traffic for exploits targeting known software vulnerabilities (e.g., buffer overflows, code execution) and applies rules to block or alert on them, directly addressing vulnerability exploitation. The Anti-Spyware Profile (E) is correct because it detects and blocks protocol manipulation and evasion techniques used by command-and-control traffic, such as DNS tunneling, and also scans for spyware downloads and C2 callbacks. Together, these two profiles provide the required defense-in-depth against evasion and exploitation. The URL Filtering Profile (A) only controls access to web categories and does not inspect for protocol evasion or exploits. The Data Filtering Profile (B) prevents sensitive data leakage by pattern matching, not protocol manipulation. The File Blocking Profile (D) blocks file transfers by type but does not analyze protocol anomalies or vulnerability exploits.

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Answer

File Blocking Profile

Question 3

An administrator is troubleshooting an issue where specific applications are failing to pass through a Palo Alto Networks firewall. Panorama and firewall logs show 'nolog' or dropped packets due to security policy denials. Which THREE CLI commands are most useful for diagnosing policy evaluation and traffic flow issues? (Choose three)

Accepted Answer

test security-policy-match source [ip] destination [ip] destination-port [port] protocol [proto]. Key CLI commands for traffic troubleshooting include 'test security-policy-match', 'show session id', and 'show counter global'.

Answer

debug software memory allocation dump

Answer

request system factory-reset keep-user-settings

Question 4

An administrator is managing firewall configurations across a large enterprise using Panorama. Which TWO configuration components are typically managed at the Panorama template level rather than the device group level? (Choose two)

Accepted Answer

Network interface assignments and security zone definitions.. Panorama templates manage network and device settings (interfaces, virtual routers, zones), while device groups manage policy and object settings (security rules, address objects, security profiles).

Answer

Security policy rules and Network object definitions.

Answer

Antivirus and WildFire security profile thresholds.

Answer

Log forwarding profile destinations and SNMP trap server IP settings.

Question 5

An enterprise security architect is reviewing the network design for a multi-tenant cloud environment protected by VM-Series firewalls. Which THREE design considerations are critical for maintaining high availability and resilience in a cloud deployment? (Choose three)

Accepted Answer

Using AWS Gateway Load Balancer (GWLB) or Azure Load Balancer to dynamically distribute traffic across firewall clusters.. Cloud HA and resilience require resilient load balancer integration (like AWS Gateway Load Balancer), multi-AZ deployments, and automated bootstrap configuration.

Answer

Configuring static Layer 2 spanning tree protocol (STP) across all cloud VPC peering links.

Answer

Relying entirely on physical bypass network taps for cloud virtual interfaces.

Question 6

A network administrator notices that a critical internal host is continuously communicating with an external Command and Control (C2) server. To mitigate this risk instantly without disrupting all outbound traffic, where should the administrator check to verify if WildFire or Anti-Spyware signatures are actively blocking this specific traffic pattern?

Accepted Answer

Objects > Security Profiles > Anti-Spyware. Anti-Spyware and WildFire signature-based blocking is configured and verified under Objects > Security Profiles > Anti-Spyware, where the administrator can confirm the profile is attached to the relevant security rule and that C2 signatures are set to block. This is the correct location to inspect whether the specific C2 traffic pattern is being matched and dropped.

Answer

Network > Zones

Answer

Network > Interfaces

Answer

Device > High Availability

Question 7

A security architect is designing a multi-tenant cloud environment protected by VM-Series firewalls. To enforce strict segmentation between tenant zones that share the same physical interface, which core Palo Alto Networks feature must be configured first?

Accepted Answer

Virtual Systems (vsys). Virtual Systems (vsys) allow a single physical or virtual firewall to be partitioned into multiple logical firewalls, providing isolated management, routing, and security policies per tenant.

Answer

User-ID agent mappings

Answer

GlobalProtect Portal

Answer

Panorama Log Collector groups

Question 8

An administrator is troubleshooting an issue where internal users cannot access an external website utilizing a newly issued SSL certificate signed by an internal enterprise Certificate Authority (CA). The firewall's Forward Trust Certificate is not trusted by the client endpoint. What is the root cause of this browser warning?

Accepted Answer

The firewall's Forward Trust Certificate has not been installed into the endpoint browser or operating system Trusted Root Certification Authorities store.. When performing SSL Forward Proxy, the firewall signs intercepted traffic with the Forward Trust Certificate. If the endpoint does not trust the firewall's CA, the browser throws a certificate warning.

Answer

The external website's server certificate has expired on the destination origin server.

Answer

The WildFire cloud analysis engine has flagged the destination domain as malicious.

Answer

The Decryption policy is set to 'No Decryption' instead of 'Decrypt'.

Question 9

A healthcare organization must comply with HIPAA regulations to protect electronic protected health information (ePHI). The security team is implementing technical safeguards. Which TWO controls are required to ensure the confidentiality and integrity of ePHI during transmission and at rest? (Choose two.)

Accepted Answer

Encryption of ePHI in transit using TLS 1.2 or higher. HIPAA's Security Rule requires technical safeguards to protect ePHI. Encryption in transit (TLS 1.2+) and at rest (AES-256) are critical for ensuring confidentiality and integrity. These controls prevent unauthorized access and tampering during transmission and storage. Other options like firewalls, training, and MFA are important but do not directly encrypt ePHI. Thus, the two encryption controls are the correct answers.

Answer

Implementation of a firewall to filter network traffic

Answer

Regular security awareness training for employees

Answer

Use of multi-factor authentication for all users

Question 10

A healthcare startup stores patient records on a shared file server. An auditor reports that any employee can open and modify any patient file, even those outside their department. Which cybersecurity principle is being violated?

Accepted Answer

Confidentiality. The core issue is that patient records are exposed to employees who should not see them, violating confidentiality. While least privilege and separation of duties are related security concepts, the auditor's specific complaint is about unauthorized access to sensitive data, which directly maps to the confidentiality principle of the CIA triad.

Answer

Availability

Answer

Separation of duties

Answer

Least privilege

Question 11

A company's security team is reviewing its incident response plan. The team wants to ensure that after a major security breach, they can determine exactly what happened, which systems were affected, and what data was accessed. Which phase of incident response is most critical for achieving this goal?

Accepted Answer

Detection and analysis. The detection and analysis phase is where the security team investigates the incident to determine its scope, impact, and root cause. This involves gathering and examining evidence from logs, forensic images, and other sources. The other phases are important but do not primarily focus on reconstructing the event details.

Answer

Preparation

Answer

Post-incident activity

Answer

Containment, eradication, and recovery

Question 12

A software company wants to let remote developers connect to internal build servers without exposing those servers directly to the internet. The security architect proposes a solution where developers authenticate to a dedicated gateway, and only after successful authentication is a connection brokered to the specific internal server. Which technology is being described?

Accepted Answer

A virtual private network gateway that brokers authenticated remote access. The described design is authenticated remote access through a gateway that brokers connections to internal resources, which is the role of a VPN concentrator or secure remote access gateway. A jump server, a web application firewall, and a demilitarized zone each provide different functions and do not match the requirement to authenticate remote developers and then connect them to unexposed build servers.

Answer

A web application firewall placed in front of the build servers

Answer

A jump server acting as an intermediary host

Answer

A demilitarized zone that hosts the build servers directly

Question 13

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

Accepted Answer

App-ID. App-ID is the Palo Alto Networks traffic classification engine that identifies applications regardless of port, protocol, encryption, or evasive techniques like port hopping. It uses multiple identification techniques including protocol decryption, heuristics, and signature matching to classify traffic even inside HTTPS streams (with SSL decryption enabled). This is the core technology that lets PAN-OS enforce policy based on the actual application rather than port number.

Answer

Data-ID

Answer

Device-ID

Answer

User-ID

Question 14

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

Accepted Answer

GlobalProtect. GlobalProtect is Palo Alto Networks' remote access solution that provides secure VPN tunneling for remote workers, including always-on VPN, split tunneling, and integration with the next-generation firewall for security policy enforcement. It securely tunnels both internet-bound and corporate traffic back to the NGFW, matching the requirement.

Answer

WildFire

Answer

AutoFocus

Answer

Traps agent

Question 15

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

Accepted Answer

The Incidents tab in the Cortex XDR management console.. The Incidents tab in the Cortex XDR management console is where correlated alerts are grouped into incidents, enriched with causality chains, and mapped to MITRE ATT&CK techniques — including Command and Control (TA0011) tactics such as T1071 Application Layer Protocol and T1571 Non-Standard Port. Analysts use this view to see which endpoints are communicating with known C2 infrastructure and to pivot into the causal chain for investigation.

Answer

The Dashboards tab under System Settings on the firewall.

Answer

The User-ID Agent status page.

Answer

The ACC (Application Command Center) threat map on Panorama.