Cybersecurity-Apprentice Cybersecurity Fundamentals Practice Test 2 — 15 Questions

Question 1

An administrator is troubleshooting an issue where specific applications are failing to pass through a Palo Alto Networks firewall. Panorama and firewall logs show 'nolog' or dropped packets due to security policy denials. Which THREE CLI commands are most useful for diagnosing policy evaluation and traffic flow issues? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

test security-policy-match source [ip] destination [ip] destination-port [port] protocol [proto]. Key CLI commands for traffic troubleshooting include 'test security-policy-match', 'show session id', and 'show counter global'.

Answer

debug software memory allocation dump

Answer

request system factory-reset keep-user-settings

Question 2

An administrator is managing firewall configurations across a large enterprise using Panorama. Which TWO configuration components are typically managed at the Panorama template level rather than the device group level? (Choose two)

Accepted Answer

Network interface assignments and security zone definitions.. Panorama templates manage network and device settings (interfaces, virtual routers, zones), while device groups manage policy and object settings (security rules, address objects, security profiles).

Answer

Security policy rules and Network object definitions.

Answer

Antivirus and WildFire security profile thresholds.

Answer

Log forwarding profile destinations and SNMP trap server IP settings.

Question 3

An enterprise security architect is reviewing the network design for a multi-tenant cloud environment protected by VM-Series firewalls. Which THREE design considerations are critical for maintaining high availability and resilience in a cloud deployment? (Choose three)

Accepted Answer

Using AWS Gateway Load Balancer (GWLB) or Azure Load Balancer to dynamically distribute traffic across firewall clusters.. Cloud HA and resilience require resilient load balancer integration (like AWS Gateway Load Balancer), multi-AZ deployments, and automated bootstrap configuration.

Answer

Configuring static Layer 2 spanning tree protocol (STP) across all cloud VPC peering links.

Answer

Relying entirely on physical bypass network taps for cloud virtual interfaces.

Question 4

A security architect is designing a multi-tenant cloud environment protected by VM-Series firewalls. To enforce strict segmentation between tenant zones that share the same physical interface, which core Palo Alto Networks feature must be configured first?

Accepted Answer

Virtual Systems (vsys). Virtual Systems (vsys) allow a single physical or virtual firewall to be partitioned into multiple logical firewalls, providing isolated management, routing, and security policies per tenant.

Answer

User-ID agent mappings

Answer

GlobalProtect Portal

Answer

Panorama Log Collector groups

Question 5

An administrator is troubleshooting an issue where specific applications are failing to pass through a Palo Alto Networks firewall. Panorama and firewall logs show 'nolog' or dropped packets due to security policy denials. Which THREE CLI commands are most useful for diagnosing policy evaluation and traffic flow issues? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall's Forward Trust Certificate has not been installed into the endpoint browser or operating system Trusted Root Certification Authorities store.. When performing SSL Forward Proxy, the firewall signs intercepted traffic with the Forward Trust Certificate. If the endpoint does not trust the firewall's CA, the browser throws a certificate warning.

Answer

The external website's server certificate has expired on the destination origin server.

Answer

The WildFire cloud analysis engine has flagged the destination domain as malicious.

Answer

The Decryption policy is set to 'No Decryption' instead of 'Decrypt'.

Question 6

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

Accepted Answer

App-ID. App-ID uses multiple classification mechanisms, including signature matching, heuristics, and SSL decryption analysis, to identify applications regardless of port.

Answer

Data-ID

Answer

Device-ID

Answer

User-ID

Question 7

An enterprise security team needs to protect remote workers connecting over public Wi-Fi networks by ensuring all their internet-bound and corporate traffic is securely tunneled back to the next-generation firewall. Which Palo Alto Networks solution provides this capability?

Accepted Answer

GlobalProtect. GlobalProtect is the Palo Alto Networks secure access solution that provides secure remote access via VPN tunnels to endpoints.

Answer

WildFire

Answer

AutoFocus

Answer

Traps agent

Question 8

An administrator needs to quickly identify active threats and infected endpoints communicating with known Command and Control (C2) servers across the network. Which Cortex XDR feature should the analyst inspect to view categorized threat alerts mapped to the MITRE ATT and CK framework?

Accepted Answer

The Incidents tab in the Cortex XDR management console.. Cortex XDR provides an Incident view that aggregates related alerts into a single incident, mapped directly to the MITRE ATT and CK framework to help analysts understand the threat lifecycle.

Answer

The Dashboards tab under System Settings on the firewall.

Answer

The User-ID Agent status page.

Answer

The ACC (Application Command Center) threat map on Panorama.

Question 9

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

Accepted Answer

URL Filtering Profile. URL Filtering profiles inspect HTTP and HTTPS traffic and block access to malicious, phishing, and inappropriate websites based on threat categories.

Answer

Denial of Service (DoS) Protection Profile

Answer

File Blocking Profile

Answer

WildFire Analysis Profile

Question 10

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Accepted Answer

A DoS Protection Profile configured with random early drop or classified rate limiting.. Zone Protection profiles or DoS Protection profiles protect against volumetric attacks and flood conditions originating from single or multiple IP sources.

Answer

A custom URL Filtering profile blocking the login page URL category.

Answer

An Antivirus Profile with signature auto-update enabled every minute.

Answer

A Data Filtering Profile configured to scan for weak passwords.

Question 11

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

Accepted Answer

Principle of Least Privilege. The principle of least privilege ensures that entities have only the permissions required to complete their jobs, minimizing the attack surface.

Answer

Zero Trust Architecture

Answer

Defense-in-Depth

Answer

Separation of Duties

Question 12

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

Accepted Answer

To centralize log collection, event correlation, and security incident monitoring across disparate enterprise systems.. SIEM systems aggregate, correlate, and analyze log data from multiple sources across the enterprise to detect security incidents and provide audit trails.

Answer

To analyze unknown executable files in an isolated sandbox environment.

Answer

To automatically patch operating system vulnerabilities on endpoints.

Answer

To enforce inline packet inspection and drop malicious TCP packets.

Question 13

A security analyst receives an alert from Cortex XDR indicating that a suspicious PowerShell script was executed on an employee workstation. Which underlying security telemetry mechanism enabled Cortex XDR to capture the exact process execution tree and command-line arguments?

Accepted Answer

The Cortex XDR endpoint agent monitoring OS kernel events and process behaviors.. The Cortex XDR agent monitors endpoint kernel activities, process creations, and system calls to build detailed execution trees and forensics.

Answer

The GlobalProtect client log export feature.

Answer

The firewall URL Filtering profile inspecting HTTP POST request parameters.

Answer

The User-ID Windows-based User Mapping daemon via WMI polling.

Question 14

What is the primary purpose of deploying a Threat Intelligence platform (TIP) alongside traditional security controls?

Accepted Answer

To aggregate, correlate, and operationalize threat intelligence feeds from multiple external and internal sources.. Threat Intelligence platforms aggregate, normalize, and operationalize threat feeds from multiple sources to improve detection and response.

Answer

To automatically isolate compromised VLANs on network switches using 802.1X.

Answer

To encrypt data at rest on enterprise database servers.

Answer

To provide zero-day malware sandbox detonation for Windows executables.

Question 15

Which security concept describes the practice of hiding internal network topology and IP address schemes from external entities using Network Address Translation (NAT)?

Accepted Answer

Network Address Translation (NAT) and topology hiding. Network Address Translation (NAT) hides internal private IP addresses behind public IP addresses, providing a degree of topology obfuscation.

Answer

Application Layer Gateway (ALG)

Answer

Multi-Factor Authentication (MFA)

Answer

End-to-End Encryption