Cybersecurity-Apprentice Cybersecurity Fundamentals Practice Test 3 — 15 Questions

Question 1

A security administrator wants to prevent employees from visiting known malicious and phishing domains. Which security profile should be attached to the security rule controlling outbound web traffic?

Accepted Answer

URL Filtering Profile. URL Filtering Profiles are specifically designed to control web access by categorizing URLs and domains, allowing administrators to block access to known malicious, phishing, and other risky categories. When attached to a security rule that governs outbound web traffic, the profile enforces these block actions based on the destination URL. This directly addresses the requirement to prevent employees from visiting malicious and phishing domains.

Answer

Denial of Service (DoS) Protection Profile

Answer

File Blocking Profile

Answer

WildFire Analysis Profile

Question 2

A security engineer observes an increase in brute-force login attempts against an external-facing administrative portal. The attacks originate from thousands of distinct IP addresses over a short time window. Which profile type should the engineer configure and attach to the security rule to mitigate this volumetric attack?

Accepted Answer

A DoS Protection Profile configured with random early drop or classified rate limiting.. A volumetric brute-force attack originating from thousands of distinct IPs is a distributed denial-of-service pattern, and a DoS Protection Profile with random early drop or classified rate limiting is designed to detect and throttle such floods before they exhaust the portal's resources. DoS Protection Profiles operate at the firewall's dataplane to enforce per-source or per-class rate limits, which directly counters the high-volume, many-source nature of the attack. This is the correct mitigation profile to attach to the security rule.

Answer

A custom URL Filtering profile blocking the login page URL category.

Answer

An Antivirus Profile with signature auto-update enabled every minute.

Answer

A Data Filtering Profile configured to scan for weak passwords.

Question 3

Which core cybersecurity principle dictates that users and applications should only be granted the minimum necessary privileges required to perform their authorized tasks?

Accepted Answer

Principle of Least Privilege. The Principle of Least Privilege (PoLP) states that users and applications should be granted only the minimum access rights necessary to perform their authorized tasks. This directly matches the question's description. PoLP is a foundational cybersecurity principle that reduces the attack surface and limits the potential damage from compromised accounts.

Answer

Zero Trust Architecture

Answer

Defense-in-Depth

Answer

Separation of Duties

Question 4

What is the primary function of a Security Information and Event Management (SIEM) system in an enterprise security architecture?

Accepted Answer

To centralize log collection, event correlation, and security incident monitoring across disparate enterprise systems.. A SIEM aggregates logs from firewalls, endpoints, servers, and applications into a central platform, then applies correlation rules and analytics to detect and alert on security incidents. Its core value is providing a single pane of glass for monitoring, triage, and compliance reporting across heterogeneous enterprise systems. This matches option A precisely.

Answer

To analyze unknown executable files in an isolated sandbox environment.

Answer

To automatically patch operating system vulnerabilities on endpoints.

Answer

To enforce inline packet inspection and drop malicious TCP packets.

Question 5

A security analyst receives an alert from Cortex XDR indicating that a suspicious PowerShell script was executed on an employee workstation. Which underlying security telemetry mechanism enabled Cortex XDR to capture the exact process execution tree and command-line arguments?

Accepted Answer

The Cortex XDR endpoint agent monitoring OS kernel events and process behaviors.. Cortex XDR relies on its lightweight endpoint agent (the Cortex XDR agent) that hooks into OS kernel-level events—such as process creation, image loads, and command-line arguments—to build a detailed process execution tree. This telemetry is captured via kernel callbacks (e.g., Windows ETW, Linux eBPF) and sent to the Cortex XDR management console for analysis. Only an endpoint agent with kernel visibility can reconstruct the exact parent-child process relationships and full command-line arguments, which is why option A is correct.

Answer

The GlobalProtect client log export feature.

Answer

The firewall URL Filtering profile inspecting HTTP POST request parameters.

Answer

The User-ID Windows-based User Mapping daemon via WMI polling.

Question 6

What is the primary purpose of deploying a Threat Intelligence platform (TIP) alongside traditional security controls?

Accepted Answer

To aggregate, correlate, and operationalize threat intelligence feeds from multiple external and internal sources.. A Threat Intelligence Platform (TIP) is specifically designed to ingest, normalize, deduplicate, and correlate threat data from many sources — OSINT feeds, commercial vendors, ISACs, and internal telemetry — then enrich and distribute that intelligence to SIEMs, SOARs, firewalls, and EDR tools via standards like STIX/TAXII. Its core value is operationalization: turning raw indicators (IPs, domains, hashes, TTPs) into actionable context that existing controls can consume. Traditional controls like firewalls and IDS detect or block, but they don't aggregate and contextualize multi-source intelligence — that orchestration layer is the TIP's unique role.

Answer

To automatically isolate compromised VLANs on network switches using 802.1X.

Answer

To encrypt data at rest on enterprise database servers.

Answer

To provide zero-day malware sandbox detonation for Windows executables.

Question 7

Which security concept describes the practice of hiding internal network topology and IP address schemes from external entities using Network Address Translation (NAT)?

Accepted Answer

Network Address Translation (NAT) and topology hiding. NAT with topology hiding translates internal private IP addresses to public addresses, preventing external entities from seeing the internal addressing scheme and network structure. This is a recognized security benefit of NAT, often described as topology hiding. It obscures internal IP ranges and host counts from external observers.

Answer

Application Layer Gateway (ALG)

Answer

Multi-Factor Authentication (MFA)

Answer

End-to-End Encryption

Question 8

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. A Vulnerability Protection Profile is the correct feature because it inspects traffic against a signature database that includes reconnaissance and scanning signatures (e.g., port scans, host sweeps). Setting the action to drop or reset-both actively blocks the scanner rather than merely alerting. This directly addresses automated vulnerability scanning tools hitting the database server.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 9

An enterprise security administrator is designing a comprehensive security posture following Zero Trust principles on a Palo Alto Networks Next-Generation Firewall. Which TWO core concepts must be implemented to satisfy a true Zero Trust data and network architecture? (Choose two)

Accepted Answer

Verify explicitly by authenticating and authorizing based on all available data points including user identity, location, and device health.. Option C is correct because Zero Trust's foundational principle of 'verify explicitly' requires every access request to be authenticated and authorized using all available context — user identity, location, device posture/health, and other telemetry — rather than granting trust based on network location alone. Option D is correct because the complementary Zero Trust principle of 'assume breach' demands that organizations minimize lateral movement and blast radius through strict micro-segmentation and least-privilege access, which on a Palo Alto NGFW is enforced via security zones, App-ID/User-ID policies, and granular rules. Option A is incorrect because relying solely on perimeter firewalls with uninspected internal VLANs is a traditional castle-and-moat model that directly contradicts Zero Trust's requirement for inspection and segmentation of east-west traffic. Option B is incorrect because implicitly trusting internal segments after VPN authentication is exactly the implicit-trust assumption Zero Trust eliminates; authentication alone does not justify unrestricted internal access. Option E is incorrect because disabling SSL decryption reduces threat visibility and undermines the continuous inspection and verification that Zero Trust requires, prioritizing privacy at the expense of security enforcement.

Answer

Rely solely on perimeter firewalls to block external malicious actors while leaving internal VLANs uninspected.

Answer

Trust internal corporate network segments implicitly once a user successfully authenticates via VPN.

Answer

Disable SSL decryption for internal traffic to prioritize employee privacy over threat visibility.

Question 10

What is the primary benefit of deploying multi-factor authentication (MFA) for administrative access to security infrastructure?

Accepted Answer

It significantly reduces the risk of unauthorized access resulting from compromised passwords.. MFA requires a second factor beyond the password, so even if an administrator's password is phished, reused, or leaked in a breach, the attacker cannot authenticate without the additional factor (TOTP, FIDO2 key, push). This directly addresses the dominant initial-access vector against privileged accounts. It does not change network behavior, account lifecycle, or SSH cipher negotiation.

Answer

It prevents denial-of-service floods against the firewall management port.

Answer

It automatically disables inactive user accounts after 90 days.

Answer

It encrypts administrative SSH sessions using quantum-resistant algorithms.

Question 11

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

Accepted Answer

Zero-day malware and ransomware payloads delivered via web downloads or email attachments.. Option A is correct because NGFWs with security subscriptions such as WildFire, Advanced Malware Protection, or similar sandboxing and anti-malware services inspect web and email traffic to detect and block zero-day malware and ransomware payloads that signature-only engines would miss. Option E is correct because NGFWs commonly include URL filtering and anti-phishing subscriptions that categorize and block credential-harvesting sites and phishing domains before users can submit enterprise credentials. Option B is incorrect because unauthorized physical access to server racks is a physical security control addressed by locks, badges, and cameras, not by an NGFW security subscription. Option C is incorrect because fiber-optic attenuation from excessive bending is a Layer 1 cabling/installation issue, not a network security threat mitigated by an NGFW. Option D is incorrect because hardware interface failure from power surges is mitigated by surge protectors, UPS systems, and electrical protection, not by NGFW security subscriptions.

Answer

Unauthorized physical access to server racks within the data datacenter.

Answer

Fiber-optic cable attenuation caused by excessive distance bending.

Answer

Hardware physical interface failure caused by power surge transients.

Question 12

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data Filtering profiles (A) are correct because they use predefined or custom patterns (e.g., credit card and SSN regexes) to detect and block sensitive data in traffic, directly preventing exfiltration. SSL Decryption policies (C) are correct because without decrypting outbound HTTPS, the firewall cannot inspect uploads to cloud storage or other encrypted channels, so decryption restores visibility and enforcement for data protection. File Blocking profiles (D) are correct because they identify file types by extension or magic bytes and can block or alert on the egress of sensitive or unauthorized files, stopping exfiltration via file transfers. Management interface IP allow lists (B) only restrict who can administer the firewall and do not inspect or control data flows, so they do not prevent exfiltration. GlobalProtect clientless portal customization banners (E) are purely informational UI elements and provide no enforcement over data leaving the network.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 13

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Option A is correct because regular vulnerability assessments and penetration testing proactively identify exploitable weaknesses in systems and applications before attackers can leverage them, directly supporting risk assessment and remediation prioritization. Option B is correct because ingesting and monitoring Indicators of Compromise (IOCs) such as malicious IPs, domains, file hashes, and URLs from trusted threat intelligence feeds enables early detection of active threats and enriches SIEM/EDR correlation. Option D is correct because threat modeling during application design (e.g., using STRIDE or PASTA) anticipates attack vectors and informs security requirements before code is written, which is a core proactive risk management practice. Option C is incorrect because removing user access controls violates least privilege and dramatically increases risk rather than managing it. Option E is incorrect because permanently disabling logging destroys the audit trail and telemetry needed for detection, investigation, and compliance, and log overflow should instead be handled via retention policies, rotation, and capacity planning.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 14

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. Option A is correct because inline machine learning in threat prevention profiles enables real-time blocking of zero-day exploits by analyzing traffic patterns locally without relying solely on signatures. Option B is correct because the DNS Security service inspects DNS queries against Palo Alto Networks' threat intelligence to block malicious domains, including DNS tunneling and command-and-control (C2) callbacks used by APTs. Option C is correct because a WildFire profile automatically submits unknown executables and documents to the WildFire cloud for sandbox detonation and analysis, generating signatures that protect against previously unseen malware. Option D is not appropriate because SNMPv1 uses cleartext community strings and is inherently insecure, making it unsuitable for a hardened firewall. Option E is not appropriate because static IPsec tunnels with disabled Phase 2 rekeying reduce cryptographic agility and do not address zero-day or multi-stage attack protection.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 15

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

Accepted Answer

Traffic log. The Traffic log in Palo Alto Networks firewalls records all sessions that match Security policy rules, including those with drop or deny actions. It contains source/destination IPs, ports, applications, and the action taken, making it the correct log for reviewing blocked connection attempts.

Answer

System log

Answer

Config log

Answer

Threat log