Cybersecurity-Apprentice Cybersecurity Fundamentals Practice Test 3 — 15 Questions

Question 1

An administrator notices that a critical internal database server is continually targeted by automated vulnerability scanning tools from external IP addresses. Which security profile feature should be applied to the security rule to detect and block these reconnaissance scans?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Vulnerability Protection Profile with action set to drop or reset-both for scan signatures.. Vulnerability Protection profiles inspect traffic for known exploit signatures, including vulnerability scans and exploit attempts targeting servers.

Answer

A File Blocking Profile configured to block executable script extensions.

Answer

A WildFire Analysis Profile set to forward all TCP handshakes.

Answer

A Decryption Profile configured to strip SSH public keys.

Question 2

An enterprise security administrator is designing a comprehensive security posture following Zero Trust principles on a Palo Alto Networks Next-Generation Firewall. Which TWO core concepts must be implemented to satisfy a true Zero Trust data and network architecture? (Choose two)

Accepted Answer

Verify explicitly by authenticating and authorizing based on all available data points including user identity, location, and device health.. Zero Trust requires verifying explicitly based on all available data points (identity, location, device health) and assuming breach by limiting blast radius with least privilege access.

Answer

Rely solely on perimeter firewalls to block external malicious actors while leaving internal VLANs uninspected.

Answer

Trust internal corporate network segments implicitly once a user successfully authenticates via VPN.

Answer

Disable SSL decryption for internal traffic to prioritize employee privacy over threat visibility.

Question 3

What is the primary benefit of deploying multi-factor authentication (MFA) for administrative access to security infrastructure?

Accepted Answer

It significantly reduces the risk of unauthorized access resulting from compromised passwords.. MFA adds an extra layer of security beyond passwords, making it significantly harder for attackers to compromise administrative accounts via credential theft.

Answer

It prevents denial-of-service floods against the firewall management port.

Answer

It automatically disables inactive user accounts after 90 days.

Answer

It encrypts administrative SSH sessions using quantum-resistant algorithms.

Question 4

An administrator is configuring a File Blocking profile to prevent users from downloading potentially dangerous file types. However, users legitimately need to download password-protected archive files (such as .zip files encrypted with passwords) for business operations. How should the administrator configure the profile to handle encrypted archives safely?

Accepted Answer

Configure the File Blocking profile to detect and block 'encrypted-zip' and 'encrypted-rar' file types.. File Blocking profiles can be configured to detect and block or alert on encrypted archives (like password-protected .zip files) because attackers often use them to bypass payload inspection.

Answer

Enable WildFire inline machine learning to guess user archive passwords.

Answer

Set the URL Filtering profile action to bypass inspection for all archive file extensions.

Answer

Attach an Antivirus profile set to automatically decrypt password-protected ZIP files using a dictionary attack.

Question 5

An organization is preparing for a security audit and wants to ensure robust defense-in-depth measures are active on their Palo Alto Networks firewalls. Which TWO security profiles protect against protocol manipulation, evasion techniques, and vulnerability exploitation? (Choose two)

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection profiles defend against software vulnerabilities and exploits, while Anti-Spyware profiles detect and block command-and-control traffic and evasion techniques.

Answer

URL Filtering Profile

Answer

Data Filtering Profile

Answer

File Blocking Profile

Question 6

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

Accepted Answer

Zero-day malware and ransomware payloads delivered via web downloads or email attachments.. Next-Generation Firewalls mitigate ransomware delivered via malicious downloads (via WildFire/Antivirus) and phishing/credential theft (via URL Filtering and Credential Enforcement).

Answer

Unauthorized physical access to server racks within the data datacenter.

Answer

Fiber-optic cable attenuation caused by excessive distance bending.

Answer

Hardware physical interface failure caused by power surge transients.

Question 7

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data exfiltration is prevented using Data Filtering profiles, File Blocking profiles, and SSL Decryption to inspect encrypted egress traffic.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 8

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Proactive risk management includes vulnerability assessments, threat modeling, and indicators of compromise (IOC) monitoring.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 9

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. APT and zero-day protection relies on WildFire cloud sandbox analysis, DNS Security for malicious domain detection, and inline machine learning.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 10

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

Accepted Answer

Traffic log. Threat logs record security events such as spyware, viruses, and vulnerability exploits, while Traffic logs record session start and end details, including allow, deny, and drop actions.

Answer

System log

Answer

Config log

Answer

Threat log

Question 11

An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?

Accepted Answer

Device > Admin Roles. Custom Admin Roles are configured under Device > Admin Roles. This allows administrators to define granular read, write, or none permissions for specific tabs, menus, and tasks.

Answer

Policies > Access Control

Answer

Device > Setup > Management

Answer

Device > Authentication Profile

Question 12

An organization is deploying a zero-trust network architecture using Palo Alto Networks firewalls. The security team needs to ensure that internal user traffic destined for sensitive database servers is strictly inspected for application-layer threats. Which security mechanism must be enforced to achieve Layer 7 visibility and control?

Accepted Answer

Implement App-ID to identify the specific application and apply a Security policy rule with threat prevention profiles.. Port-based rules only look at layer 4 ports, whereas App-ID performs deep packet inspection to identify the exact application regardless of port, enabling effective Layer 7 security.

Answer

Rely entirely on traditional layer 3 network routing protocols to isolate database subnets.

Answer

Disable NAT rules to ensure internal IP addresses remain hidden from external networks.

Answer

Enforce explicit port-based allow rules combined with static IP subnetting.

Question 13

A network administrator notices that a critical internal host is continuously communicating with an external Command and Control (C2) server. To mitigate this risk instantly without disrupting all outbound traffic, where should the administrator check to verify if WildFire or Anti-Spyware signatures are actively blocking this specific traffic pattern?

Accepted Answer

Objects > Security Profiles > Anti-Spyware. The Anti-Spyware profile detects and blocks C2 communications and DNS queries associated with malware. Checking the Security policy rule to ensure an Anti-Spyware profile is attached is essential.

Answer

Network > Zones

Answer

Network > Interfaces

Answer

Device > High Availability

Question 14

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Securing the management plane involves restricting administrative access via Management Profile source IP whitelisting and ensuring strong administrative authentication settings.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 15

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust principles include continuous verification, least privilege access, inspecting and logging all traffic, and assuming breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.