Cybersecurity-Apprentice Cybersecurity Fundamentals Practice Test 4 — 15 Questions

Question 1

An organization wants to implement the principle of least privilege for administrators accessing the Palo Alto Networks next-generation firewall. Where should an administrator configure custom Admin Roles to restrict specific configuration and operational tasks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device > Admin Roles. Custom Admin Roles in PAN-OS are configured under Device > Admin Roles, where an administrator defines a role name and then selects granular permissions across functional areas (e.g., Policies, Objects, Network, Device, Privacy) and read/write levels. This is the only location that lets you create role-based access control (RBAC) tailored to least privilege for firewall administrators.

Answer

Policies > Access Control

Answer

Device > Setup > Management

Answer

Device > Authentication Profile

Question 2

An organization is deploying a zero-trust network architecture using Palo Alto Networks firewalls. The security team needs to ensure that internal user traffic destined for sensitive database servers is strictly inspected for application-layer threats. Which security mechanism must be enforced to achieve Layer 7 visibility and control?

Accepted Answer

Implement App-ID to identify the specific application and apply a Security policy rule with threat prevention profiles.. Palo Alto Networks firewalls achieve Layer 7 visibility through App-ID, which identifies applications regardless of port or protocol by inspecting traffic signatures and behavior. To enforce inspection of internal user traffic to database servers, the team must create a Security policy rule that uses App-ID to identify the application and attaches threat prevention profiles (Antivirus, Anti-Spyware, Vulnerability Protection) to that rule. This combination provides both identification and enforcement at the application layer.

Answer

Rely entirely on traditional layer 3 network routing protocols to isolate database subnets.

Answer

Disable NAT rules to ensure internal IP addresses remain hidden from external networks.

Answer

Enforce explicit port-based allow rules combined with static IP subnetting.

Question 3

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Option B is correct because a Management Profile applied to an interface explicitly controls which management services (HTTPS, SSH, Telnet, SNMP, etc.) are permitted and from which source IP addresses, so restricting it to trusted management subnets prevents unauthorized administrative access from untrusted networks. Option E is correct because enabling an Authentication Profile with MFA on administrative accounts adds a strong second factor, mitigating credential theft and brute-force or password-reuse attacks against the management plane. Option A is incorrect because an Antivirus security profile on outbound HTTP rules protects data-plane traffic, not the management plane. Option C is incorrect because the captive portal is a user authentication/redirection feature for data-plane traffic and disabling it does not harden administrative access. Option D is incorrect because dynamic DNS updates on an untrusted interface increase exposure and are unrelated to securing management access.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 4

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust rejects the idea of a trusted internal network, so Option B is correct because inspecting and logging all traffic on every port and protocol with App-ID and Threat Prevention ensures no flow is blindly trusted and that application-layer visibility and threat detection apply universally. Option C is correct because Zero Trust requires micro-segmentation, and using zones and virtual routers on Palo Alto firewalls creates granular micro-perimeters that contain lateral movement between workloads. Option E is correct because Zero Trust enforces least-privilege access decisions based on user identity, application, and content rather than IP address or network location, which is exactly what Palo Alto's User-ID and App-ID enable. Option A is wrong because implicitly trusting internal-zone traffic is the traditional castle-and-moat assumption that Zero Trust explicitly eliminates. Option D is wrong because relying only on perimeter firewalls and leaving internal lateral traffic uninspected contradicts Zero Trust's requirement to inspect east-west traffic and assume breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 5

An organization is deploying a comprehensive threat prevention strategy using Palo Alto Networks Security Profiles. Which THREE security profile types are available out-of-the-box to inspect data plane traffic for specific threat vectors? (Choose three)

Accepted Answer

Anti-Spyware. Anti-Spyware (A) is a correct out-of-the-box Security Profile type that inspects data plane traffic for command-and-control (C2) activity, spyware downloads, and DNS sinkhole-based botnet traffic. Vulnerability Protection (B) is also correct: it is a Security Profile that detects and blocks exploits targeting host software and applications by matching signatures against traffic in the data plane. Antivirus (D) is the third correct profile type, scanning data plane traffic for viruses, worms, and other malware in files transferred over protocols such as HTTP, FTP, SMB, and SMTP. Packet Filter (C) is not a Security Profile type; it is a stateless firewall capability, and Palo Alto Networks firewalls perform stateful inspection rather than offering a packet-filter profile. Session Timeout (E) is not a Security Profile either; it is a session-handling parameter configured in security policy or application settings, not a threat-inspection profile.

Answer

Packet Filter

Answer

Session Timeout

Question 6

An enterprise firewall is experiencing high session utilization due to a distributed denial-of-service (DDoS) SYN flood attack targeting a public web server. Which feature on the Palo Alto Networks firewall should an administrator configure to protect the server from resource exhaustion?

Accepted Answer

A DoS Protection profile and policy specifying SYN flood rate-limiting thresholds.. A Palo Alto Networks DoS Protection profile is designed to detect and mitigate denial-of-service attacks, including SYN floods, by applying rate-limiting thresholds and other protections. Configuring a DoS Protection policy with SYN flood rate-limiting thresholds allows the firewall to limit the number of SYN packets per second to the web server, preventing session table exhaustion and resource exhaustion from the SYN flood.

Answer

A Data Filtering profile configured with credit card pattern matching.

Answer

A custom URL Filtering profile with block actions enabled for high-risk categories.

Answer

An SSL Decryption policy configured to strip certificates from inbound web traffic.

Question 7

A security analyst at a financial firm receives an alert that a workstation has been communicating with a known malicious IP address. The analyst isolates the workstation from the network and begins reviewing logs. Which step of the incident response process is the analyst performing?

Accepted Answer

Containment. Isolating a compromised workstation from the network is a containment action. Containment aims to limit the scope and impact of an incident while the analyst investigates further. Identification has already occurred because the alert confirmed malicious communication. Eradication and recovery come later, after the threat is fully understood and removed. Thus, the analyst is performing containment.

Answer

Recovery

Answer

Eradication

Answer

Identification

Question 8

A new cybersecurity apprentice is asked to classify the following event: an employee receives an email that appears to come from the IT department, asking them to click a link and reset their password immediately or their account will be disabled. The link leads to a fake login page that captures credentials. Which type of attack best describes this scenario?

Accepted Answer

Phishing. The scenario describes a deceptive email that impersonates IT and pressures the user to enter credentials on a fake page. This is a phishing attack, which relies on social engineering rather than technical exploitation. The other choices describe different attack categories that do not match the observed behavior.

Answer

Man-in-the-middle (MITM)

Answer

SQL injection

Answer

Denial-of-service (DoS)

Question 9

A security analyst is reviewing a web server log and sees the following entry: `GET /products.php?id=1' OR '1'='1`. The analyst suspects an injection attack. Which type of attack is most likely being attempted?

Accepted Answer

SQL injection. The payload `' OR '1'='1` is a textbook SQL injection attempt. It aims to alter the logic of a database query by injecting a tautology. The other attack types would involve different payloads and mechanisms, such as script tags for XSS, shell commands for command injection, or forged requests for CSRF.

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 10

A security analyst receives an alert about a workstation repeatedly attempting to connect to an IP address known for hosting malware. The analyst wants to confirm whether the connection was successful and what data might have been transferred. Which type of data should the analyst examine first?

Accepted Answer

Firewall session logs. Firewall session logs are the most direct source to verify whether a connection was allowed and how much data was transferred. They capture the five-tuple of source IP, destination IP, source port, destination port, and protocol, along with bytes sent and received. This allows the analyst to confirm the connection and assess potential data exfiltration.

Answer

System event logs

Answer

Email gateway logs

Answer

Antivirus scan reports

Question 11

A small business owner wants to protect the company's network from external threats. The owner has installed a firewall and antivirus software on all computers. Which additional basic security measure should the owner implement to protect against unauthorized access to the wireless network?

Accepted Answer

Enable WPA3 encryption on the wireless access point. Enabling WPA3 encryption on the wireless access point is the most effective way to protect against unauthorized access. WPA3 provides strong encryption and authentication, ensuring only authorized users can connect. Other measures like disabling SSID broadcast or changing router passwords are less effective or address different aspects. An open guest network would worsen security. Thus, WPA3 is the correct basic security measure.

Answer

Set up a guest network with no password

Answer

Disable the SSID broadcast

Answer

Change the default administrator password on the router

Question 12

An organization wants to ensure that sensitive data stored on employee laptops remains confidential even if a laptop is lost or stolen. The data must be unreadable without the correct credentials. Which security control should be implemented?

Accepted Answer

Full-disk encryption. Full-disk encryption ensures that data at rest is encrypted and cannot be read without the proper key. This directly protects confidentiality if a laptop is lost or stolen. The other options are detective or preventive controls for other purposes but do not encrypt data on the device.

Answer

File integrity monitoring

Answer

Security information and event management (SIEM)

Answer

Data loss prevention (DLP)

Question 13

A new security analyst at a retail company receives a help desk ticket stating that an employee clicked a link in an email and a browser window opened asking for their corporate username and password. The page looks identical to the company's single sign-on portal, but the URL is misspelled. The analyst must classify this event. Which category BEST describes this activity?

Accepted Answer

Phishing. The deceptive email link and counterfeit single sign-on page are designed to capture the employee's credentials, which is the defining behavior of phishing. The other categories describe availability attacks, post-compromise escalation, or database manipulation, none of which match the evidence. Correct classification drives the proper response: reset the user's credentials, block the URL, and reinforce awareness training.

Answer

Denial of service

Answer

SQL injection

Answer

Privilege escalation

Question 14

A junior security analyst at a healthcare company receives a call from an employee who says they received an email from the IT department asking them to click a link and reset their password. The email address looks slightly misspelled. The analyst wants to confirm whether this is a phishing attempt before the employee clicks anything. Which action should the analyst take FIRST?

Accepted Answer

Instruct the employee to forward the email to the security team and do not click the link.. The correct approach is to preserve the suspicious message and prevent interaction with it. Forwarding the email to the security team keeps headers and URLs intact for analysis, while instructing the employee not to click avoids credential theft or malware execution. This supports containment and enables responders to check for other recipients and block the sender or link.

Answer

Reply to the email asking the sender to verify their identity.

Answer

Delete the email from the employee's mailbox and close the ticket.

Answer

Tell the employee to click the link from a personal device so the corporate network is not affected.

Question 15

A security team is implementing the principle of least privilege across its organization. Which TWO practices best support this principle? (Choose two.)

Accepted Answer

Granting users only the permissions required to perform their job functions. Least privilege is upheld by granting only necessary permissions and by regularly reviewing and revoking unnecessary access. These two practices ensure that users have just enough rights to perform their duties and that those rights are kept current. The other options either grant excessive access or weaken security controls.

Answer

Sharing a single privileged account among IT staff to reduce the number of credentials

Answer

Disabling multi-factor authentication for privileged accounts to speed up access

Answer

Assigning all users administrative privileges to simplify troubleshooting