Cybersecurity-Apprentice Hard Questions — 25 Difficult Questions

Question 1

A security engineer is reviewing Prisma Cloud Compute runtime defense for a Kubernetes environment. The team wants to prevent a container from executing a shell after it starts, while still allowing the container to run its intended application. Which Prisma Cloud Compute capability should the engineer configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A runtime rule that blocks the execution of specific processes, such as /bin/sh, within the container.. Preventing a shell from executing after a container starts is a runtime enforcement task. Prisma Cloud Compute runtime rules can block specific processes by name or path, so a rule that denies /bin/sh stops interactive shell access while leaving the application process unaffected. Configuration and vulnerability checks do not enforce behavior at runtime.

Answer

A vulnerability rule that flags images containing shell binaries with known CVEs.

Answer

An admission controller rule that rejects pods whose security context allows privilege escalation.

Answer

A compliance policy that checks whether the container image is built from a minimal base image.

Question 2

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures between the Cortex XDR agent and the management server almost always point to a trust or interception issue. If a proxy or firewall performs TLS inspection (decryption) and the Cortex XDR root certificate is not installed in the agent's trust store, the agent rejects the proxy's re-signed certificate and the handshake fails, which matches the observed symptoms.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 3

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust rejects the idea of a trusted internal network, so Option B is correct because inspecting and logging all traffic on every port and protocol with App-ID and Threat Prevention ensures no flow is blindly trusted and that application-layer visibility and threat detection apply universally. Option C is correct because Zero Trust requires micro-segmentation, and using zones and virtual routers on Palo Alto firewalls creates granular micro-perimeters that contain lateral movement between workloads. Option E is correct because Zero Trust enforces least-privilege access decisions based on user identity, application, and content rather than IP address or network location, which is exactly what Palo Alto's User-ID and App-ID enable. Option A is wrong because implicitly trusting internal-zone traffic is the traditional castle-and-moat assumption that Zero Trust explicitly eliminates. Option D is wrong because relying only on perimeter firewalls and leaving internal lateral traffic uninspected contradicts Zero Trust's requirement to inspect east-west traffic and assume breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 4

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR network isolation blocks all traffic except management communication by default. To allow a specific forensic server to reach an isolated endpoint, the responder configures IP-based isolation exceptions in the Cortex XDR profile (or via the isolation policy), whitelisting the forensic server's IP so its traffic is permitted while all other traffic remains blocked. This preserves containment while enabling evidence collection.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 5

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)

Accepted Answer

Enable the Prisma Cloud Config assessment feature for each cloud account.. To detect publicly accessible storage buckets, Prisma Cloud must have read-only access to storage services and the Config assessment feature must be enabled. These two actions allow Prisma Cloud to query bucket configurations and evaluate them against security policies. Compute agents, audit logs, and webhooks do not provide the necessary configuration data.

Answer

Deploy Prisma Cloud Compute agents on all virtual machines.

Answer

Configure CloudTrail, Azure Activity Log, and GCP Audit Logs to send logs to Prisma Cloud.

Answer

Set up a Prisma Cloud webhook to receive alerts from cloud providers.

Question 6

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

Accepted Answer

The two hosts are on different IP subnets and require a router or Layer 3 device to communicate. IP communication depends on subnet boundaries, not physical topology. Hosts on 172.16.5.0/24 and 172.16.6.0/24 are on separate logical networks even when cabled to the same switch. A host forwards off-subnet traffic to its default gateway, so without a router or Layer 3 switch providing inter-subnet routing, the two hosts cannot exchange packets. Confirming subnet membership and the presence of a Layer 3 path is essential before blaming switching or ACLs.

Answer

The switch is blocking traffic because the MAC address table has not learned the server's MAC address

Answer

The server's /24 mask is too large and causes it to treat the workstation as local

Answer

The workstation is using the wrong default gateway, which prevents ARP from resolving the server

Question 7

A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?

Accepted Answer

The technique is code injection, and the agent blocked the write operation and may have terminated the injecting process.. Writing to another process's memory is a hallmark of code injection, often used by malware to execute code in the context of a trusted process. Behavioral Threat Protection detects this activity and can block the write operation, preventing the injection. Depending on the configured policy, the agent may also terminate the injecting process. The other options misidentify the technique or the agent's response.

Answer

The technique is privilege escalation, and the agent escalated the alert to the cloud for analysis.

Answer

The technique is DLL side-loading, and the agent quarantined the DLL file.

Answer

The technique is process hollowing, and the agent terminated the target process.

Question 8

A network engineer is configuring a router interface with the IPv4 address 172.16.10.33 and subnet mask 255.255.255.224. The engineer needs to determine the network address and broadcast address for this subnet. What are the network and broadcast addresses, respectively?

Accepted Answer

172.16.10.32 and 172.16.10.63. With a subnet mask of 255.255.255.224 (/27), the subnet increment is 32. The address 172.16.10.33 falls within the subnet starting at 172.16.10.32. Therefore, the network address is 172.16.10.32 and the broadcast address is 172.16.10.63. The correct answer is 172.16.10.32 and 172.16.10.63.

Answer

172.16.10.0 and 172.16.10.31

Answer

172.16.10.0 and 172.16.10.63

Answer

172.16.10.33 and 172.16.10.62

Question 9

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

Accepted Answer

Apply policy tags to group related policies and use those tags in alert rules to control which findings are surfaced to each business unit.. Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Answer

Disable all policies that have not generated an alert in the last 30 days to reduce the number of active policies.

Answer

Increase the scan frequency of the cloud accounts to every five minutes so that duplicate alerts are generated for each scan cycle.

Answer

Enable auto-remediation for every high-severity policy so that all findings are fixed without human review.

Question 10

An administrator is configuring SSL Decryption on a Palo Alto Networks firewall to inspect outbound HTTPS traffic. Users in the Finance department must be excluded from decryption when accessing banking websites due to strict privacy regulations. How should the administrator configure the Decryption policy to achieve this securely?

Accepted Answer

Create a Decryption rule with action set to 'No Decryption' matching the Finance source user and banking URL categories, placed above the general outbound decryption rule.. To exclude specific traffic from decryption while maintaining security oversight, the administrator must create a Decryption policy rule with the action set to 'No Decryption' and place it above the general decryption rule.

Answer

Create a Decryption profile with 'Block sessions with expired certificates' enabled and apply it to the default rule.

Answer

Configure an untrusted Root CA certificate on the client certificate store for the Finance group.

Answer

Disable SSL Forward Proxy globally and rely solely on WildFire DNS security signatures.

Question 11

A network administrator configures a Layer 3 subinterface with DHCP Client enabled. However, the interface fails to receive an IP address from the upstream provider. Which CLI command should the administrator execute to troubleshoot the DHCP client process on the firewall?

Accepted Answer

tail follow log dhcpc. DHCP client operations on PAN-OS can be diagnosed using tail-follow on the dhcpc log file or specific debug commands.

Answer

show dhcp client statistics

Answer

debug dhcp-relay dump

Answer

show system state filter-value dhcp

Question 12

An organization wants to enforce zero trust principles by inspecting all internal east-west traffic between different VLANs terminating on a Palo Alto Networks Next-Generation Firewall. The firewall is currently running in Layer 3 mode. Which configuration step is essential to ensure that inter-VLAN traffic passes through the security inspection engine rather than routing directly through an upstream core switch?

Accepted Answer

Configure separate subinterfaces for each VLAN, assign each subinterface to a unique security zone, and create a Security policy rule permitting the inter-zone traffic.. To inspect traffic between subnets on the same firewall, the subnets must be assigned to different security zones, and inter-zone traffic must be explicitly allowed by a Security policy.

Answer

Configure a static multicast route pointing to the loopback address of the firewall management plane.

Answer

Enable Layer 2 mode bridging across all subinterfaces to allow the core switch to perform bridging while the firewall inspects packets in virtual wire mode.

Answer

Create a single aggregate interface (AE) and assign all VLAN tags to the native VLAN ID.

Question 13

An enterprise security architect is reviewing the network design for a multi-tenant cloud environment protected by VM-Series firewalls. Which THREE design considerations are critical for maintaining high availability and resilience in a cloud deployment? (Choose three)

Accepted Answer

Using AWS Gateway Load Balancer (GWLB) or Azure Load Balancer to dynamically distribute traffic across firewall clusters.. Cloud HA and resilience require resilient load balancer integration (like AWS Gateway Load Balancer), multi-AZ deployments, and automated bootstrap configuration.

Answer

Configuring static Layer 2 spanning tree protocol (STP) across all cloud VPC peering links.

Answer

Relying entirely on physical bypass network taps for cloud virtual interfaces.

Question 14

An organization has deployed a multi-tenant Palo Alto Networks firewall using virtual systems (vsys). An administrator in vsys1 needs to reference a security object (such as an address object) created by the root administrator. How can this address object be made available to vsys1 without recreating it?

Accepted Answer

Configure the address object in the Shared location within Device or Panorama context, making it available to all virtual systems.. Address objects created in the shared context (root) can be made accessible to virtual systems by setting their scope to 'Shared' during creation.

Answer

Export the vsys1 configuration to XML, manually inject the object, and import it back into the root vsys.

Answer

Establish an internal BGP peering session between vsys1 and the root virtual router.

Answer

Configure a virtual wire interface bridging vsys1 and the shared management interface.

Question 15

An auditor is reviewing an organization's network segmentation and points out that management traffic (SSH, HTTPS to the firewall) traverses the same physical interface and routing table as untrusted user traffic. Which Palo Alto Networks best practice should be implemented to secure management access?

Accepted Answer

Isolate management traffic onto the dedicated out-of-band MGT port, configure Management Interface IP settings, and restrict access using Management Profiles and Service Routes.. Best practices dictate that management traffic should be isolated using a dedicated Management interface (MGT) connected to an out-of-band management network, protected by Service Routes and Management Profile restrictions.

Answer

Move all administrative accounts to use RADIUS authentication over the data plane VPN tunnel.

Answer

Enable Zone Protection profiles on all Layer 3 trust zones.

Answer

Configure a Layer 2 subinterface on the untrusted zone and apply an SSH decryption profile.

Question 16

An enterprise security architect is designing a high-security network architecture where firewalls are deployed in a cluster to inspect traffic between AWS VPCs. The architecture requires dynamic routing support for thousands of routes without maintaining traditional BGP peering complexity on every firewall. Which Palo Alto Networks feature supports dynamic cloud route updates and integration with cloud orchestrators?

Accepted Answer

Cloud Plug-ins for Panorama and VM-Series integration with cloud APIs for dynamic route and security group management.. Panorama plugins and VM-Series firewalls integrate with cloud APIs (like AWS VPC route tables and Azure route tables) via AWS/Azure plugins to dynamically update routes and security groups.

Answer

GlobalProtect clientless VPN with internal SAML identity federation.

Answer

Static IPsec tunneling with Proxy IDs configured for every individual VPC subnet.

Answer

OSPFv3 multi-area transit routing over virtual wire interfaces.

Question 17

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

Accepted Answer

test security-policy-matching source [IP] destination [IP] application [app]. The 'test security-policy-matching' command on PAN-OS performs a live lookup against the current security rulebase, showing exactly which rule matches a specified source, destination, and application tuple. It is the correct tool for verifying rule matching during troubleshooting because it evaluates the actual policy logic without generating traffic. This directly answers the administrator's need to confirm which rule is matching incoming traffic.

Answer

show running-config security-rules

Answer

debug dataplane packet-log dump

Answer

show system resources active-sessions

Question 18

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

Accepted Answer

Configure the SIEM server profile to export logs using CEF (Common Event Format) or JSON formatting.. CEF (Common Event Format) and JSON are the standard structured, parsable output formats used when forwarding logs or incidents to a SIEM, and the SIEM server profile in Cortex XDR lets you select CEF or JSON formatting. These formats preserve field-value structure so the SIEM can parse and correlate events reliably. This is the correct configuration for a legacy SIEM integration.

Answer

Disable all header encryption and export logs using raw ASCII carriage returns only.

Answer

Rewrite the PAN-OS kernel to natively output syslog in Microsoft Word DOCX format.

Answer

Convert all log files into uncompressed raw bitmap graphics prior to export.

Question 19

An organization is utilizing Palo Alto Networks Prisma Access for secure remote network and user access. An administrator needs to ensure that branch offices connecting via Prisma Access Remote Networks can communicate securely with each other without backhauling traffic through a central hub. Which Prisma Access feature enables this direct communication?

Accepted Answer

Prisma Access Remote Networks Mesh connectivity enabling direct branch-to-branch communication.. Mesh or Hub-and-Spoke configurations with full mesh enabled allow remote networks to communicate directly with each other without traversing a central hub.

Answer

Cloud Secure Web Gateway (SWG) explicit proxy chaining.

Answer

GlobalProtect Clientless VPN portal redirection profiles.

Answer

Panorama log forwarding aggregate filters.

Question 20

An architect is designing a high-availability (HA) pair of Palo Alto Networks firewalls in Active/Passive mode. During a link failure on the active firewall's primary internal interface, the firewalls fail over successfully, but sessions are immediately dropped on the new active firewall. What configuration setting should be verified to ensure seamless session failover?

Accepted Answer

Verify that HA Session Synchronization is enabled and that dedicated HA backup links are functional.. Session synchronization must be enabled in the HA configuration so that active session state information is continuously replicated from the active to the passive firewall.

Answer

Configure port-channel load sharing using LACP across both HA peers.

Answer

Verify that the management port IP addresses are configured in the same subnet.

Answer

Ensure that preempt is enabled on both firewall peers with a hold time of zero.