Cybersecurity-Apprentice Multiple Select — 20 Questions

Question 1

When onboarding multi-account cloud environments into Prisma Cloud, administrators can choose from several integration methods. Which THREE advantages are gained by setting up centralized cloud account onboarding and role aggregation? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Simplifies IAM role maintenance by leveraging organization-level trust relationships. Centralized onboarding simplifies management, ensures consistent security policies, and reduces administrative overhead across large multi-account enterprise structures.

Answer

Enables VM-Series firewalls to route BGP updates directly to the ISP

Answer

Allows Prisma Cloud to directly reboot physical data center servers during hardware failures

Question 2

An administrator is configuring Prisma Cloud Compute defense mechanisms for serverless functions (FaaS) such as AWS Lambda. Which THREE capabilities does Prisma Cloud provide for serverless security? (Choose three)

Accepted Answer

Secret detection to prevent credentials from being hardcoded in serverless source code. Prisma Cloud protects serverless functions by scanning function code and packages for vulnerabilities, protecting against injection attacks, and monitoring runtime behavior.

Answer

Configuring enterprise BGP peering sessions between cloud VPCs and on-premises routers

Answer

Providing dedicated physical server rack space in AWS data centers

Question 3

An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)

Accepted Answer

Continuous cloud resource configuration auditing against security benchmarks. Prisma Cloud CSPM focuses on continuous cloud configuration monitoring, compliance reporting, and asset visibility across multi-cloud environments.

Answer

Active runtime container memory dumping and kernel rootkit prevention

Answer

Line-rate Layer 7 decryption of TLS encrypted inbound web traffic

Answer

Remote user secure web gateway DNS tunneling prevention

Question 4

An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)

Accepted Answer

Scanning Terraform, AWS CloudFormation, and Kubernetes YAML templates for misconfigurations. Prisma Cloud Application Security scans infrastructure as code templates, open source dependencies, and CI/CD pipelines to find vulnerabilities before deployment.

Answer

Performing active real-time DDoS mitigation on public BGP routing tables

Answer

Enforcing hardware token multi-factor authentication for corporate VPN users

Question 5

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Proactive risk management includes vulnerability assessments, threat modeling, and indicators of compromise (IOC) monitoring.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 6

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust principles include continuous verification, least privilege access, inspecting and logging all traffic, and assuming breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 7

An organization is hardening its Palo Alto Networks firewalls against advanced persistent threats (APTs) and malware campaigns. Which THREE advanced features or profiles should be deployed to ensure maximum protection against zero-day exploits and multi-stage attacks? (Choose three)

Accepted Answer

Inline machine learning capabilities within threat prevention profiles to block zero-day exploits in real-time.. APT and zero-day protection relies on WildFire cloud sandbox analysis, DNS Security for malicious domain detection, and inline machine learning.

Answer

SNMP v1 read-only community strings configured on the management interface.

Answer

Static IPsec VPN tunnels with disabled phase 2 rekeying.

Question 8

An enterprise security team is implementing data protection controls on their Palo Alto Networks firewalls. Which THREE mechanisms can be utilized to prevent unauthorized data exfiltration? (Choose three)

Accepted Answer

Data Filtering profiles configured to inspect traffic for patterns such as credit card numbers or social security numbers.. Data exfiltration is prevented using Data Filtering profiles, File Blocking profiles, and SSL Decryption to inspect encrypted egress traffic.

Answer

Management interface IP allow lists.

Answer

GlobalProtect clientless portal customization banners.

Question 9

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). A static route requires a destination subnet, a next-hop specification (IP address or interface), and a route name/destination identifier.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID

Question 10

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

Accepted Answer

Configure an interface Management Profile that restricts administrative access (HTTPS, SSH) to trusted management IP addresses only.. Securing the management plane involves restricting administrative access via Management Profile source IP whitelisting and ensuring strong administrative authentication settings.

Answer

Deploy an Antivirus security profile on outbound HTTP Security policy rules.

Answer

Disable the captive portal service on all internal user-facing security zones.

Answer

Configure dynamic DNS updates on the external untrusted interface.

Question 11

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Tier-1 analysts focus on initial alert triage, alert verification, running basic playbooks, and escalating verified threats to Tier-2.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 12

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

Accepted Answer

Provides a standardized industry terminology for describing adversary tactics and techniques.. MITRE ATT&CK mapping provides a common framework for understanding adversary tactics, standardizing incident reports, and identifying security coverage gaps.

Answer

Automatically recompiles malicious binary code into safe executable patches.

Answer

Directly replaces the need for endpoint firewalls and network segmentation.

Question 13

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. OSPF neighbors must have matching Area ID, Hello/Dead intervals, and authentication parameters (if enabled) to form an adjacency.

Answer

Process ID

Answer

Router ID

Question 14

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Layer 3. PAN-OS physical interfaces can be configured in several modes, including Layer 3, Layer 2, Virtual Wire, and Tap.

Answer

WAN Accelerator

Answer

Switchport Trunk

Answer

Promiscuous Bridge

Question 15

An administrator is configuring NAT on a Palo Alto Networks firewall. Which THREE address types can be used as translation sources in a Source NAT rule? (Choose three)

Accepted Answer

Static IP. Source NAT translation can utilize dynamic IP and port (DIPP), dynamic IP, or static IP configurations.

Answer

VLAN Subinterface Tag

Answer

Port Forwarding Pool

Question 16

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

Accepted Answer

SAML. PAN-OS supports multiple authentication methods including RADIUS, LDAP, SAML, Kerberos, and local database authentication.

Answer

IPsec Pre-Shared Key exchange exclusively without user credentials

Answer

WPA3 Enterprise 802.1X

Answer

SNMPv3 localized USM passwords

Question 17

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

Accepted Answer

Reset the user password in Active Directory via integration command.. Compromised credential playbooks typically involve resetting the user's password in Active Directory, revoking active sessions, and notifying the user or manager.

Answer

Factory reset all enterprise core routing switches.

Answer

Format the physical hard drive of the Active Directory Domain Controller.

Question 18

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

Accepted Answer

A Decryption policy rule configured with the 'Forward Proxy' action.. SSL Forward Proxy requires a Decryption policy rule, a Decryption profile (with Forward Proxy action), and a trusted Forward Trust Certificate signed by an internal CA.

Answer

An external BGP routing peer for prefix exchange.

Answer

A GlobalProtect Gateway license installed on the management plane.

Question 19

An administrator is reviewing security logs and notices several sessions marked as 'App-ID' change mid-session from 'unknown-tcp' to a specific application like 'ssl' or 'web-browsing'. Which TWO mechanisms explain this behavior? (Choose two)

Accepted Answer

App-ID re-evaluates traffic as more packets are inspected and application signatures match deeper in the stream.. App-ID initially identifies traffic based on initial packets (port/heuristics), and as payload decryption or deeper signature inspection occurs (e.g., SSL handshake or HTTP parsing), App-ID re-evaluates and updates the session application.

Answer

The firewall rebooted mid-session, causing the application cache to reset.

Answer

Static routing tables dynamically updated the next-hop gateway.

Answer

NAT rules translated the source port, forcing an application renegotiation.

Question 20

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

Accepted Answer

Process execution events. The Cortex XDR agent collects comprehensive endpoint telemetry including process executions, network connections, file modifications, and registry events.

Answer

Physical datacenter environmental temperature readings

Answer

Monitored Wi-Fi router SSID signal strengths