Cybersecurity-Apprentice Multiple Select — 50 Questions

Question 1

An organization wants to implement robust risk management and threat detection practices. Which THREE activities are fundamental components of a proactive threat intelligence and risk assessment program? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conducting regular vulnerability assessments and penetration testing to identify security gaps.. Option A is correct because regular vulnerability assessments and penetration testing proactively identify exploitable weaknesses in systems and applications before attackers can leverage them, directly supporting risk assessment and remediation prioritization. Option B is correct because ingesting and monitoring Indicators of Compromise (IOCs) such as malicious IPs, domains, file hashes, and URLs from trusted threat intelligence feeds enables early detection of active threats and enriches SIEM/EDR correlation. Option D is correct because threat modeling during application design (e.g., using STRIDE or PASTA) anticipates attack vectors and informs security requirements before code is written, which is a core proactive risk management practice. Option C is incorrect because removing user access controls violates least privilege and dramatically increases risk rather than managing it. Option E is incorrect because permanently disabling logging destroys the audit trail and telemetry needed for detection, investigation, and compliance, and log overflow should instead be handled via retention policies, rotation, and capacity planning.

Answer

Removing all user access controls to streamline internal developer productivity.

Answer

Permanently disabling all logging to prevent log storage overflow on SIEM disks.

Question 2

A security engineer is reviewing the fundamental security design principles for deploying Palo Alto Networks firewalls in a high-security enterprise data center. Which THREE core practices align with a Zero Trust network architecture model? (Choose three)

Accepted Answer

Inspect and log all traffic across all ports and protocols using App-ID and Threat Prevention.. Zero Trust rejects the idea of a trusted internal network, so Option B is correct because inspecting and logging all traffic on every port and protocol with App-ID and Threat Prevention ensures no flow is blindly trusted and that application-layer visibility and threat detection apply universally. Option C is correct because Zero Trust requires micro-segmentation, and using zones and virtual routers on Palo Alto firewalls creates granular micro-perimeters that contain lateral movement between workloads. Option E is correct because Zero Trust enforces least-privilege access decisions based on user identity, application, and content rather than IP address or network location, which is exactly what Palo Alto's User-ID and App-ID enable. Option A is wrong because implicitly trusting internal-zone traffic is the traditional castle-and-moat assumption that Zero Trust explicitly eliminates. Option D is wrong because relying only on perimeter firewalls and leaving internal lateral traffic uninspected contradicts Zero Trust's requirement to inspect east-west traffic and assume breach.

Answer

Implicitly trust all traffic originating from internal network zones.

Answer

Rely solely on perimeter firewalls while leaving internal lateral traffic uninspected.

Question 3

A security engineer is hardening an Amazon EC2 instance that hosts a public-facing web application. The engineer wants to reduce the attack surface at the network and host layers. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Attach a security group that allows inbound traffic only on ports 80 and 443 from the internet, and restrict all other inbound ports.. Hardening an EC2 instance requires both network-level and host-level reductions in exposure. A restrictive security group limits which inbound ports are reachable from the internet, while removing unnecessary services and packages eliminates host-level entry points. Monitoring and backup actions, such as CloudTrail, AMIs, and CloudWatch, support detection and recovery but do not shrink the attack surface.

Answer

Create an Amazon Machine Image (AMI) backup of the instance before making changes.

Answer

Enable AWS CloudTrail to record all API calls made in the account.

Answer

Enable detailed monitoring in Amazon CloudWatch for the instance.

Question 4

An administrator is configuring a new Layer 3 interface on a Palo Alto Networks firewall. Which TWO parameters must be defined for the interface to function correctly in a routed network? (Choose two)

Accepted Answer

IP Address. Option A (IP Address) is correct because a Layer 3 interface on a Palo Alto Networks firewall must be assigned an IPv4 or IPv6 address (or be configured as DHCP client) to participate in a routed network and forward traffic between subnets. Option B (Security Zone) is correct because every Layer 3 interface must be bound to a security zone, which defines the trust level and the security policy rules that govern traffic entering and leaving that interface. Option C (DHCP Server Scope) is incorrect because a DHCP server scope is only needed if the firewall itself is acting as a DHCP server for clients, not for basic Layer 3 routed operation. Option D (MAC Address Override) is incorrect because overriding the interface MAC address is an optional feature for specific scenarios like ISP requirements or HA, not a mandatory parameter. Option E (Virtual Wire Pair Identifier) is incorrect because virtual wire pairs are used for Layer 2 transparent (tap) deployments, not for Layer 3 routed interfaces.

Answer

DHCP Server Scope

Answer

MAC Address Override

Answer

Virtual Wire Pair Identifier

Question 5

A security team is using Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and GCP. They want to ensure that Prisma Cloud can detect misconfigured storage buckets that allow public read access. Which TWO actions must the team take to enable this capability? (Choose two.)

Accepted Answer

Enable the Prisma Cloud Config assessment feature for each cloud account.. To detect publicly accessible storage buckets, Prisma Cloud must have read-only access to storage services and the Config assessment feature must be enabled. These two actions allow Prisma Cloud to query bucket configurations and evaluate them against security policies. Compute agents, audit logs, and webhooks do not provide the necessary configuration data.

Answer

Deploy Prisma Cloud Compute agents on all virtual machines.

Answer

Configure CloudTrail, Azure Activity Log, and GCP Audit Logs to send logs to Prisma Cloud.

Answer

Set up a Prisma Cloud webhook to receive alerts from cloud providers.

Question 6

A financial services company runs a multi-account AWS organization and uses Prisma Cloud for cloud security posture management. The security team wants to reduce the number of low-value alerts and ensure that findings are routed to the right owners. Which TWO Prisma Cloud capabilities should the team use to achieve this? (Choose two.)

Accepted Answer

Apply policy tags to group related policies and use those tags in alert rules to control which findings are surfaced to each business unit.. Reducing low-value alerts and routing findings to owners requires filtering and targeting, not simply changing scan frequency or disabling policies. Alert rules that use severity, account, and resource tags let the team send only relevant findings to each recipient, while policy tags group related controls so that business units receive the alerts that match their responsibilities. Together these capabilities cut noise and improve ownership without reducing detection coverage.

Answer

Disable all policies that have not generated an alert in the last 30 days to reduce the number of active policies.

Answer

Increase the scan frequency of the cloud accounts to every five minutes so that duplicate alerts are generated for each scan cycle.

Answer

Enable auto-remediation for every high-severity policy so that all findings are fixed without human review.

Question 7

A Tier-1 SOC analyst is preparing to escalate a confirmed malware infection on a finance workstation to the Tier-2 team. Which TWO pieces of information are most essential to include in the escalation ticket to enable effective response? (Choose two.)

Accepted Answer

The affected host's name, IP address, and the user account currently logged in. A useful escalation must identify the affected asset and user, and it must convey the technical detection evidence so the responder can validate and scope the incident quickly. Host identifiers enable correlation and containment, while process tree, hashes, and C2 indicators provide the investigative starting point. Bulk data, environment inventories, and personal preferences do not advance response.

Answer

The full raw packet capture of all traffic from the workstation for the past 24 hours

Answer

A list of every security tool deployed across the entire organization and their version numbers

Answer

The analyst's personal opinion about which team member should handle the case

Question 8

An administrator is configuring OSPF on a Palo Alto Networks virtual router. Which THREE parameters must match between OSPF routers for an adjacency to form successfully? (Choose three)

Accepted Answer

Hello and Dead timer intervals. Option B (Hello and Dead timer intervals) is correct because OSPF neighbors must agree on the Hello interval and Dead interval on the interface; mismatched timers prevent Hello packets from being accepted and the adjacency never reaches 2-Way/Full. Option D (Authentication type and password) is correct because if authentication is configured, both routers must use the same authentication type (e.g., MD5 or SHA) and matching key/password, otherwise OSPF packets fail authentication and are discarded. Option E (Area ID) is correct because two OSPF routers can only form an adjacency if their interfaces belong to the same OSPF area, since the Area ID is carried in the Hello packet and must match. Option A (Process ID) is not required to match because the OSPF process ID is locally significant to the router and is not carried in Hello packets. Option C (Router ID) is not required to match because each OSPF router must have a unique Router ID within the OSPF domain; duplicate Router IDs actually cause adjacency problems rather than being a requirement.

Answer

Process ID

Answer

Router ID

Question 9

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

Accepted Answer

Process execution events. The Cortex XDR agent collects rich endpoint telemetry for behavioral analytics and threat hunting, and process execution events (A) are core because they capture process creation, command lines, parent-child relationships, and related metadata used by the causality chain and Behavioral Threat Protection. Network connection events (B) are also collected, recording endpoint network activity such as connections, ports, and remote IPs so the agent can correlate network behavior with process activity for threat detection and investigation. File modification and creation events (C) are likewise collected, tracking file writes, creations, and related file operations that are essential for detecting malware drops, ransomware behavior, and persistence. The remaining options do not belong: physical datacenter environmental temperature readings (D) are facility/environmental monitoring data not gathered by an endpoint agent, and monitored Wi-Fi router SSID signal strengths (E) are wireless infrastructure metrics outside the Cortex XDR agent's endpoint telemetry scope.

Answer

Physical datacenter environmental temperature readings

Answer

Monitored Wi-Fi router SSID signal strengths

Question 10

A SOC analyst is documenting an incident in which an attacker gained initial access through a phishing email and then created a new local administrator account on a compromised workstation. The analyst must record evidence that supports both the initial access vector and the persistence mechanism. Which TWO artifacts should the analyst collect to support the investigation? (Choose two.)

Accepted Answer

The original email headers and the URL from the phishing message. Documenting this intrusion requires evidence for each phase. The phishing email headers and URL establish the initial access vector, while Windows Security account-management events prove the rogue administrator account was created and identify the responsible actor. Asset tags and desktop appearance are inventory or cosmetic details, and memory from an uninvolved machine cannot speak to actions on the compromised host.

Answer

A full memory dump of the analyst's own triage laptop

Answer

The physical asset tag number of the compromised workstation

Answer

The workstation's current wallpaper and desktop shortcut layout

Question 11

An administrator needs to configure static routing on a PAN-OS Virtual Router. Which THREE parameters are required when defining a static route entry? (Choose three)

Accepted Answer

Next-hop (IP address or interface). The three required parameters for a PAN-OS static route entry are the Route Name (E), the Destination subnet (D), and the Next-hop (C). Option E is correct because every static route in a Virtual Router must be given a unique name to identify it in the routing table and configuration. Option D is correct because a static route must specify the destination IP prefix (network/mask) that the route matches. Option C is correct because the route must define where to forward matching traffic, either via a next-hop IP address or an egress interface. Options A and B are incorrect because BGP AS numbers and OSPF Area IDs are parameters for dynamic routing protocols, not for a static route entry.

Answer

BGP Autonomous System Number

Answer

OSPF Area ID

Question 12

Which TWO methods are valid ways to access the Command Line Interface (CLI) of a Palo Alto Networks firewall? (Choose two)

Accepted Answer

Serial Console connection using a terminal emulator. Option A is correct because a serial console connection using a terminal emulator (typically 9600-8-N-1 on the console/RJ-45 or USB console port) provides direct out-of-band CLI access to the firewall, which is essential for initial configuration and recovery when network access is unavailable. Option D is correct because SSH to the firewall's management IP address on TCP port 22 is the standard in-band method for remotely accessing the CLI, and it is permitted only on the management interface per Palo Alto Networks' management-plane design. Option B is incorrect because FTP on port 21 is a file transfer protocol and does not provide an interactive CLI session. Option C is incorrect because Telnet is not a supported management protocol on Palo Alto Networks firewalls, and CLI management access is restricted to the management interface, not arbitrary data plane interfaces. Option E is incorrect because an HTTPS session on port 443 accesses the web-based management UI (PAN-OS web interface), not the Command Line Interface.

Answer

FTP file transfer session on port 21

Answer

Telnet connection to any data plane interface

Answer

HTTPS web browser session on port 443

Question 13

A cloud security engineer is configuring Prisma Cloud to monitor a multi-cloud environment consisting of AWS, Azure, and Google Cloud. The engineer wants to ensure that Prisma Cloud can continuously assess the security posture of resources across all three providers. Which TWO actions are required to onboard these cloud accounts for posture management? (Choose two.)

Accepted Answer

Create a read-only role or service principal in each cloud account with the necessary permissions for Prisma Cloud to inventory resources.. To onboard cloud accounts for posture management, Prisma Cloud needs read-only API credentials and the accounts added to the console. Then, enabling compliance standards activates policy evaluation. These two actions ensure Prisma Cloud can discover resources and assess them against security benchmarks, providing continuous multi-cloud visibility.

Answer

Deploy Prisma Cloud Compute agents on every virtual machine in each cloud account.

Answer

Set up a VPN connection between each cloud environment and the Prisma Cloud console.

Answer

Install the Prisma Cloud app from each cloud provider's marketplace.

Question 14

Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)

Accepted Answer

Apple macOS. The standard Cortex XDR agent is officially supported on Apple macOS (option C), since Palo Alto Networks provides a native macOS endpoint agent for both Intel and Apple Silicon systems. It is also officially supported on Microsoft Windows 10 and Windows 11 (option D), which are core supported desktop platforms for the Cortex XDR agent. Options A and B are incorrect because embedded automotive CAN bus microcontrollers and commercial airliner avionics flight control firmware are specialized real-time/embedded environments not supported by the standard Cortex XDR agent. Option E is incorrect because consumer smart refrigerator operating systems are embedded IoT platforms outside the agent's supported OS matrix.

Answer

Embedded automotive CAN bus microcontrollers

Answer

Commercial airliner avionics flight control firmware

Answer

Consumer smart refrigerator operating systems

Question 15

A Cortex XDR administrator is configuring an endpoint protection policy for a group of Windows servers that host a custom in-house database application. The application frequently writes large temporary files and spawns child processes during batch jobs. The administrator wants to reduce false positives without disabling protection entirely. Which TWO policy actions should the administrator take? (Choose two.)

Accepted Answer

Add the application's executable and its working directory to the Behavioral Threat Protection exclusions for the server policy. Reducing false positives on a trusted server requires narrowly scoped exclusions rather than weakening protection globally. Excluding the specific application executable and its working directory from Behavioral Threat Protection stops the benign process-spawning and file-writing pattern from being flagged, while a malware exclusion on the temporary directory prevents repeated scanning of churning trusted files. Both actions preserve the modules for all other activity on the host.

Answer

Disable the Malware, Exploit, and Behavioral Threat Protection modules entirely on the server policy

Answer

Set the agent to Report mode for all modules so detections are logged but nothing is blocked

Answer

Lower the agent's scan schedule frequency so temporary files are only scanned once per day

Question 16

Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)

Accepted Answer

Endpoint management platforms such as Microsoft Intune or SCCM.. Option C is correct because Cortex XDR agent MSI packages can be distributed through enterprise endpoint management tools like Microsoft Intune or SCCM, which push the installer to managed Windows endpoints and run it with the required system privileges. Option D is correct because the agent package can be installed manually by running the MSI interactively with administrator rights, which is a supported deployment method for individual or small-scale installs. Option E is correct because Active Directory Group Policy Object software installation can assign or publish the Cortex XDR MSI to domain-joined Windows computers, installing it automatically at startup with elevated rights. Option A is not a valid software deployment mechanism, since FM radio broadcasts cannot deliver or execute an MSI package on Windows endpoints. Option B is also invalid and unsafe, as unauthenticated printer port scans cannot inject an MSI payload and do not represent any supported Cortex XDR deployment method.

Answer

Broadcasting the installation package over commercial FM radio frequencies.

Answer

Injecting the MSI payload via unauthenticated network printer port scans.

Question 17

A financial services company is migrating workloads to Microsoft Azure and must strengthen its identity security posture. The security team wants to enforce controls that reduce the impact of compromised user accounts. Which TWO measures should the team implement? (Choose two.)

Accepted Answer

Enable Microsoft Entra ID multifactor authentication for all users. Multifactor authentication and Conditional Access policies that require compliant devices both add verification layers beyond a password, so stolen credentials alone cannot grant access. Broad Owner role assignments, disabling security defaults, and exposing secrets all weaken identity protections and increase the damage a compromised account can cause.

Answer

Store application service principal secrets in plaintext in a public repository

Answer

Assign the Owner role at the subscription scope to all developers

Answer

Disable Microsoft Entra ID security defaults for the tenant

Question 18

A security analyst is reviewing Cortex XDR endpoint alerts and notices that a process on a Windows endpoint performed a series of actions: it created a child process from a Microsoft Office application, then attempted to write to the memory of that child process. The analyst suspects a multi-stage attack. Which TWO Cortex XDR agent modules would most likely generate alerts for these actions? (Choose two.)

Accepted Answer

Exploit Protection. Behavioral Threat Protection detects suspicious process behavior chains, such as Office applications spawning child processes, which is a common attack pattern. Exploit Protection detects memory manipulation techniques like writing to another process's memory, indicating code injection or exploitation. Together, these modules would generate alerts for the described multi-stage attack. Device Control, Malware Protection, and Disk Encryption are not relevant to these specific behaviors.

Answer

Device Control

Answer

Disk Encryption

Answer

Malware Protection

Question 19

A security team is evaluating Prisma Cloud's cloud infrastructure entitlement management (CIEM) capabilities for a multi-cloud environment. The team wants to identify identities with excessive permissions. Which TWO functions does Prisma Cloud CIEM provide to support this goal? (Choose two.)

Accepted Answer

It identifies unused or over-privileged permissions and recommends right-sizing based on observed activity.. Prisma Cloud CIEM analyzes effective permissions across policies and boundaries to reveal what identities can actually do, and it compares granted permissions with observed usage to flag unused or over-privileged access with right-sizing recommendations. These two functions directly support identifying identities with excessive permissions in a multi-cloud environment.

Answer

It enforces network microsegmentation between workloads based on their identity labels.

Answer

It scans container images for known vulnerabilities and generates fix recommendations.

Answer

It automatically rotates all access keys and secrets for every identity in the cloud environment.

Question 20

A network security engineer is configuring a new Palo Alto Networks firewall to securely allow remote users to access internal applications. The engineer decides to implement GlobalProtect with SSL VPN. Which TWO configurations are required to enable user authentication and ensure that only authorized users can access the internal applications? (Choose two.)

Accepted Answer

Configure an Authentication profile that specifies an LDAP server for user credential validation.. To enable GlobalProtect with SSL VPN and ensure authorized access, an Authentication profile is needed to validate user credentials against a directory service. Additionally, a Security policy rule must permit traffic from the GlobalProtect zone to the internal zone and include user/group matching to enforce authorization. These two configurations together provide authentication and access control for remote users.

Answer

Configure a Decryption policy to inspect all SSL VPN traffic for threats.

Answer

Set up a GlobalProtect portal and gateway with client certificate authentication only.

Answer

Enable User-ID on the internal zone to map IP addresses to usernames.