Cybersecurity-Apprentice Network Fundamentals Practice Test 2 — 15 Questions

Question 1

An administrator is troubleshooting packet drops on a Palo Alto Networks firewall and wants to inspect dropped packets or hardware counters using CLI diagnostic tools. Which TWO commands can be used to review packet drop information? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show counter global filter packet-drop yes. Option B, 'show counter global filter packet-drop yes', is correct because the global counter command with the packet-drop filter displays only the counters related to packet drops, letting the administrator quickly identify which drop reasons (e.g., flow, decode, resource) are incrementing on the firewall. Option E, 'show counter global filter delta yes', is correct because the delta filter shows the change in global counters since the last time the command was run, which is essential for spotting active packet drops in real time rather than cumulative totals. Options A, C, and D are not valid PAN-OS CLI commands: 'debug session drop-history' is not a supported diagnostic command, 'show ip route drop-packets' does not exist for inspecting drops, and 'show interface drop-counters all' is not a recognized PAN-OS syntax for reviewing drop counters.

Answer

debug session drop-history

Answer

show ip route drop-packets

Answer

show interface drop-counters all

Question 2

A cybersecurity apprentice is reviewing network traffic logs and observes that a user's device is sending multiple identical DNS queries to different DNS servers for the same domain name. The apprentice wants to understand which TWO characteristics of DNS could explain this behavior. (Choose two.)

Accepted Answer

DNS clients may query multiple configured DNS servers in parallel or sequentially if the first server does not respond within a timeout period.. The two correct characteristics are that DNS uses UDP port 53, which is unreliable and can lead to retransmissions, and that DNS clients may query multiple servers if the first does not respond in time. Both can result in multiple identical queries being sent from the same device. The other options are incorrect because they either misstate DNS protocol usage or make absolute claims that do not fit the scenario.

Answer

DNS responses are always cached locally, so a client should never send multiple queries for the same domain.

Answer

DNS queries are encrypted by default, which causes additional handshake queries to be sent to each server.

Answer

DNS uses TCP port 53 for all queries to ensure reliability, which causes duplicate queries when packets are retransmitted.

Question 3

A junior administrator is asked to verify the IP address, subnet mask, and default gateway of the management interface on a Palo Alto Networks firewall. Which CLI command should be used?

Accepted Answer

show interface management. To verify the management interface's IP configuration on a Palo Alto Networks firewall, the correct CLI command is 'show interface management'. It provides the IP address, netmask, and default gateway. Other commands like 'show interface all' or 'show system info' do not focus on management interface settings, and 'show management-interface' is not a valid command.

Answer

show interface all

Answer

show management-interface

Answer

show system info

Question 4

A network security engineer is configuring a Palo Alto Networks firewall to perform source NAT for outbound internet traffic. The internal network is 192.168.1.0/24, and the firewall's external interface is 203.0.113.5/24. The engineer wants all outbound traffic to appear as the external interface IP. Which NAT configuration is correct?

Accepted Answer

Source NAT rule with original source 192.168.1.0/24, translated source 203.0.113.5, and destination interface as the external interface.. For outbound source NAT, the rule must translate the internal source subnet to the external interface IP and specify the destination interface as the egress interface. This ensures only traffic leaving that interface is translated. Reversing the addresses or using destination NAT would not achieve the desired hiding of internal addresses.

Answer

Source NAT rule with original source 192.168.1.0/24, translated source 203.0.113.5, and no destination interface specified.

Answer

Destination NAT rule with original destination 203.0.113.5, translated destination 192.168.1.0/24.

Answer

Source NAT rule with original source 203.0.113.5, translated source 192.168.1.0/24.

Question 5

A cybersecurity apprentice is setting up a small office network and needs to connect two switches to allow devices on both switches to communicate as if they were on the same local area network. The apprentice wants to ensure that frames from one switch can reach the other without any routing. Which type of connection should the apprentice use between the switches?

Accepted Answer

A crossover cable between the switches. A crossover cable is used to connect two switches directly, enabling Layer 2 communication between them. This allows devices on both switches to be part of the same broadcast domain without routing. While modern switches may support Auto-MDI/X, the crossover cable remains the correct traditional choice for switch-to-switch connections. The other options involve routing, VLAN tagging, or access links, which are not appropriate for simple same-LAN connectivity.

Answer

An access link configured for a single VLAN

Answer

A router with separate interfaces for each switch

Answer

A trunk link carrying multiple VLANs

Question 6

A network administrator is configuring a new subnet on a Layer 3 switch. The administrator must ensure that hosts on this subnet can communicate with hosts on remote subnets. Which TWO parameters must be configured on the Layer 3 switch interface to enable inter-subnet routing? (Choose two.)

Accepted Answer

IP routing enabled globally. To enable inter-subnet routing on a Layer 3 switch, the administrator must assign an IP address with a subnet mask to the interface (SVI) and enable IP routing globally. The IP address allows the interface to act as a gateway for hosts, while global IP routing allows the switch to forward packets between subnets. The VLAN ID is needed to associate the SVI with a VLAN, but it does not enable routing by itself. A default gateway is configured on hosts, not the switch interface, and a default static route is only needed for external destinations.

Answer

A static route to 0.0.0.0/0

Answer

A VLAN ID

Answer

A default gateway address

Question 7

A cybersecurity apprentice is documenting how a router handles IPv4 packets. She needs to identify TWO fields in the IPv4 header that can change as a packet is forwarded hop by hop across the network. (Choose two.)

Accepted Answer

Time to Live. Two IPv4 header fields are designed to be mutable in transit. Time to Live is decremented at every router to prevent loops, and the Header Checksum is recomputed whenever any header field changes so the receiver can validate integrity. Other fields, including the source address, protocol, and identification, are set by the sender and remain unchanged during ordinary forwarding.

Answer

Protocol

Answer

Identification

Answer

Source IP Address

Question 8

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

Accepted Answer

The receiver's buffer is full and it is requesting the sender to pause transmission.. A TCP window size of zero means the receiver's receive buffer is full and it is advertising a zero window to tell the sender to stop transmitting until it can drain the buffer. This is normal TCP flow control, not an error — the sender will periodically send zero-window probes until the receiver advertises a non-zero window.

Answer

The maximum segment size (MSS) negotiation has failed during the three-way handshake.

Answer

An asymmetric routing loop has caused sequence numbers to go out of sync.

Answer

The firewall has blocked the session due to a security profile match.

Question 9

An administrator is configuring a new Layer 2 subinterface on a Palo Alto Networks firewall and needs to associate it with an existing VLAN ID. Where is the VLAN tag specified for a Layer 2 subinterface?

Accepted Answer

In the Tag field of the Layer 2 interface configuration. For a Layer 2 subinterface on a Palo Alto Networks firewall, the VLAN tag is specified in the Tag field of the Layer 2 interface configuration. This field binds the subinterface to a specific 802.1Q VLAN ID so the firewall can process tagged frames correctly. The Tag field is the only place where the VLAN ID is defined for a Layer 2 subinterface.

Answer

Within the DHCP Server IP pool configuration

Answer

In the Virtual Router general settings

Answer

Inside the Zone Protection Profile assigned to the interface

Question 10

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?

Accepted Answer

An Interface Management Profile assigned to the interface. To allow a Palo Alto Networks firewall interface to respond to ICMP echo requests (ping) for diagnostics, an Interface Management Profile must be created and assigned to that interface. The profile explicitly enables management services like Ping, Telnet, SSH, HTTP, HTTPS, and SNMP on the interface.

Answer

A Security Policy rule with an application of 'ping'

Answer

A Zone Protection Profile applied to the egress zone

Answer

The Device > Setup > Management tab

Question 11

An administrator needs to configure a static route on a Palo Alto Networks firewall so that traffic destined for a remote subnet (192.168.10.0/24) reaches its next-hop router (10.0.0.1). Which menu path must the administrator navigate to configure this?

Accepted Answer

Network > Virtual Routers > [Virtual Router Name] > Static Routes. On a Palo Alto Networks firewall, static routes are configured under the virtual router. The correct path is Network > Virtual Routers > [Virtual Router Name] > Static Routes, where you define the destination subnet (192.168.10.0/24) and the next-hop IP (10.0.0.1). This is the standard PAN-OS navigation for static routing.

Answer

Device > Setup > Operations > Routing

Answer

Network > Interfaces > Ethernet > Static Route

Answer

Policies > Routing > Static

Question 12

An administrator is troubleshooting a connectivity issue between a host and a server across a Palo Alto Networks firewall. The administrator needs to verify whether the firewall is dropping the packets due to a security rule denial. Which CLI command should the administrator use to monitor packet drops in real time?

Accepted Answer

show counter global filter packet-drop yes. The command 'show counter global filter packet-drop yes' displays global counters related to packet drops in real time, allowing the administrator to see if the firewall is dropping packets and the reason (e.g., security policy deny, threat, etc.). This is the standard PAN-OS CLI troubleshooting command for verifying drop counters. It filters the global counter output to show only drop-related counters, which is exactly what is needed to diagnose a security rule denial.

Answer

show system resources

Answer

show session all

Answer

show interface all

Question 13

An administrator has configured BGP on a Palo Alto Networks virtual router, but the BGP peers are stuck in the 'Idle' state. What is the most likely configuration error causing this status?

Accepted Answer

An incorrect peer AS number or incorrect peer IP address configuration. BGP peers stuck in the Idle state means the router has not even begun the TCP connection or has repeatedly failed to establish one, which most commonly results from a misconfigured peer IP address or peer AS number. If the peer address is wrong, the TCP session to port 179 never forms; if the peer AS number is wrong, the OPEN message is rejected and the session tears down back to Idle. Both are fundamental peer configuration errors that prevent the BGP finite state machine from progressing.

Answer

An AS-path loop detection trigger

Answer

MD5 authentication password mismatch during OPEN message exchange

Answer

BGP route reflection timer expiration

Question 14

An administrator needs to verify the MAC address associated with a specific IP address on the local network segment using the firewall CLI. Which command should be executed?

Accepted Answer

show arp all. The 'show arp all' command displays the ARP cache, which maps IP addresses to MAC addresses on the local network segment. This is the correct way to verify the MAC address associated with a specific IP on a Palo Alto Networks firewall CLI. ARP entries are populated dynamically as the firewall communicates with hosts on the same subnet.

Answer

show mac-table all

Answer

show interface ip

Answer

show routing route

Question 15

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

Accepted Answer

Objects > Applications > [Application Name], modifying TCP timeout settings. In Palo Alto Networks PAN-OS, application-specific TCP timeout settings are configured under Objects > Applications > [Application Name], where you can override the default session timeout for that application. This allows the engineer to extend the timeout for the custom database application without affecting global or interface-level timeouts. Modifying the application object ensures the change applies only to traffic identified as that application.

Answer

Network > Interfaces > Advanced > TCP Timeout

Answer

Policies > Security > Timeout Profile

Answer

Device > Setup > Management > Session Settings