Cybersecurity-Apprentice Security Operations Practice Test 2 — 15 Questions

Question 1

An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Panorama Pre-Rule or Post-Rule blocking the destination IP address and push the policy to managed firewalls.. Panorama manages multiple firewalls centrally, and its Pre-Rules and Post-Rules are policy rulebases that are pushed to all managed firewalls. Creating a Pre-Rule or Post-Rule that blocks the destination C2 IP address and pushing the policy to managed firewalls immediately enforces the block enterprise-wide, which is the correct containment action for a known C2 destination. This leverages Panorama's centralized policy management to stop further communication across all managed enforcement points.

Answer

Change the GlobalProtect Gateway IP pool configuration.

Answer

Modify the local hosts file on every endpoint via Cortex XDR Action Center.

Answer

Reboot the Panorama management server to flush active state tables.

Question 2

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles in PAN-OS are defined under Device > Server Profiles > Syslog, where you configure the server name, IP/FQDN, port, transport (UDP/TCP/SSL), format (BSD, IETF), and facility. This profile is then referenced in Log Forwarding profiles attached to Security, Threat, or other log types.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 3

A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?

Accepted Answer

Navigate to Cortex XDR > Incident View to review the automated attack story and affected endpoints.. Cortex XDR's Incident View is the central triage console that automatically correlates endpoint telemetry into an attack story, showing the causal chain of events, affected endpoints, and root cause. For a ransomware outbreak, this is where an analyst immediately sees scope (how many endpoints) and the initial infection vector. It is the designed starting point for incident triage, not policy or hunting tools.

Answer

Run a manual threat hunting query in the Action Center to install new agents.

Answer

Access the Policy Editor to disable the infected endpoints from the network.

Answer

Open the Endpoint Protection profiles to manually delete the malware binaries.

Question 4

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire Portal provides a public and private cloud analysis search interface where analysts can manually submit or look up a file hash (MD5, SHA-1, or SHA-256) to see whether WildFire has previously analyzed it and what verdict was returned. This is the standard manual hash lookup method in the Palo Alto Networks ecosystem. It is distinct from automated WildFire forwarding configured on firewalls.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 5

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

Accepted Answer

Review the Cyvera.txt log file located in the Cortex XDR installation directory.. The Cyvera.txt log file is the primary diagnostic log for the Cortex XDR agent on Windows endpoints. It records detailed information about agent operations, including communication attempts with the Cortex XDR server, registration status, and any errors encountered during telemetry upload. Since the issue is specifically about agents failing to report telemetry, this log provides the most direct evidence of the communication failure. Other logs listed are either installation-related or pertain to different Palo Alto products (PAN-OS, log collector).

Answer

Open the msiexec.log file generated during the initial software installation.

Answer

Check the /var/log/pan/nsm.log file on the log collector.

Answer

Inspect the pan_event_log.csv file in the PAN-OS system partition.

Question 6

A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?

Accepted Answer

Navigate to Cortex XSIAM > Settings > Data Sources to review agent and collector ingestion health metrics.. Cortex XSIAM's Settings > Data Sources section provides ingestion health metrics for agents, collectors, and brokers, showing whether logs are being received, parsed, and whether any data is being dropped. This is the correct place to verify log collector health and parsing status. It gives visibility into throughput, errors, and source status across all integrated data sources.

Answer

Open the Threat Intelligence management page and verify API token validity.

Answer

Review the GlobalProtect Gateway logs for active tunnel handshakes.

Answer

Check the Panorama > Setup > Operations > Export Panorama Configuration menu.

Question 7

An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?

Accepted Answer

Create an exception rule in Cortex XDR using the alert details to filter out the scanner's specific parameters.. Cortex XDR allows analysts to create exception rules (also called exclusions or alert exceptions) that match specific alert parameters — such as the scanner's host, process, or signature — so that the false-positive alert is suppressed without disabling detection globally. This is the surgical, recommended way to tune out a known benign scanner. It preserves security coverage for all other activity.

Answer

Delete the default Security Policy rule on the firewall governing internal subnets.

Answer

Disable the entire Local Analysis module globally across all endpoint security profiles.

Answer

Restart the Cortex XDR Agent daemon on the vulnerability scanner host.

Question 8

A tier-1 SOC analyst receives an alert for a blocked malware execution detected by WildFire on a firewall. What is the standard operational response procedure for this type of high-confidence prevention alert?

Accepted Answer

Verify that the threat was successfully blocked by the firewall and check if any other endpoints attempted to access the same file.. WildFire is Palo Alto Networks' cloud-based malware analysis sandbox, and when it identifies a file as malicious, the firewall can enforce a prevention action (block or alert) inline. Because the alert indicates the threat was already blocked, the analyst's job shifts from containment to verification and scope assessment — confirming the block succeeded and checking whether other hosts attempted to download the same file, which would indicate a broader campaign or lateral movement attempt. This is the standard tier-1 triage pattern for high-confidence prevention alerts: validate the control worked, then hunt for related activity.

Answer

Escalate the alert directly to law enforcement without reviewing internal logs.

Answer

Immediately re-image the firewall management plane to remove potential rootkits.

Answer

Disable WildFire inline inspection to prevent future network latency.

Question 9

An administrator is configuring log forwarding filters in PAN-OS to reduce the volume of unneeded informational logs sent to an external SIEM. Where are these log forwarding filters defined?

Accepted Answer

Objects > Log Forwarding, attached to individual Security Policy rules.. Log forwarding filters in PAN-OS are defined under Objects > Log Forwarding, and the resulting log forwarding profile is attached to individual Security Policy rules. This allows administrators to control which logs (e.g., only high-severity threats, or only traffic logs for specific applications) are sent to external destinations like syslog or SIEM. The filter is evaluated per policy rule, giving granular control over log volume.

Answer

Device > Setup > Management, under the Syslog export filter tab.

Answer

Panorama > Collector Groups > Log Retention policies.

Answer

Network > Interfaces > Ethernet, under the advanced logging parameters.

Question 10

A SOC analyst is reviewing real-time firewall traffic in the Application Command Center (ACC). What is the primary purpose of the ACC in a Palo Alto Networks firewall?

Accepted Answer

To provide a visual and interactive summary of network traffic, applications, and threats over time.. The Application Command Center (ACC) in Palo Alto Networks firewalls is a dashboard that provides visual, interactive summaries of network traffic, applications, users, and threats over time. It aggregates data from traffic, threat, URL, and WildFire logs into widgets and charts, enabling analysts to spot trends and drill down into specific activity. It is a monitoring and visibility tool, not an enforcement or automation engine.

Answer

To execute active containment playbooks on infected endpoint hosts.

Answer

To automatically generate SIEM correlation rules based on machine learning.

Answer

To compile configuration backups before pushing policy changes.

Question 11

An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?

Accepted Answer

Review the Cortex XDR Causality Chain and Timeline view for the affected endpoint.. The Cortex XDR Causality Chain and Timeline view reconstructs the full sequence of events — process creation, network connections, file writes, registry changes — linked by causality (parent-child process relationships) for a specific endpoint and alert. This is the purpose-built investigative surface for understanding malware execution flow chronologically. It lets the analyst pivot from the initial alert to root cause and downstream impact in one view.

Answer

Run a vulnerability scan against the endpoint using Panorama compliance tools.

Answer

Examine the DHCP lease table on the core routing switch.

Answer

Export the firewall Traffic Log CSV and sort by destination port numbers.

Question 12

An incident responder is investigating a suspected lateral movement attack where an attacker utilized stolen Kerberos tickets (Pass-the-Ticket). Which log source in Cortex XSIAM or Windows event collection is essential for detecting abnormal Kerberos service ticket requests (Event ID 4769)?

Accepted Answer

Windows Security Event Logs (specifically Event ID 4769 for Kerberos service tickets).. Event ID 4769 is generated on domain controllers whenever a Kerberos service ticket (TGS) is requested, and it is the authoritative record for detecting Pass-the-Ticket activity. Because Pass-the-Ticket abuses valid stolen TGS tickets rather than forging credentials, the only reliable detection point is the Kerberos service ticket request telemetry captured in the Windows Security Event Log. Cortex XSIAM ingests these Windows Security events via its Windows agent or broker, allowing correlation of anomalous 4769 patterns such as unusual service names, encryption downgrades (RC4), or source hosts that never performed a TGT request (4768).

Answer

Prisma Access Cloud DNS query logs.

Answer

PAN-OS GlobalProtect Gateway connection logs.

Answer

Cortex XDR Device Control logs for USB storage insertions.

Question 13

During a routine audit, a SOC supervisor wants to ensure that all administrative logins to Panorama and managed firewalls are centrally tracked and securely archived. Which log type in the PAN-OS logging architecture records administrator login sessions and configuration changes?

Accepted Answer

Configuration and System logs.. In PAN-OS, Configuration logs record administrator configuration changes, and System logs record administrator login/logout sessions and system events. Together, the Configuration and System log types provide the centralized tracking and secure archiving of administrative logins and config changes that the SOC supervisor requires.

Answer

WildFire Submission and Analysis logs.

Answer

Data Filtering and GTP logs.

Answer

Threat and URL Filtering logs.

Question 14

An analyst notices that a specific URL is incorrectly categorized by the Palo Alto Networks URL Filtering database (BrightCloud/PAN-DB). What is the appropriate procedure to request a re-categorization of this URL?

Accepted Answer

Submit a URL categorization review request directly through the Palo Alto Networks URL Filtering review site.. Palo Alto Networks maintains the URL categorization database (PAN-DB) and provides a public review portal where anyone can submit a URL for re-categorization if it is misclassified. Submitting through this official review site triggers a human/automated review, and if approved, the change propagates to firewalls on the next content update cycle. This is the documented, supported procedure for correcting categorization errors.

Answer

Delete all local threat intelligence feeds from the Panorama server.

Answer

Reinstall the firewall firmware to factory default settings.

Answer

Manually edit the PAN-OS kernel routing table.

Question 15

When designing a Security Operations Center (SOC) incident triage workflow, which TWO core principles are fundamental for effective incident management? (Choose two)

Accepted Answer

Establishing clear severity levels and prioritization criteria for incoming alerts.. Option A is correct because a SOC triage workflow depends on defined severity levels and prioritization criteria (for example, mapping alerts to P1–P4 based on asset criticality, exploitability, and business impact) so analysts consistently decide what to work first. Option C is correct because repeatable playbooks and documentation for standard incident types (such as phishing, malware, or unauthorized access) standardize response steps, reduce mean time to respond (MTTR), and ensure consistent, auditable handling across shifts. Option B is incorrect because granting every analyst unrestricted administrator access to all enterprise systems violates least privilege and expands the attack surface and insider-risk exposure. Option D is incorrect because ignoring low-severity alerts without review or automation creates blind spots and lets minor indicators escalate into major incidents. Option E is incorrect because deleting all historical log data daily destroys the evidence needed for detection, correlation, forensics, and compliance retention requirements.

Answer

Allowing every analyst unrestricted administrator access to all enterprise systems.

Answer

Ignoring low-severity alerts completely without review or automation.

Answer

Deleting all historical log data daily to maintain optimal disk storage capacity.