Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) (Cybersecurity-Apprentice) — Questions 1–75

A security analyst is hardening a Palo Alto Networks firewall against common reconnaissance and risk exposure vectors. Which TWO configuration steps should the analyst take to secure the management plane? (Choose two)

An administrator observes that specific internal users are bypassing security policies by utilizing unauthorized tunneling applications disguised as standard web traffic. Which PAN-OS feature should be used to identify and block these hidden application tunnels?

An administrator wants to view active sessions matching a specific source IP address (192.168.1.50) using the firewall CLI. Which command is correct?

A security operations team is investigating an incident where an attacker compromised cloud credentials and attempted privilege escalation. Which THREE Prisma Cloud features or data sources assist in detecting and investigating this cloud security incident? (Choose three)

Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)

Which TWO interface types are available when configuring physical ports on a Palo Alto Networks firewall? (Choose two)

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?

A network administrator needs to verify whether a specific security policy rule is matching incoming traffic during a live troubleshooting session. Which CLI command provides real-time packet evaluation against the security rulebase?

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

A security analyst is examining a packet capture (PCAP) and observes that the TCP window size is dropping to zero during a data transfer between a client and a server through the firewall. What does a zero window size typically indicate in a TCP transmission?

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

A SOC analyst is reviewing the primary log categories generated by a Palo Alto Networks Next-Generation Firewall. Which TWO log types are natively available in PAN-OS for security monitoring and incident analysis? (Choose two)

A network engineer configures OSPF on a Palo Alto Networks virtual router. Neighbors are stuck in the EXSTART/EXCHANGE state. What is the most likely cause of this issue?

Under the shared responsibility model in cloud computing, the customer retains responsibility for securing specific layers regardless of whether the service is IaaS, PaaS, or SaaS. Which TWO items are always the customer's responsibility? (Choose two)

An administrator needs to restrict access to the Prisma Cloud administrative console based on corporate IP ranges. Where within the Prisma Cloud platform should the administrator configure trusted IP address restrictions?

A security analyst is reviewing a suspicious inbound connection attempt blocked by the Palo Alto Networks firewall. Which log type contains the details of traffic that matched a Security policy drop or deny action?

An administrator needs to configure a Palo Alto Networks firewall to prevent unauthorized outbound traffic by restricting users to only access approved internal web applications. Which security control should be implemented in the Security policy?

An enterprise security administrator is designing a comprehensive security posture following Zero Trust principles on a Palo Alto Networks Next-Generation Firewall. Which TWO core concepts must be implemented to satisfy a true Zero Trust data and network architecture? (Choose two)

A network security engineer observes that TCP sessions are being terminated prematurely during periods of inactivity. The default application timeout is not meeting the business requirement for a custom database application. Where should the engineer modify the session timeout for this specific application?

An administrator is configuring a File Blocking profile to prevent users from downloading potentially dangerous file types. However, users legitimately need to download password-protected archive files (such as .zip files encrypted with passwords) for business operations. How should the administrator configure the profile to handle encrypted archives safely?

When designing a Security Operations Center (SOC) incident triage workflow, which TWO core principles are fundamental for effective incident management? (Choose two)

A junior cloud engineer is configuring a new AWS S3 bucket and wants to ensure that Prisma Cloud successfully detects public exposure risks. Which Prisma Cloud feature continuously evaluates cloud resource configurations against security benchmarks like CIS?

A security architect is designing an enterprise logging strategy where all Prisma Cloud audit alerts, vulnerability findings, and compliance violations must be streamed to a third-party SIEM (such as Splunk). Which Prisma Cloud feature should be configured to achieve real-time log export?

Which THREE of the following are valid routing protocols supported natively within a PAN-OS Virtual Router? (Choose three)

A security administrator is evaluating cloud environments and needs to determine where customer responsibility ends in an Infrastructure as Service (IaaS) model. Which component is managed entirely by the cloud provider in IaaS?

A security engineer is configuring Prisma Cloud Compute runtime defense rules for containerized workloads. Which THREE runtime behaviors can Prisma Cloud Compute monitor and defend against? (Choose three)

Which TWO types of files or threats are typically inspected and analyzed by the WildFire cloud service when integrated with Cortex XDR? (Choose two)

An administrator is troubleshooting asymmetric routing issues where packets arrive out of order or fail stateful checks. Which TWO features or settings in PAN-OS can assist in handling or mitigating asymmetric routing challenges? (Choose two)

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

A security analyst notices that internal hosts are resolving domains associated with known command and control (C2) servers. Which profile should be attached to the Security policy rule to automatically block this DNS-based threat?

Which security control is primarily responsible for inspecting decrypted web traffic for known viruses, trojans, and worms entering the network?

Which THREE actions occur when an endpoint is placed into 'Isolation' mode using Cortex XDR? (Choose three)

Which THREE features are provided by the Cortex XDR agent to protect endpoints against modern malware and advanced threats? (Choose three)

An enterprise security architect is reviewing Prisma Cloud integration options for securing cloud-native applications throughout their lifecycle. Which THREE activities are supported by Prisma Cloud Application Security (IaC Security)? (Choose three)

An administrator is troubleshooting packet drops on a Palo Alto Networks firewall and wants to inspect dropped packets or hardware counters using CLI diagnostic tools. Which TWO commands can be used to review packet drop information? (Choose two)

An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?

An application security engineer configures Prisma Cloud WAAS (Web Application and API Security) to protect a containerized microservices application running behind an ingress controller. Which deployment method is supported for WAAS in a Kubernetes environment?

A network administrator notices that asymmetric routing is occurring on a multi-path firewall deployment, causing valid TCP sessions to be dropped by the firewall. Which feature should the administrator enable to resolve this issue?

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

An administrator is reviewing the core components and capabilities of Prisma Cloud Cloud Security Posture Management (CSPM). Which TWO capabilities are primary functions of Prisma Cloud CSPM? (Choose two)

An administrator is troubleshooting a packet flow issue where traffic arriving on a Layer 3 interface is being dropped. The administrator runs the command 'show counter global filter packet-drop yes' and notices an increment in counters related to 'Discard due to zone mismatch'. What does this counter typically indicate?

An organization is preparing for a security audit and wants to ensure robust defense-in-depth measures are active on their Palo Alto Networks firewalls. Which TWO security profiles protect against protocol manipulation, evasion techniques, and vulnerability exploitation? (Choose two)

An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)

A security team is reviewing the threat landscape and common attack vectors. Which TWO threats represent prevalent risks that Next-Generation Firewalls mitigate through specialized security subscriptions? (Choose two)

An administrator is deploying Prisma Cloud to secure a multi-cloud environment consisting of AWS and Azure. The administrator needs to understand the boundaries of security management under the shared responsibility model. Which responsibility always remains with the customer regardless of the cloud service model used?

An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?

A DevOps engineer observes that Prisma Cloud Compute vulnerability scans are reporting high severity Common Vulnerabilities and Exposures (CVEs) on running containers, but the build pipeline failed to catch them. How should the engineer integrate Prisma Cloud into the CI/CD pipeline to prevent vulnerable images from being built and pushed?

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

An auditor requests evidence that public AWS S3 buckets are automatically remediated when discovered by Prisma Cloud. Which feature should the security engineer configure to achieve automated remediation?

An enterprise requires remote access users to connect securely via GlobalProtect. Which TWO authentication methods are natively supported by PAN-OS for verifying GlobalProtect user credentials? (Choose two)

A network engineer needs to configure a redundant path for outbound traffic using static routes with different metrics (administrative distances). If the primary route has a metric of 10, what metric should be assigned to the backup static route to ensure it is only used when the primary route fails?

An administrator needs to configure granular endpoint settings for different departments within the organization. Which THREE components of Cortex XDR should be utilized? (Choose three)

An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?

When performing threat hunting in Cortex XDR using XQL, an analyst needs to identify anomalous execution chains. Which THREE XQL query stages or clauses are valid and commonly used in building investigative queries? (Choose three)

An administrator is troubleshooting a complex routing issue where traffic is not taking the expected static route. Which TWO commands can the administrator use to inspect the routing table and test route lookup for a specific destination IP address? (Choose two)

What is the primary benefit of deploying multi-factor authentication (MFA) for administrative access to security infrastructure?

An administrator configures high availability (HA) active/passive mode between two identical firewall models. What happens to active sessions when a failover occurs if 'Session Synchronization' is enabled?

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

A security engineer notices that a specific vulnerability signature is generating false positives for a critical internal custom application. What is the recommended way to prevent this signature from blocking the application without disabling the entire vulnerability profile?

A security operations team is configuring threat intelligence feeds in Cortex XSIAM. Which THREE indicator types can typically be ingested and correlated against network and endpoint telemetry? (Choose three)

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

An enterprise security team wants to prevent developers from deploying Infrastructure as Code (IaC) templates that contain misconfigurations, such as open security groups. Which Prisma Cloud module should be integrated into the developer workflow (e.g., GitHub or Terraform Cloud)?

An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?

During an incident response investigation, a security analyst needs to determine the exact application identified within an encrypted HTTPS stream traversing the firewall. Which PAN-OS feature allows the firewall to identify applications even when obfuscated or using non-standard ports?

Which THREE components are required to successfully configure an SSL Forward Proxy decryption policy on a PAN-OS firewall? (Choose three)

An administrator is reviewing Cortex XDR investigation tools. Which THREE features are available when investigating an incident in the Cortex XDR Incident View? (Choose three)

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

An organization is adopting a Zero Trust architecture. Which foundational principle must be applied to all network traffic traversing the Palo Alto Networks firewall?

An administrator configures a Virtual Wire (VWire) interface pair on a Palo Alto Networks firewall. Traffic passing between the two VWire interfaces is intermittently failing. Upon checking, the administrator realizes VLAN tags are being stripped or not matched properly. What setting should be checked in the VWire object configuration?

An engineer is configuring a new Layer 3 interface on a Palo Alto Networks firewall and needs to ensure that the interface responds to ICMP echo requests for diagnostic purposes. Where must the administrator enable this setting?