Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) (Cybersecurity-Apprentice) — Questions 1–75

Forwarding the suspicious email preserves the original headers and URL, which the security team needs to analyze the sender, reply-to, and embedded link. Telling the employee not to click prevents credential compromise. This is the safest first step because it isolates the threat without interacting with it, and it gives responders evidence to determine whether other employees received the same message.

An interface Management Profile defines which administrative protocols (HTTPS, SSH) are permitted on that interface and from which source addresses. Restricting it to trusted management IPs prevents untrusted hosts reaching the management plane, directly reducing reconnaissance and exposure vectors.

Tuning thresholds and creating exceptions for trusted hosts or applications helps reduce false positives without disabling protection entirely. For example, if a legitimate application triggers a signature, an exception can be made for that specific host or flow. This maintains security while avoiding disruption. It is a key step in NIPS tuning to achieve a balance between detection and operational continuity.

App-ID identifies applications by their intrinsic traffic signatures and behaviour, not merely port or protocol, so tunnelling tools masquerading as standard web traffic are still recognised. Application-based Security policy rules then enforce allow or deny decisions against that App-ID, directly satisfying the requirement to identify and block hidden application tunnels.

Full-disk encryption renders the stored data unreadable without the decryption key, so removing the drive or booting another operating system yields only ciphertext. Pre-boot authentication ensures the key is released only after the user proves identity, protecting against cold-boot and offline attacks. Because the data lives on the local drive and the user works offline, this control directly meets the requirement without depending on network connectivity.

Bot detection and behavioral analysis identifies automated tools by analyzing request patterns, mouse movements, timing, and device fingerprints. Credential stuffing relies on automation, so this feature can distinguish bots from humans and block or challenge suspicious sessions. It is the most appropriate WAF capability for detecting distributed, low-and-slow login attempts that evade simple rate limits.

Broadcast frames have a destination MAC address of FF:FF:FF:FF:FF:FF and must be delivered to all devices in the broadcast domain. A switch floods such frames out every port in the same VLAN except the ingress port. This ensures all hosts receive the broadcast while avoiding a loop back to the sender, which is essential for protocols like ARP and DHCP.

The `show session all filter source 192.168.1.50` command queries the firewall's active session table and applies a source-IP filter, returning only sessions originating from 192.168.1.50. This directly satisfies the stem's requirement to view active sessions matching that specific source address via the CLI.

Resource configuration history (Config RQL) records every change to IAM policies and security groups, so investigators can pinpoint when the attacker altered permissions during privilege escalation. This satisfies the scenario's need to trace credential compromise and escalation attempts across the cloud estate, providing the audit timeline that detection alone cannot supply.

Reader allows viewing of all resources but does not permit any modifications. It is the least privileged role that provides the necessary read access for Prisma Cloud to assess configurations and compliance. This aligns with the principle of least privilege.

The arp -a command displays the current ARP entries for all interfaces on a Windows system. It shows the IP address and corresponding MAC address, allowing the analyst to spot duplicate IPs with different MACs, which may indicate ARP spoofing. This is a standard command for examining the ARP cache.

Selecting DHCP Client on a Layer 3 interface instructs the firewall to send DHCP requests and accept a lease from a DHCP server on the connected subnet. This provides automatic IP address, gateway, and DNS assignment for that interface. It is the correct choice when the firewall must integrate into an existing network without a manually assigned static address.

The central management console aggregates alerts and events from all managed endpoints. Querying it by the malicious hash lets the analyst see every endpoint that reported an execution attempt and whether the action was blocked or allowed. This provides the fleet-wide visibility needed to assess scope and prioritize response actions.

Isolation severs the endpoint's network connectivity while preserving the agent's management channel, halting lateral movement and command-and-control traffic during an active incident. This containment action is available directly from the Cortex XDR management console's response menu for the affected endpoint.

Layer 3 interfaces are routable ports that carry IP addresses and participate in routing decisions, supporting features such as zones, virtual routers and NAT. This is one of the standard configurable interface types on Palo Alto Networks firewalls, alongside Layer 2, virtual wire, tap and HA.

When an alert is generated, Prisma Cloud provides detailed information including the affected resource, its cloud account, and the configuration history. The resource explorer allows the analyst to view the bucket's attributes, and the alert details often include the user or role that made the change if cloud trail logs are integrated. This is the fastest way to get both the account and the actor.

The Cortex XDR agent installs on the host operating system, continuously collecting endpoint telemetry and enforcing local threat prevention. It provides the on-host data collection and blocking capability the scenario requires, unlike cloud-based or management components.

Port Scan protection in a Zone Protection profile is designed to detect and block port scanning activities. When applied to the untrusted zone, it monitors for reconnaissance patterns such as TCP SYN scans, TCP FIN scans, and UDP scans. This directly addresses the requirement to detect and block port scans on the untrusted zone. It is a key component of zone-level reconnaissance defense.

The Cortex XDR agent captures process execution events, including command lines and parent-child relationships, which feed the behavioural analytics engine. This telemetry is essential for detecting malicious execution chains and supporting threat-hunting queries across endpoints.

A zero window advertises that the receiver's TCP receive buffer is full, so the sender must stop transmitting until a window update arrives. This is TCP flow control, distinct from congestion control or packet loss.

Syslog forwarding and the Cortex XDR streaming API both push alerts and BIOC data outward to an external SIEM, satisfying the real-time centralisation constraint. The streaming API delivers near-continuous event export, while Syslog forwarding relays alerts, so endpoint logs reach the SIEM without polling.

Address Resolution Protocol broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address. This is exactly the IPv4-to-MAC mapping the analyst is looking for on the local segment. ARP operates at Layer 2 and is essential because Ethernet frames require a destination MAC address, not just an IP address, to be delivered.

Threat logs record traffic matching security profiles, such as antivirus, anti-spyware, vulnerability and URL filtering signatures, capturing the actual malicious or suspicious events. This makes them a native PAN-OS log type suited to incident analysis, satisfying the requirement for security monitoring log categories.

In ExStart and Exchange, neighbours swap Database Description packets that include the interface MTU. A router rejects DBD packets whose MTU is larger than its own, so the pair retransmits and never moves on to Loading and Full. Match the MTU on both sides, on PAN-OS in the Layer 3 interface or subinterface settings, rather than ignoring the check, which only hides the problem and can drop large packets later.

Data classification, labelling, and encryption key management remain the customer's duty across IaaS, PaaS, and SaaS, since the provider never owns the data itself. This satisfies the stem's constraint by naming a layer that never transfers to the cloud provider under any service model.

Prisma Cloud's Trusted IP settings live under Administration > Access Control > Trusted IP, where administrators define allowed corporate CIDR ranges that gate console login. Configuring this restricts administrative console access to the specified corporate IP ranges, exactly as the stem requires.

A registration token is a secure key generated in the Cortex XDR console that authorizes the agent to register with the tenant. It is required during installation to authenticate the agent and establish a trusted connection. Without a valid token, the agent installation may complete but the agent will not successfully register or receive policies.

Prisma Cloud Config policies use RQL to query the resource configuration of cloud accounts. An RQL rule can inspect the S3 bucket encryption settings and the KMS key manager, then flag any bucket whose default encryption is not a customer-managed key. This gives continuous, near-real-time detection aligned with the compliance requirement.

DNS Security leverages Palo Alto Networks threat intelligence to detect and block malicious domains. When DNS sinkholing is configured, the firewall responds to DNS queries for malicious domains with a sinkhole IP address, preventing connection to the actual malicious site. The DNS Security profile is applied to Security policy rules that allow DNS traffic, and it is the correct feature to check for DNS sinkholing functionality. It provides real-time protection and logging.

Traffic logs record every session evaluated against Security policy, including the action applied. A drop or deny generates an entry showing source, destination, application, and the denying rule, so the analyst can confirm exactly which policy blocked the inbound attempt and why.

The Internet layer of the TCP/IP model handles logical addressing and routing, using protocols such as IP, ICMP, and ARP to move packets between networks. In this scenario, the analyst needs to identify the layer that assigns logical addresses and determines the best path between distinct networks, which is precisely the Internet layer's role.

App-ID identifies applications regardless of port, protocol, or encryption, so the firewall permits only the approved internal web applications and blocks all other outbound traffic. This directly satisfies the requirement to restrict users to sanctioned applications rather than merely filtering by IP address or port.

Contacting the user is the most direct way to determine if the login was legitimate, such as if the user is traveling or using a VPN. It provides immediate context and avoids unnecessary containment actions. If the user denies the login, the analyst can proceed with incident response, including password reset and session revocation.

ESP in tunnel mode encrypts the entire original IP packet and encapsulates it in a new IP packet, providing confidentiality. Specific proxy IDs define the local and remote subnets that are permitted over the VPN, ensuring only those subnets can communicate. This combination meets both the encryption and the subnet restriction requirements. It is the standard configuration for secure site-to-site VPNs.

Using a CloudFormation stack set from the AWS Organizations management account deploys the required IAM role to all current and future member accounts automatically. This matches Prisma Cloud's recommended onboarding pattern for Organizations, reduces manual role creation, and ensures new accounts are covered without additional intervention.

Multicast DNS sends queries to 224.0.0.251 on UDP port 5353, allowing hosts to resolve .local names without a central server. It is an application-layer protocol that deliberately uses UDP multicast for lightweight, local discovery. This makes mDNS a valid example of an application-layer mechanism relying on UDP, distinct from unicast DNS to a resolver.

Verify explicitly is a core Zero Trust principle: every access request is authenticated and authorised using all available telemetry, including user identity, location and device health. Continuous evaluation of these signals replaces implicit network-location trust, satisfying the stem's Zero Trust data and network requirement.

Objects > Applications > [Application Name] exposes per-application TCP timeout settings, letting the engineer override the global default for only the custom database application. This satisfies the stem's constraint that the default application timeout fails the business requirement, without altering timeouts for unrelated traffic.

802.1X provides port-based authentication, requiring devices to authenticate via EAP before gaining network access. With certificates, the switch acts as an authenticator, forwarding credentials to a RADIUS server. Unauthorized devices are placed in a guest VLAN or denied. This directly meets the requirement to enforce identity-based access and reject non-compliant devices.

Clear severity levels and prioritisation criteria let analysts rank incoming alerts by business impact and urgency, satisfying the triage workflow's need to allocate limited SOC resources to the most consequential incidents first. Without this ranking axis, every alert competes equally for attention, delaying response to genuine threats.

Prisma Cloud CSPM Resource Configuration Scan continuously evaluates cloud resource configurations against benchmarks such as CIS, directly satisfying the requirement to detect public exposure on the new S3 bucket. It inspects configuration state rather than runtime traffic, so an open bucket policy or ACL is flagged as a misconfiguration.

Account-level S3 Block Public Access overrides bucket policies and ACLs that would otherwise grant public access, and it applies to all buckets in the account unless explicitly exempted. Enabling it prevents administrators from accidentally or intentionally making objects public, which matches the requirement.

Alert Integrations, webhooks and SIEM connectors push Prisma Cloud audit alerts, vulnerability findings and compliance violations to third-party platforms such as Splunk in real time, satisfying the streaming requirement. Native log collection alone would not deliver the immediate export the architecture demands.

In IaaS the provider always owns and manages the physical hosts and the hypervisor layer beneath the guest. Customers retain responsibility from the guest operating system upward, so this option marks exactly where provider responsibility ends.

Cortex XDR alerts include an 'Action' field that indicates whether the agent blocked the activity or only reported it. For memory modification attempts, if Behavioral Threat Protection or Exploit Prevention is configured to block, the action will show 'Blocked'. This field is the definitive source to confirm the agent's response. Examining it directly answers the analyst's question.

WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service. When integrated with Cortex XDR, it provides global file reputation and verdicts by analyzing files submitted from multiple sources. This allows the analyst to see if the file is known malicious across other organizations and confirm its threat level.

Monitoring outbound connections to known malicious IPs and unexpected ports is a core Prisma Cloud Compute runtime defence, satisfying the requirement to defend against network-based threats such as command-and-control callbacks and unauthorised egress from containerised workloads.

WildFire analyses suspicious Microsoft Office documents by detonating them in a sandboxed cloud environment, observing macro and script behaviour such as payload downloads or process injection. This satisfies the stem's requirement for file types inspected by WildFire, since static signatures alone cannot reliably detect obfuscated macro-based threats.

The subnet mask 255.255.255.224 is a /27, which means the block size is 32. The subnet containing 172.16.10.33 starts at 172.16.10.32 (the network address) and ends at 172.16.10.63 (the broadcast address). The usable host range is 172.16.10.33 through 172.16.10.62. This is correct.

Anti-Tamper protection blocks unauthorised modification or removal of the Cortex XDR agent by intervening before the Windows installer or service-control calls complete, requiring the designated uninstall password instead. This directly satisfies the stem's constraint of preventing users from tampering with or uninstalling the agent on their workstations.

Cortex XDR agents communicate with the cloud backend exclusively over outbound TCP 443 to specific FQDNs; if firewall rules block this, telemetry and incident data never reach the console. Verifying this egress path directly satisfies the reporting-failure constraint in the stem.

The DNS Sinkhole action within an Anti-Spyware Profile intercepts DNS queries matching known malicious domains and returns a spoofed address, preventing internal hosts from reaching C2 infrastructure. Attaching it to the Security policy rule satisfies the requirement to block DNS-based threats automatically.

Sysmon provides detailed process creation, network connection, and image load events. It can log the full command line of the PowerShell process, including the script arguments, and network connections to the remote server. This is crucial for tracing the script's execution and its attempt to download and execute a file.

An antivirus profile performs deep packet inspection on decrypted traffic, matching streams against signature databases of viruses, trojans and worms. It satisfies the requirement to inspect web content after TLS decryption, which URL filtering and intrusion prevention cannot do at the payload level.

This is correct because in a TCP or UDP header the source IP address identifies the originating host and the source port identifies the originating application socket. Together they pinpoint the internal workstation and the specific process that opened the connection. Examining these fields in the capture directly answers which internal device initiated the traffic.

App-ID includes protocol decoders that can parse control channels and dynamically open pinholes for data connections, such as FTP. This allows the firewall to identify and apply security policies to applications using dynamic ports without manual configuration.

Isolation blocks all network traffic except the Cortex XDR management channel, but configured exceptions whitelist specific forensic or remediation servers so investigators retain access. This preserves containment while permitting authorised forensic communication with the quarantined host.

Exploit Prevention is designed to block attempts to exploit software vulnerabilities, including memory corruption and ROP chain execution. It uses techniques like behavioral analysis and exploit mitigation to protect applications such as browsers and Office. Enabling this module directly addresses the administrator's goal of mitigating exploit techniques.

Microsegmentation enforces security policy at the workload level, often within the hypervisor or host, so east-west traffic between tiers is inspected and controlled without traversing a central appliance. Because policy is attached to the workload rather than a physical port, it follows virtual machines as they move between hypervisors, satisfying both stated goals.

Local Analysis runs machine learning models directly on the endpoint, inspecting file and process behaviour to identify unknown malware without cloud lookup. This satisfies the requirement for a protection feature against modern malware and advanced threats, complementing exploit mitigation and behavioural threat protection.

Causation Analysis reconstructs the full attack chain by tracing process ancestry from the root cause, graphically linking initial access, lateral movement and persistence into one causal timeline. This directly satisfies the need to visualise the entire APT lifecycle rather than isolated alerts.

Many IPS signatures carry confidence and severity metadata. Raising the threshold so only higher-confidence matches block traffic filters out weak or noisy signatures that frequently match benign patterns. This directly reduces the false positives described while still allowing the more reliable signatures to protect the segment, making it a sound tuning action for an inline sensor.

In Kubernetes, Prisma Cloud WAAS is deployed as a Defender module, using proxy or ingress annotations and container injection to inspect traffic inline. This integrates with the ingress controller path, satisfying the containerised microservices constraint without requiring a separate standalone reverse proxy.

Prisma Cloud CSPM continuously audits cloud resource configurations against benchmarks such as CIS and PCI DSS, identifying drift and violations. This satisfies the posture management requirement by evaluating deployed settings rather than scanning workloads for malware or runtime threats.

Traffic logs record session details including source IP, destination IP, destination port, and the action taken (allow or deny). Filtering by port 445 and the internal source zone quickly reveals the offending host and whether the firewall blocked the connection, directly answering the administrator's need.

The zone mismatch counter increments when a packet's ingress security zone differs from the zone associated with the existing session or expected by policy lookup, so the firewall discards it. This matches the stem's Layer 3 interface drop condition.

The action center and agent logs record which module blocked the process, the rule or signature involved, and the timestamp, giving the technician the exact cause before any change is made. This evidence-driven first step avoids guessing and lets the administrator apply a targeted exclusion or policy adjustment based on the actual detection record.

Encrypting records at rest with separately managed keys means an attacker who compromises the web server gains ciphertext, not readable payment data. This directly reduces impact by protecting the confidentiality of the data even when the host is breached. Separate key management prevents the attacker from simply reading the key from the same server, which is the essence of this control.

Causality Analysis links events across processes, files, and network activity into a coherent story, so the alert details show the process tree and the sequence leading to the blocked exploit. This gives the administrator the behavioral context needed to understand the memory manipulation technique without recreating the attack.

Cortex XDR's Investigation view under Incident Response provides a searchable timeline of endpoint events including process creation, command line arguments, and parent-child process relationships. Filtering by hostname and time narrows the view to the alert window, letting a Tier-1 analyst quickly retrieve the process name, full command line, and parent process needed for triage and escalation.

The content inspection engine scans email bodies and attachments to detect patterns matching credit card numbers, such as regular expressions or checksum validation. It is the component that actually identifies the sensitive data and feeds that classification to the policy engine. This makes it the correct answer for recognizing the data in question.

Zero-day malware and ransomware delivered via web downloads or email attachments are prevalent vectors that NGFW security subscriptions, such as advanced threat protection and sandboxing, inspect and block. This satisfies the specialised-subscription mitigation the question requires.

The three-way handshake consists of SYN from the client, SYN+ACK from the server, and ACK from the client. Seeing exactly these three segments in order confirms the connection reached the ESTABLISHED state on both sides. After this, application data such as HTTP requests can flow. The analyst can treat the session as successfully opened, assuming no RST or missing ACK appears later.

Path MTU Discovery (PMTUD) is a mechanism that determines the maximum transmission unit (MTU) along a network path to avoid fragmentation. It works by sending packets with the Don't Fragment (DF) flag set; if a packet is too large for a link, an ICMP 'Fragmentation Needed' message is returned, and the sender reduces the packet size. This process is essential for efficient data transfer and is defined in RFC 1191 for IPv4 and RFC 8201 for IPv6.

Under the shared responsibility model, the cloud provider secures the infrastructure, but classifying data and protecting it within storage buckets remains the customer's duty across IaaS, PaaS and SaaS. This obligation never transfers to AWS or Azure, making it the constant customer responsibility.