Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) (Cybersecurity-Apprentice) — Questions 76–150

Sandbox analysis safely executes the file in an isolated environment and captures process activity, network connections, and dropped files. This reveals malicious behavior without risking production systems. It is a standard triage step when static reputation is inconclusive and helps determine the appropriate escalation path.

The Endpoint Management upgrade feature pushes the new agent version to selected endpoint groups from the console, giving centralised, staged rollout. This satisfies the requirement to upgrade agents across all enterprise endpoints without manual installation.

Palo Alto Networks PAN-OS assigns a default administrative distance of 30 to OSPF internal routes. This value determines route preference when multiple routing sources provide a path to the same destination. Recognizing this default is essential when troubleshooting why a particular route is or is not installed in the virtual router's forwarding table.

Running twistcli during the build stage scans the image before it reaches the registry, failing the pipeline when high-severity CVEs are detected. This shifts detection left, satisfying the requirement to prevent vulnerable images being built and pushed rather than discovering them post-deployment.

WildFire performs dynamic sandbox analysis of unknown files and samples forwarded by endpoints, executing them in an isolated environment to observe malicious behaviour. This satisfies the stem's requirement for determining whether previously unseen files are malicious, delivering verdicts that Cortex XDR uses to block threats without relying on signature-based detection alone.

The primary purpose of a chain of custody is to document the chronological history of evidence handling to ensure its integrity and admissibility in legal proceedings. It shows who had control, when, and for what purpose. Without it, evidence can be challenged as tampered or contaminated.

Creating an exception rule allows the analyst to whitelist the legitimate tool based on its hash or path, preventing Behavioral Threat Protection from blocking it while keeping the module enabled for other threats. This is the recommended approach to handle false positives without compromising overall security.

Prisma Cloud's auto-remediation triggers a Cloud Function or webhook the moment a policy violation is detected, removing public access from the S3 bucket without human intervention. This satisfies the auditor's requirement for automatic remediation upon discovery, rather than merely alerting on misconfiguration.

The Cortex XDR Query Builder allows analysts to create custom queries, such as searching for network connections to a specific domain. By running this query across all endpoints, the analyst can identify other hosts that communicated with the malicious domain, thus determining the scope of the infection. This is a precise and efficient method.

Exploit Protection is designed to detect and block attempts to exploit software vulnerabilities, such as buffer overflows or use-after-free conditions. Enabling this module on Linux servers helps prevent attacks that target known vulnerabilities in services like Apache or SSH. It monitors process behavior for exploitation techniques.

A static configuration assigns the address directly on the host, so the device keeps the same IPv4 address regardless of whether a DHCP server exists. This guarantees the predictable reachability the lab requires and removes dependency on lease renewal. It is exactly the right approach when a host must always be found at a known address and DHCP availability cannot be assumed.

SAML is natively supported by PAN-OS for GlobalProtect, letting the firewall act as a service provider and delegate credential verification to an external identity provider. This satisfies the requirement for a natively supported authentication method for verifying GlobalProtect user credentials.

EtherType 0x0806 identifies the Address Resolution Protocol, and the destination MAC FF:FF:FF:FF:FF:FF is the layer 2 broadcast address. ARP requests are broadcast so every host on the local segment can inspect the request and determine whether it owns the IPv4 address being queried. These two header values together uniquely identify this frame as an ARP request.

A mismatch between the display name and the actual reply-to domain is a strong phishing indicator. Attackers spoof or imitate a trusted colleague so the message looks internal, but replies go to an external address they control. This discrepancy is visible in the message headers and should prompt verification through a separate trusted channel before acting on any request.

Exploit Prevention in Cortex XDR is designed to block exploitation techniques such as buffer overflows, command injection, and memory corruption that target vulnerable services. It monitors processes like Apache and SSH for signs of exploitation and can prevent the attack from succeeding. Enabling and configuring Exploit Prevention on Linux servers provides the required protection against service exploitation.

Administrative distance ranks route trustworthiness; the lower value wins. Assigning the backup a higher metric than 10, such as 20, keeps it out of the routing table while the primary remains reachable, so it installs only after the primary fails.

An Authentication profile defines how the firewall validates user credentials. For GlobalProtect, you must configure an Authentication profile that points to an LDAP server (or other authentication service) to authenticate users. This ensures that only users with valid credentials can establish a VPN connection. Without it, GlobalProtect cannot verify user identity, and access control would be ineffective.

Endpoint Groups let administrators categorise endpoints by criteria such as department or operating system, then attach distinct policy settings to each group. This grouping mechanism directly satisfies the requirement for granular, department-specific endpoint configuration rather than one uniform policy across the organisation.

Agent Settings in the Cortex XDR management console defines which protection modules — Malware, Exploit, Behavioral Threat Protection — are enabled per endpoint policy. Checking there satisfies the requirement to verify prevention modules for a specific set of workstations, since policies apply to assigned endpoint groups.

Prisma Cloud config compliance policies allow the engineer to define a custom RQL (Resource Query Language) query that checks IAM user attributes, such as console access enabled and MFA not enabled. When the policy is evaluated, any IAM user matching the query triggers an alert. This is the intended mechanism for detecting misconfigurations like missing MFA on console-enabled users.

Reviewing authentication logs helps validate the alert by confirming the failed attempts and the successful login, including source IP and time. This is a crucial step to determine if the login is legitimate or malicious. It provides evidence before taking any disruptive action.

Least privilege means giving users the minimum access necessary to do their work. By granting only job-required permissions, the organization reduces the attack surface and limits potential damage from compromised accounts. This practice directly implements the principle and is a fundamental step in access control.

The stats stage aggregates events, and count() by actor_process_image_path tallies process executions per image path, exposing rare or anomalous binaries. This satisfies the need to surface unusual execution chains during threat hunting in Cortex XDR XQL.

Local Analysis is the Cortex XDR agent component that performs on-endpoint inspection of files using signatures, heuristics, and machine learning models. It operates independently of cloud connectivity, providing immediate protection against known and unknown malware. This matches the requirement to block malicious files without relying on the cloud.

The Block List allows administrators to specify file hashes (for example SHA-256) that the Cortex XDR agent will block from executing on endpoints. Once the policy is applied, the agent enforces the block regardless of file name or path, and no full scan is required. This directly meets the requirement for rapid, hash-based prevention across all Windows endpoints.

The Compute Defender runs on cluster nodes and can scan images that are present on the node, including containers that are already running. This provides visibility into vulnerabilities in the deployed workloads without waiting for a registry rescan or requiring the images to be rebuilt.

Behavioral Threat Protection watches process behavior in real time and correlates chains such as an Office application spawning a child process, writing to the Startup folder, and beaconing outbound. That exact behavioral sequence, independent of any file hash reputation, is what triggers this detection, which is why an unknown unsigned binary still raises an alert.

MFA blocks unauthorised access even when an administrator's password is stolen or guessed, because a second factor such as an authenticator app or hardware token is also required. This directly satisfies the stem's focus on administrative access to security infrastructure, where compromised credentials pose the greatest risk.

Session Synchronization replicates the active peer's session table to the passive firewall, so established connections survive failover. This satisfies the seamless-continuity requirement, since the newly active peer already holds the state needed to forward existing traffic without dropping sessions.

A recent heartbeat timestamp confirms the agent is actively communicating with the Cortex XDR cloud tenant, satisfying the stem's requirement for verified ongoing connectivity. The Connected status alone indicates registration, but the heartbeat proves live check-ins, which is precisely the evidence the administrator needs.

Creating a hash-based exception in the Cortex XDR behavioural threat protection profile allows that exact script to run while all other behavioural rules stay enforced. The file hash pins the exception to one immutable artefact, satisfying the requirement to permit this specific script without disabling behavioural monitoring endpoint-wide.

The EDR platform can provide detailed process information, command lines, and network connections on the internal host, helping identify the application responsible for the transfer and whether it is legitimate. This context is crucial to determine if the transfer is malicious, such as data exfiltration by malware, or benign, like a cloud backup.

A Vulnerability Protection Profile exception targets one Signature ID, so that specific signature stops blocking the custom application while every other signature in the profile remains active. This satisfies the constraint of preventing false positives without disabling the entire vulnerability profile.

File cryptographic hashes (SHA256, MD5) are ingested as file-based indicators and correlated against endpoint telemetry, matching the stem's requirement for endpoint coverage. Cortex XSIAM matches these hashes against observed file activity, enabling detection of known malicious files without relying on network-level artefacts.

QoS mechanisms classify and prioritize traffic, ensuring that latency-sensitive voice packets are forwarded ahead of less critical data. By configuring QoS on switches, administrators can assign voice traffic to a high-priority queue, reducing jitter and delay. This is the standard method for prioritizing VoIP traffic on a LAN.

AWS CloudTrail logs all API activity in an AWS account, including the identity of the caller, the time, source IP, and request parameters. Querying CloudTrail events for the ModifySecurityGroupIngress API call will reveal which IAM principal made the change, directly answering the analyst's need.

The Cortex XDR agent includes a watchdog service that monitors the main agent process and restarts it if it is terminated. This ensures the agent remains running even if an attacker attempts to kill it. It is a key self-protection feature. This option is correct.

Authentication verifies that a claimed identity is genuine. The impossible travel alert directly questions whether the user's credentials were used by the legitimate user or an attacker. Investigating authentication logs, MFA prompts, and session tokens is the correct first step to determine if the identity assertion is trustworthy before assuming a breach of other principles.

Setting the operation mode to prevent enforces blocking behaviour rather than passive detection, satisfying the requirement for full prevention without user intervention. Detect mode only logs alerts, while disable stops enforcement entirely, so prevention must be explicitly selected in the installation profile for the Cortex XDR agent.

Prisma Cloud Application Security scans IaC templates during the build phase, catching misconfigurations such as open security groups before deployment. Its native integrations with GitHub and Terraform Cloud embed these checks directly into the developer workflow, satisfying the requirement to prevent flawed templates from ever reaching production environments.

Exception rules filter alerts by matching specific attributes such as process name, IP address or user, so the scanner's distinctive parameters can be excluded while genuine port-scan detections remain active. This directly suppresses the recurring false positive without disabling the underlying analytics.

Runtime defense in Prisma Cloud Compute monitors container behavior in real time. Process protection rules can detect and alert on suspicious process activities, including attempts to access the host's process namespace, which is a common container escape technique. This directly addresses the requirement to detect such access attempts.

The immediate priority is to confirm that the malware was indeed quarantined and that no other malicious activity occurred. Tier-1 analysts should review endpoint telemetry for related processes, network connections, or persistence mechanisms. This ensures the threat is fully contained and helps determine if escalation is needed.

This is correct because only an actual restore into a functioning environment proves the backups are complete, readable, and sufficient to run the application. It surfaces issues such as missing dependencies, corrupted media, or gaps between backup sets that logs cannot reveal. This is the definitive test of recovery capability and is what auditors expect for critical systems.

Destination NAT only translates the address; it does not permit traffic. The firewall still evaluates a security policy based on the post-NAT destination zone and address. If no rule allows untrust-to-trust traffic on TCP 443 to the server, the packet is dropped. This is the classic missing step after configuring DNAT.

This approach uses a specific allow rule for the required traffic, then a broader deny rule for all other DMZ-to-internal traffic, and finally a default deny. The order ensures the specific allow is evaluated first, and any other DMZ-initiated traffic to the internal network is explicitly blocked. This enforces least privilege and prevents the web server from initiating unauthorized connections.

App-ID classifies traffic by inspecting application signatures and behaviour, identifying the application even when it is encrypted, obfuscated or running on non-standard ports. This satisfies the requirement to determine the exact application within the HTTPS stream.

An IAM role attached through an instance profile lets the EC2 instance obtain temporary, automatically rotated credentials from the instance metadata service. The application inherits only the permissions granted to the role, and no long-term secrets are stored on disk, which matches the engineer's requirement precisely.

Decryption policy rules dictate which sessions trigger decryption.

The Traffic log records bytes sent and received per session, along with application identification and session end reason. A large outbound byte count relative to normal beaconing is a strong indicator of exfiltration. Correlating this with the C2 domain and timing provides evidence of data transfer volume, which is the best available indicator when payload inspection is unavailable.

Exploit Protection in the Cortex XDR agent inspects memory and system calls for techniques used by exploit kits, such as heap spraying, ROP chains, and shellcode execution. Enabling it on a Windows workstation ensures these known exploitation methods are blocked before they can compromise the process. This directly addresses the analyst's goal of confirming exploit prevention is active.

The impacted endpoints and user accounts list identifies the affected scope of an incident, satisfying the stem's requirement for available Incident View investigation features. It lets analysts pivot directly from the incident to the hosts and identities requiring containment or remediation.

User Datagram Protocol operates at the transport layer and provides connectionless, best-effort delivery with minimal overhead. It uses port numbers for multiplexing but omits handshakes, acknowledgments, and retransmissions. Protocols such as DNS, DHCP, and voice traffic often rely on UDP, making it a correct transport-layer entry for the administrator's documentation.

Resetting the user password through the Active Directory integration command removes the compromised credential's validity, satisfying the stem's compromised-credential playbook requirement. It is a standard containment step executed automatically once the playbook confirms the account is compromised.

Cyvera.txt records the Cortex XDR agent's service activity, including connectivity and communication attempts with the management server. Reviewing it reveals whether telemetry uploads are failing due to network, certificate or registration problems, directly addressing the reported reporting failure.

Parsing Rules in Cortex XSIAM transform non-standard raw logs by mapping their fields to the XDM schema. This lets the analyst normalise custom application logs that lack RFC structure so they align with the Common Schema.

Office applications spawning PowerShell is a strong indicator of a malicious macro or exploit, because legitimate Office workflows rarely invoke PowerShell directly. This parent-child process relationship is a common technique in phishing campaigns and should be prioritized as a high-fidelity detection. It helps distinguish malicious script execution from administrative automation.

Zero Trust requires every packet to be treated as untrusted regardless of zone, so the firewall must decrypt, inspect and log traffic between all zones while enforcing least-privilege rules. This satisfies the stem's demand for a foundational principle applied to all traffic traversing the firewall.

In the TCP/IP model, the Transport layer directly corresponds to the OSI Transport layer. It provides end-to-end communication, segmentation, and optionally reliable delivery via TCP or lightweight datagram service via UDP. This layer uses port numbers to identify application endpoints, making it the correct mapping for the OSI Transport layer in documentation and troubleshooting discussions.

VLAN tags must be explicitly permitted on the Virtual Wire object; by default a VWire drops tagged frames. Enabling VLAN tagging and binding subinterfaces lets the firewall match and forward tagged traffic, resolving the intermittent failures caused by stripped or unmatched tags.

An Interface Management Profile defines which management services, including ICMP, the interface answers. Assigning the profile to the Layer 3 interface enables ping replies for diagnostics; the setting is not enabled by default on dataplane interfaces.

Prisma Cloud Admission Controller Webhook intercepts Kubernetes API requests before persistence, evaluating privileged pod specifications against deployed runtime security policies. It satisfies the requirement to block non-compliant workloads at admission time, denying the developer's privileged pod before scheduling occurs, rather than detecting it later during runtime monitoring.

Inline machine learning inspects traffic directly within the threat prevention profile, blocking previously unseen zero-day exploits before a signature exists. This satisfies the stem's zero-day and multi-stage attack constraint, since static signatures alone cannot catch novel payloads. It complements, rather than replaces, the other selected advanced protections.

RRL works by limiting the number of identical responses that a DNS server will send to a single destination IP address within a given time period. In a DNS amplification attack, the attacker spoofs the victim's IP and sends many queries for the same record, causing the server to send large responses to the victim. RRL caps these responses, mitigating the attack while allowing legitimate queries.

Firewall session logs record allowed and denied connections, including source and destination IP addresses, ports, and bytes transferred. Examining these logs can confirm whether the workstation's connection attempts to the malicious IP were permitted and how much data was exchanged. This directly answers the analyst's question about success and data transfer.

Prisma Cloud CDR ingests AWS CloudTrail audit logs and applies behavioural analytics to spot anomalous API activity, satisfying the stem's requirement to detect potential credential compromise from cloud provider logs. Identity Security correlates that activity with risky identities, so the alert originates from CDR rather than posture or workload scanning.

Disabling macros by default with a trusted publisher requirement prevents unsigned or malicious macros from running while allowing properly signed business macros. This directly addresses the execution vector without blocking entire file types, balancing security and business need. It is a standard hardening measure in office productivity suites and aligns with least privilege for code execution.

Onboarding at the GCP organization level lets Prisma Cloud inherit access to all projects under that organization, including projects created later. Granting the service account organization-level roles provides the read permissions needed for discovery and posture evaluation without per-project configuration.

Repeated failed logins from one external IP using common account names such as admin, root, and test is characteristic of automated password guessing or brute force against default accounts. The attacker is trying well-known usernames rather than stolen credential pairs. Because no login succeeded, the activity is still an attempt, and blocking or rate-limiting the source and disabling default accounts are appropriate responses.

A SIEM aggregates logs from disparate sources, correlates events across them, and surfaces incidents for analyst monitoring. This centralisation satisfies the enterprise-wide visibility requirement, unlike point tools that only cover single systems or lack correlation.

Containment is the phase where the analyst takes immediate action to stop the spread of an incident and prevent further damage. Isolating the workstation from the network is a classic containment step. The analyst has already identified the malicious communication and is now limiting its impact, which aligns with containment. This step precedes eradication and recovery, and is critical to prevent lateral movement or data exfiltration.

An External Dynamic List lets the firewall poll a third-party feed by URL and reference it directly in policy, so newly published malicious IPs are blocked automatically. This satisfies the stem's requirement for dynamic ingestion rather than manual updates.

WildFire already blocked the file, so containment is complete; the analyst confirms the block succeeded and then scopes for other endpoints that may have downloaded the same hash. This satisfies the stem's high-confidence prevention alert by verifying protection and hunting for related exposure.

The ACC delivers a visual, interactive summary of traffic, applications and threats over time, satisfying the analyst's need for real-time review. It aggregates logs into widgets and graphs, enabling rapid identification of anomalies and threat patterns without querying raw logs directly.

A master CloudTrail in the management account aggregates organisation-wide events into one trail, satisfying the centralised ingestion constraint. Cross-account IAM roles then let Prisma Cloud read that consolidated log stream without deploying separate trails per member account, giving unified posture visibility.