Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) (Cybersecurity-Apprentice) — Questions 226–300

The Host Firewall policy allows administrators to create rules that permit or deny network traffic based on IP addresses, ports, and protocols. It can restrict endpoints to communicate only with specific internal servers and block all other traffic, including internet access. This directly enforces the network restriction requirement without needing external network devices.

Cortex XSIAM's Process Tree provides a visual representation of process creation, showing parent-child relationships and the full command line for each process. The analyst can quickly see the PowerShell process, its command line, and the parent process that spawned it. This is the most direct way to get the required details.

Message-trace and search functions in an email security console allow analysts to query by sender, subject, or embedded URL and list every mailbox that received the message. That directly answers whether the campaign reached other users and enables containment such as purging the message. It is the most efficient and accurate way to scope a phishing campaign across the organization.

Detection and Analysis is the phase where the analyst validates alerts, determines if an event is a true incident, and assesses its scope and impact. In this scenario, the analyst would examine the SIEM alert, correlate logs, and decide if the brute-force attempt succeeded or was blocked, which is exactly the activity described in the question.

Records linking names, birth dates, insurance identifiers, and treatment notes to identifiable people are regulated personally identifiable and protected health information. Such data must be restricted to authorized clinical and billing staff under least privilege. Confidential is the correct label because unauthorized disclosure would cause significant harm to individuals and legal liability for the hospital, requiring encryption, access controls, and audit logging.

Parameterized queries separate the SQL statement structure from the data values, so user input is always treated as a literal value and never as executable syntax. This removes the root cause of SQL injection regardless of how the payload is encoded. Binding parameters also prevents the crafted input from altering query logic or returning schema-revealing errors, making it the correct structural fix for this scenario.

DNS tunneling encodes data within DNS queries and responses, often using long, random-looking subdomains to carry chunks of stolen information. The high volume and frequent changes in subdomains indicate a covert channel exfiltrating data. This matches the scenario where the workstation sends many queries with encoded payloads to an external IP, a classic sign of DNS-based data exfiltration.

Configuring security groups and network ACLs is a customer responsibility because these are virtual firewall rules that control traffic to and from customer resources. The cloud provider secures the underlying network infrastructure, but the customer must define and manage these access controls.

FCS errors indicate corrupted frames arriving at the interface, which speed and duplex mismatches do not cause when both ends match. Damaged cabling, faulty SFP transceivers, or electromagnetic interference corrupt the signal at the physical layer, producing exactly these errors.

The standard Cortex XDR agent ships an installer for Apple macOS, alongside Windows, making it an officially supported deployment platform. Linux endpoints are handled by a separate agent variant, so macOS qualifies for this selection.

The `show counter global filter packet-drop yes` command streams global counters filtered to packet-drop events, revealing real-time discards including those caused by security rule denials. This directly satisfies the requirement to monitor drops live, unlike static log queries or session lookups that show only historical or per-flow state.

BIOC analytics correlate sequences of system events and behaviours to flag suspicious activity, satisfying the requirement to distinguish them from signature-based detections. Standard malware alerts match known file signatures, so they miss novel or fileless activity that behavioural analytics surfaces.

A RST flag indicates an abrupt termination of a TCP connection or rejection of an unexpected segment. In this scenario, after a successful three-way handshake on port 443, the workstation sending RST means it is tearing down the connection immediately or refusing further communication. This can result from an application closing unexpectedly or a segment arriving for a closed socket.

Forwarding occurs only when the file hash is absent from the global cloud cache and the file matches the configured file type forwarding rules, so known-benign files are skipped. This satisfies the condition governing submission to the WildFire cloud.

The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a reliable, connection-oriented session by synchronizing sequence numbers and confirming that both hosts are ready to communicate. It ensures bidirectional connectivity and sets up parameters for ordered, error-checked data delivery. This is the fundamental purpose of the handshake and is essential for any TCP-based application, from web browsing to email.

SSL Forward Proxy decryption requires the firewall to present a certificate signed by its Forward Trust CA to clients. Installing that CA as trusted on endpoints prevents browser certificate warnings while allowing the firewall to inspect outbound HTTPS sessions transparently.

The CSPM Compliance Dashboard continuously assesses cloud resources against built-in benchmarks and frameworks, including HIPAA and PCI-DSS, across AWS and Azure accounts. It surfaces encryption-related posture findings without custom policy authoring, satisfying the out-of-the-box reporting requirement.

Prisma Cloud includes built-in compliance standards such as HIPAA, PCI DSS, and NIST. By selecting the HIPAA standard, the analyst can continuously assess S3 bucket configurations against specific requirements like encryption and access logging. The compliance dashboard shows pass/fail status and detailed findings, enabling remediation. This directly addresses the need to verify ongoing compliance posture for protected health information stored in AWS.

Path MTU Discovery (PMTUD) is designed to determine the maximum transmission unit (MTU) along the entire path between two hosts, ensuring that packets are not fragmented. It uses ICMP 'fragmentation needed' messages to adjust the packet size. In this scenario, the large server response suggests a PMTUD issue, so examining PMTUD behavior directly addresses the problem of whether the path supports the larger frame size.

Intune and SCCM push the agent installer through their existing device-management channels, so no manual per-endpoint installation is needed. This satisfies the enterprise-wide deployment requirement by leveraging agent-based distribution to Windows endpoints already enrolled in those platforms.

WPA3 is the latest wireless security protocol that provides strong encryption and protection against unauthorized access. Enabling WPA3 on the wireless access point ensures that only authorized users with the correct password can connect, and it protects data in transit. Without encryption, wireless traffic can be intercepted or accessed by outsiders. This is a fundamental step to secure a wireless network from external threats.

Anti-Spyware is an out-of-the-box Palo Alto Networks Security Profile type that inspects data plane traffic for spyware, command-and-control callbacks and known malicious patterns. It satisfies the stem's requirement by covering a specific threat vector within the Security Profiles framework.

Behavioural Threat Protection monitors process behaviour, including remote thread creation and memory writes into other processes, which are the hallmarks of process injection. It blocks these sequences at runtime regardless of the malware's changing file signature.

Regular vulnerability assessments and penetration testing actively uncover exploitable weaknesses before attackers do, directly satisfying the proactive identification requirement. Unlike reactive monitoring, this scheduled testing exposes misconfigurations and unpatched flaws, feeding findings into risk assessment so remediation prioritises genuine exposure rather than theoretical threats.

The MAC prefix 01:00:5E maps to IPv4 multicast, and the low 23 bits of 224.0.0.251 map to 00:00:FB, matching the frame. Address 224.0.0.251 is the mDNS group used for local name resolution and service discovery. The workstation is querying for the internal web server by multicast name resolution rather than by unicast DNS, which explains why a unicast web connection attempt may fail if mDNS is filtered.

Zone Protection profiles include SYN flood protection that can limit the rate of SYN packets and activate random early drop or SYN cookies. Applying it to the internal zone where the attacking host resides will mitigate the flood by throttling or dropping excessive SYN packets before they consume resources. This directly addresses the observed behavior of incomplete TCP handshakes.

PAN-OS hashes source and destination IP addresses, ports, and protocol to pick one of the equal-cost paths, then pins that flow to it. This per-session pinning preserves packet ordering and prevents mid-session path switching, satisfying the requirement that selection stays consistent for a given session.

Cortex XSIAM's Log Search allows analysts to query and view raw log events from various sources. By searching for the relevant user account and time frame, the analyst can see the exact log entries that triggered the brute-force alert. This provides the granular detail needed for verification and further investigation.

Without NAT loopback, the firewall translates outbound internal traffic to the public IP but cannot redirect it back inside, so internal clients fail to reach the server via its public NAT address. Enabling hairpin NAT lets the firewall reflect that traffic to the internal host.

In Cortex XDR, policy updates are driven by the endpoint's group membership and the policies applied to that group. If the endpoint is in a group with outdated or no policies, it may not receive updates. Verifying group assignment and policy rules is the logical first step to ensure the agent is targeted with the correct prevention profiles. This is non-disruptive and directly addresses the issue.

A host-based firewall enforces policy at the server itself, allowing only the ports needed for HTTPS web traffic and management while dropping everything else. A default deny stance ensures unlisted inbound connection attempts are silently discarded, which directly reduces the attack surface as required for this internet-facing web server.

Port security enforces a maximum number of source MAC addresses per interface. Setting the maximum to one and violation mode to shutdown causes the switch to err-disable the port as soon as a second MAC is learned, which directly matches the requirement to lock each residence hall wall jack to a single device and stop rogue routers from bridging multiple hosts.

AWS KMS customer managed keys give the organization full control over key policies, rotation, and grants, and S3 server-side encryption with SSE-KMS uses those keys for data at rest. This satisfies both encryption at rest and organizational key control, which is exactly what the auditor requested for the patient records bucket.

Initial triage and alert categorisation is core Tier-1 work: analysts review incoming detections, classify severity, filter false positives and escalate genuine incidents. This satisfies the stem's requirement for a responsibility typically assigned to first-line SOC monitoring staff rather than Tier-2 or Tier-3 investigators.

A remote-access VPN concentrator accepts encrypted tunnels from individual clients such as employee laptops and places their traffic onto the internal network. This matches the requirement to give remote employees access to an internal file server without exposing that server directly to the internet, while keeping the tunnel endpoint at the network edge.

Runtime defense rules can allow or block process execution based on the process name or path. By blocking a shell binary like /bin/sh, the rule prevents interactive shell access while the container's intended application continues to run, which matches the requirement to stop post-start shell execution.

Full-disk encryption (FDE) encrypts the entire storage drive, making data unreadable without the decryption key. If a laptop is lost or stolen, the data remains protected because the attacker cannot access it without the correct credentials or recovery key. This directly addresses the requirement to keep sensitive data confidential in the event of physical loss.

Threat intelligence platforms and malware analysis services maintain reputation and behavioral data keyed by file hash. Querying the hash returns whether it is associated with known malware families, prior campaigns, and observed behaviors, giving the analyst the context needed to judge severity and escalate with supporting evidence. This is the most direct enrichment step for a hash observed across multiple hosts.

A profile exception using the exact file hash or behavioural signature suppresses only that known-good tool, preserving detection for genuinely malicious scripts. This satisfies the false-positive scenario by preventing repeat alerts without broadly weakening the prevention profile.

TLS handshake failures with the service running indicate interception: a proxy or firewall performing TLS decryption presents its own certificate, which the agent rejects because the Cortex XDR root certificate is absent from its trust store. Installing that root certificate restores the handshake and reporting.

App-ID classifies traffic by application regardless of port, and Threat Prevention inspects all allowed sessions. Logging every port and protocol enforces the Zero Trust requirement to verify and inspect all traffic rather than trusting implicit port-based permissions.

The Incidents tab aggregates correlated alerts into cases, each mapped to MITRE ATT&CK techniques, letting the analyst see active threats and C2 communications. It provides the categorised, framework-mapped view the stem requires, unlike raw endpoint or log views.

Phishing is a social engineering attack that uses fraudulent emails or messages to trick recipients into revealing sensitive information such as credentials. In this scenario, the attacker impersonates the IT department and creates urgency to pressure the employee into clicking a malicious link and entering credentials on a fake login page, which is the classic pattern of a phishing attack.

The arp -a command displays the current ARP cache, which maps IP addresses to MAC addresses for hosts on the local subnet. If two different MAC addresses appear for the same IP, or if the MAC does not match the expected host, a duplicate IP or ARP spoofing may be present. This command is the correct tool for inspecting IP-to-MAC bindings on a Windows host.

Security groups are stateful virtual firewalls attached to the instance's network interface. Allowing only ports 80 and 443 from the internet and denying all other inbound ports reduces the network attack surface, which is exactly what the scenario asks for. This is a standard, effective hardening step for a public web server.

A sandbox is an isolated environment designed to safely execute and analyze malware. It provides automated reports on the malware's behavior, including network activity, file system changes, and registry modifications. This allows the analyst to understand the malware's capabilities without risking production systems. Submitting to a sandbox is a standard and safe first step in malware analysis.

Pinging the default gateway is the fastest way to test Layer 3 reachability to the first hop. If the gateway replies, local IP configuration, ARP, and the access link are working, so the fault likely lies beyond the gateway. If it fails, the technician can focus on the workstation's subnet mask, VLAN, switch port, or the gateway interface itself before investigating routing on remote devices.

A routed Layer 3 interface needs an IP address to participate in the network, providing the logical identifier for forwarding and next-hop reachability. Without it, the interface cannot route traffic between subnets, so the address is mandatory alongside the zone assignment.

Cortex XDR isolation blocks all network traffic except the management server by default; IP-based exceptions in the isolation profile permit the designated forensic server's IP to reach the endpoint. This satisfies the stem's need to allow one specific management server while preserving isolation.

Creating a targeted exception for the Java application's executable allows its legitimate JIT-generated code to run while keeping Exploit Protection active for all other processes. This balances security and functionality by scoping the exclusion to the known application. It is the recommended approach when a legitimate application triggers exploit prevention due to dynamic code generation.

Config compliance policies allow the team to write custom RQL queries that target IAM resources in each cloud, such as AWS IAM policies, Azure role assignments, and GCP IAM bindings. These policies can detect specific misconfigurations like roles with wildcard permissions or credentials not rotated. This capability is essential for enforcing IAM best practices across multi-cloud environments, so it is a correct choice.

The Causality Chain reconstructs the parent-child relationships between processes, network connections and file writes, presenting them chronologically. This satisfies the requirement for a granular timeline linking each artefact to the original malware execution, which raw alert lists cannot provide.

Windows Security Event Logs capture Event ID 4769 each time a Kerberos service ticket is requested, recording account name, service name, client address and encryption type. This directly satisfies the stem's requirement to detect abnormal Kerberos service ticket requests, since Pass-the-Ticket activity surfaces as anomalous 4769 patterns that Cortex XSIAM ingests for correlation.

The Config assessment feature in Prisma Cloud is responsible for scanning cloud resource configurations against security policies. Enabling it ensures that storage buckets are evaluated for public access. Without this feature active, Prisma Cloud will not perform the necessary checks even if permissions are granted.

Although both hosts share a physical switch, 172.16.5.20/24 and 172.16.6.10/24 belong to different subnets. A host sends directly only to destinations within its own subnet; for anything else it forwards to its default gateway. If no Layer 3 device routes between the subnets, the workstation cannot reach the server, and ARP for the server will go unanswered on the local segment.

BGP peers remain in Idle when the local router cannot establish a TCP session or rejects the neighbour, typically because the configured peer IP address or remote AS number is wrong. Correcting these parameters lets the peer advance through Connect and OpenSent.

Phishing is a social-engineering attack that uses a fraudulent message, such as email, to trick a user into revealing credentials or clicking a malicious link. The misspelled URL impersonating the company's single sign-on portal is the classic credential-harvesting pattern, so classifying the event as phishing is correct and directs the analyst to the right response playbook.

Policy tags allow administrators to categorize policies by function, compliance framework, or business unit. Using those tags in alert rules means that a business unit only receives findings for the policies that apply to it, which reduces noise and ensures that each team sees the alerts it is responsible for.

Private IP addresses, defined in RFC 1918, include the 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 ranges. The 192.168.1.0/24 network the administrator documents falls within the 192.168.0.0/16 private range, and these addresses are not routable on the public Internet, requiring NAT for external communication. This matches the scenario exactly.

The alert's resource configuration details show exactly what setting is noncompliant, such as a public ACL or missing block public access, and the linked compliance standard violations map the issue to frameworks like CIS or PCI DSS. Together they give the analyst immediate context on impact and priority without leaving Prisma Cloud.

In the AWS shared responsibility model, the customer is responsible for security 'in' the cloud, which includes the guest operating system, installed applications, and data on EC2. Patching the guest OS is therefore the customer's duty. AWS secures the underlying infrastructure, but not the operating system the customer controls, so the security lead must own this patching task.

A structured risk assessment paired with control review and management sign-off creates the auditable record auditors seek. It identifies threats and vulnerabilities, maps them to implemented controls, records residual risk decisions, and captures dated approvals from accountable managers. That combination demonstrates the controls were evaluated and formally accepted, which is exactly the evidence of ongoing governance and effectiveness the compliance manager must present.

OSPF neighbours exchange Hello packets to discover each other and detect failures; mismatched Hello or Dead intervals prevent the neighbour state machine from progressing past Init, so no adjacency forms. Matching these timers is a mandatory prerequisite for adjacency on the Palo Alto Networks virtual router.

Behavioral Threat Protection exceptions allow administrators to specify processes that should be excluded from behavioral analysis. By adding an exception for the custom application's process name and hash, the agent will not flag its system calls as malicious. This is the appropriate way to prevent false positives while keeping other protections active.

Prisma Cloud onboards Azure subscriptions by using a service principal that is assigned a read-only role, such as Reader, at the subscription scope. The service principal credentials allow Prisma Cloud to call Azure Resource Manager APIs and collect configuration data without the ability to modify resources, which matches the monitoring requirement.

The payload `' OR '1'='1` is a classic SQL injection attempt. It tries to manipulate the SQL query by breaking out of the id parameter and adding a condition that is always true, potentially bypassing authentication or returning all records. This matches the pattern of SQL injection, where malicious SQL statements are inserted into input fields.

A File Blocking profile can block files based on file type, direction, and even specific file hashes when configured with a hash list. Attaching it to the Security policy rule ensures the firewall inspects the file transfer and blocks the known malicious hash while logging the event. This directly addresses the requirement to block future transfers of that exact file hash.

The 'show arp all' command displays the firewall's complete ARP table, listing each IP address mapped to its corresponding MAC address on the local segment. This directly satisfies the requirement to verify the MAC address associated with a specific IP.

Phishing is a social-engineering attack that uses a fraudulent message, often mimicking a trusted entity such as a bank, to trick the recipient into revealing credentials or clicking a malicious link. Here the email impersonates the firm's bank and pressures the employee to re-enter banking credentials, which matches the defining characteristics of phishing.

Identifying the exact host, its network address, and the logged-in user lets the Tier-2 responder locate the asset, assess scope, and contact or verify the user's activity. Without these identifiers, the responder cannot correlate telemetry or take targeted containment. This is foundational context for any escalation and is required for a usable ticket.

MITRE ATT&CK supplies a shared, vendor-neutral vocabulary of adversary tactics and techniques, so alerts tagged in Cortex XDR map to the same named behaviours across tools and teams. This common language lets analysts correlate and communicate incidents consistently, satisfying the need for standardised terminology.

GlobalProtect is Palo Alto Networks' client VPN, tunnelling remote users' traffic to the next-generation firewall for inspection and policy enforcement. It secures public Wi-Fi connections by encrypting both internet-bound and corporate traffic back to the firewall.

URL Filtering profiles can be configured to either alert or block for each category. If the action is set to alert, the firewall generates a log but does not block the traffic. In this scenario, users can still access blocked categories, indicating that the profile is not set to block. Changing the action to block for the desired categories would enforce the policy.

Prisma Cloud CIEM correlates granted permissions with actual usage from logs to surface permissions that are unused or broader than needed, then recommends reductions. This directly addresses the team's goal of finding identities with excessive permissions and provides actionable remediation guidance.

Setting allowPrivilegeEscalation to false prevents a process from gaining more privileges than its parent, blocking setuid/setgid binaries and other escalation vectors. This directly addresses the requirement to stop privilege escalation, and Prisma Cloud Compute can enforce this via its runtime defense policies.