Certified Cybersecurity Apprentice (Cybersecurity-Apprentice) (Cybersecurity-Apprentice) — Questions 301–339

This is correct because the finding about former employees retaining active accounts is a lifecycle management failure. A formal deprovisioning process with defined triggers and timelines ensures accounts are disabled or removed as soon as employment ends, closing the window an attacker could use a stale credential. This directly remediates the specific gap the auditors identified.

Exploit Protection monitors memory regions of common applications, detecting shellcode executing directly in memory before any file is written to disk. This satisfies the stem's pre-file-drop constraint, since file-based malware scanning cannot observe memory-only execution flows.

Domain lists are natively supported for External Dynamic Lists in PAN-OS, satisfying the requirement for direct import without transformation. The firewall retrieves a plain-text file of domains and enforces policy against them, unlike IP or URL lists which serve different matching axes. This confirms domain as one of the three valid EDL types.

Traffic logs contain detailed information about sessions, including source and destination IP addresses, applications, and ports. By filtering traffic logs where the destination IP is the known malicious address, the analyst can quickly identify the internal source host and the application used. This is the most direct and efficient method to correlate the traffic and answer the question.

BGP best-path selection first validates the NEXT_HOP attribute; if the advertised next-hop address has no resolving route in the Routing Information Base, the route stays in rib-in but is marked not-best and never installed. Fixing reachability (static route, IGP, or next-hop-self) restores eligibility.

Domain generation algorithms produce many pseudo-random domain names that malware queries to locate its command-and-control server. Most queries fail with NXDOMAIN until the attacker registers one of the generated domains. The pattern of repeated random DNS queries from an unscheduled server strongly indicates an infected host attempting to establish C2. The analyst should isolate and investigate the server.

A red status with working internet access suggests the agent service is stopped or cannot reach the cloud endpoints. Verifying the service state and DNS resolution or reachability of the required hostnames is the fastest, least disruptive first step and directly targets the management connection the security team needs restored.

Cortex XDR's Incident View correlates related endpoint alerts into a single automated attack story, mapping the ransomware's root cause, process chain and every affected host. This directly satisfies the analyst's need to establish scope and causality during initial triage, rather than investigating isolated alerts individually.

Security groups act as stateful virtual firewalls at the instance level. An inbound rule permitting port 3306 from 0.0.0.0/0 would expose the database to any source that can reach it, which is the most common misconfiguration behind unexpected database exposure, so reviewing these rules is the correct first step.

Full-disk encryption encodes all data on the drive so it cannot be read without the decryption key. If the disk is physically removed from the server, the stored card data remains unreadable to anyone without the key, directly mitigating the confidentiality risk described in the scenario.

Causation Analysis with expanded forensic data collection captures the process lineage and behavioural telemetry behind the flagged activity. Enabling it in the Agent Settings profile for that endpoint group gives the administrator the forensic detail needed to determine whether the internal application is genuinely malicious.

Virtual Wire mode binds two interfaces into a transparent inline pair, so frames traverse the firewall without any Layer 2 or Layer 3 addressing. This satisfies the stem's constraint: inspection occurs between two ports with no IP addresses or MAC switching tables required, unlike Layer 3 routed or Layer 2 switched deployments.

URL filtering profiles inspect outbound HTTP/HTTPS requests against category and reputation lists, blocking known phishing and malicious domains at the rule level. This directly satisfies the requirement to prevent employees reaching those destinations, unlike TLS inspection or threat-intelligence feeds alone.

A Vulnerability Protection Profile inspects traffic against signatures for known scanning and exploit activity, and drop or reset-both actions terminate the session. Applied to the security rule, it detects and blocks the reconnaissance scans targeting the internal database server from external IPs.

CSPM is designed to provide visibility into cloud resource configurations, detect misconfigurations, and assess compliance against standards. Prisma Cloud CSPM scans cloud accounts, identifies issues like public storage buckets or overly permissive security groups, and alerts on violations. This continuous monitoring helps organizations maintain a secure posture and meet regulatory requirements, making it the core purpose of CSPM.

AWS CloudTrail records API activity, including IAM actions such as CreateAccessKey. By querying CloudTrail logs, the analyst can identify the user who created the access key, along with the timestamp and source IP. This is the primary service for auditing AWS API calls.

Prisma Cloud CSPM typically scans cloud accounts on a schedule, such as every few hours, or via event-driven triggers if configured. A newly created resource may not appear until the next scan cycle. The delay of 10 minutes is consistent with scheduled scanning. The team can check the scan schedule or manually trigger a scan in the console to expedite discovery.

Agent-to-cloud communication depends on outbound access to the tenant's service endpoints over TLS. If a TLS-inspecting proxy substitutes an untrusted certificate, the handshake fails even though general connectivity works. Confirming reachability and a trusted certificate chain directly addresses the repeated handshake failures seen in the agent logs.

Blocking the URL prevents further clicks, hunting identifies all affected recipients, and resetting credentials for users who submitted them removes attacker access. This combined response contains the phishing campaign, addresses the credential compromise, and preserves the ability to investigate scope. It is the most complete action for protecting users while maintaining evidence for the incident record.

tcpdump is a command-line packet analyzer that can capture full packet payloads from a network interface, including a SPAN port. It supports writing to a pcap file for offline analysis with tools like Wireshark. It is widely used for its simplicity and ability to capture detailed traffic, making it suitable for this scenario.

A WAF inspects HTTP traffic and blocks or alerts on malicious requests such as SQL injection or cross-site scripting attempts. It is a technical control because it is implemented in software or hardware and automatically enforces security policy on traffic, directly reducing the likelihood that common web attacks succeed.

Email headers preserve the sender's originating infrastructure, authentication results, and routing path, while the URL identifies the delivery mechanism for the credential-harvesting or malware page. Together they document how the attacker obtained initial access, which is essential for root-cause analysis, blocking the sender, and notifying other potentially targeted users.

Security profiles are applied on security policy rules to inspect allowed traffic for threats. Even if traffic is not decrypted, the firewall can still perform threat inspection on the plaintext portions. The decryption policy rule should simply exclude those categories from decryption, and the security policy rule handles threat scanning.

Least privilege grants users and applications only the minimum access rights needed for their authorised tasks, reducing the attack surface exposed by excessive permissions. It directly matches the requirement that privileges be restricted to what each identity genuinely requires, limiting damage from compromised accounts or over-privileged processes.

A serial console connection via terminal emulator gives out-of-band CLI access through the physical RJ-45 or micro-USB port, working even when management interfaces are unreachable. This satisfies the requirement for a valid CLI access method independent of network configuration.

Aggregating and correlating feeds from multiple sources lets the TIP normalise indicators and operationalise them into existing controls, satisfying the stem's requirement to complement traditional defences. Rather than merely collecting data, it enriches detection and response with actionable, prioritised intelligence drawn from both external and internal telemetry.

This sequence matches the widely used incident response lifecycle: preparation before incidents, detection and analysis to confirm and scope, containment, eradication, and recovery to remove the threat and restore service, and post-incident activity to capture lessons learned. It reflects the logical order in which responders move from readiness through investigation to cleanup and improvement.

Syslog server profiles are defined under Device > Server Profiles > Syslog in the firewall GUI. This path creates the profile that log forwarding rules then reference, enabling the external SIEM to receive Syslog messages from the Next-Generation Firewall.

Static IP is a valid Source NAT translation type, mapping one internal address to one fixed public address persistently. It differs from dynamic IP, which draws from a pool, and from dynamic IP and port, which also translates the source port for many-to-few overloading.

The Cortex XDR endpoint agent hooks OS kernel-level events, capturing process creation, parent-child relationships and full command-line arguments. This kernel telemetry is what reconstructs the exact execution tree and PowerShell parameters, satisfying the need to identify the precise script invocation.

Organization-level trust relationships let Prisma Cloud assume a single management-account role, which then chains into member accounts, so you maintain one trust policy and role set rather than per-account credentials. This directly satisfies the stem's role-aggregation requirement, cutting IAM maintenance overhead across every onboarded account.

Panorama Pre-Rules and Post-Rules sit outside the device-group rule hierarchy and are evaluated before or after local rules, so a destination-IP block pushed to managed firewalls immediately halts the workstation's C2 traffic enterprise-wide without editing each firewall's rulebase.

Placing the management interface in the Management zone and denying Trust-to-Management traffic in the Security policy enforces separation of management and dataplane traffic. This prevents internal users from reaching the management IP, while still allowing internet access via the Trust-to-Untrust rule. The firewall evaluates Security policy for inter-zone traffic, so this rule effectively blocks unauthorized management access.

Prisma Cloud requires read-only access to cloud accounts to discover and assess resources. For AWS, this is typically an IAM role with a trust policy allowing Prisma Cloud to assume it. For Azure, a service principal with Reader role; for GCP, a service account with Viewer permissions. Without these credentials, Prisma Cloud cannot collect configuration data, making this a fundamental onboarding step.

Malware Prevention in Cortex XDR uses signature and hash-based detection to compare files against known malicious databases, including cloud lookups. Enabling this module ensures that the agent can block known malware based on file reputation and hashes, directly addressing the administrator's goal. This is the primary module for detecting and preventing known malicious files.

Log forwarding filters are configured as profiles under Objects > Log Forwarding, then attached to individual Security Policy rules. This placement lets the administrator drop informational logs per rule before forwarding to the external SIEM.

Offloading pattern matching to dedicated ASICs or FPGAs removes regular expression inspection from the dataplane CPU entirely, satisfying the stem's requirement to reduce CPU utilisation on supported hardware models. Inspection throughput then scales with the security processor rather than general-purpose cores, preserving detection coverage without degrading traffic forwarding.

Reviewing authentication logs and comparing them to the user's baseline helps determine if the login is anomalous. Cortex XDR provides identity analytics that show typical locations, times, and devices. This quick check can reveal whether the login is legitimate, such as from a new location due to travel, or suspicious, warranting further investigation.

A service account with a custom IAM role scoped to organisation-level read permissions grants Prisma Cloud only the access needed for API integration, satisfying least privilege. This avoids broad predefined roles, and Prisma Cloud documents service accounts as the supported GCP authentication method.