Palo Alto Networks Certified Cybersecurity Apprentice Cybersecurity-Apprentice Exam Questions

Answer : C

A firewall is an inline security control that can inspect traffic destined for a host and determine whether to allow, block, or further analyze it. Modern firewalls, especially next-generation firewalls, can identify malicious traffic using application awareness, threat prevention, signatures, URL categories, and policy context. Quality of service prioritizes or manages traffic performance, not security inspection. Endpoint protection resides on the host and is not primarily an inline network option. A WAN accelerator improves performance over wide area networks but does not serve as the main malicious traffic enforcement device. Inline placement matters because it allows the firewall to stop traffic before it reaches the target. This differs from passive monitoring tools that may alert after seeing suspicious traffic but do not block it directly. Firewalls are foundational network security controls because they define trust boundaries and enforce policy between zones, networks, users, applications, and destinations. Reference/topics: Network Security 3.2, firewalls and NGFWs; Cybersecurity 1.5, firewalls as threat prevention systems.

Answer : B

A next-generation firewall is best suited to block or allow traffic based on the actual application being used rather than only the port number. Traditional firewalls commonly rely on IP addresses, protocols, and ports, which is insufficient when many applications use common ports such as TCP 80 or TCP 443. A next-generation firewall adds application awareness, allowing it to identify traffic based on application behavior and enforce more precise security policy. A hub operates at OSI Layer 1 and simply repeats signals; it cannot inspect applications. A DHCP server assigns IP configuration information to clients and does not enforce application-based security policy. A Layer 2 switch forwards frames based on MAC addresses and does not determine whether a specific application should be allowed. Application-aware policy is important because attackers and risky applications often hide within allowed ports. NGFWs help security teams control traffic according to business intent, application risk, user identity, and threat context. Reference/topics: Network Security, stateful firewalls, next-generation firewalls, application awareness.

Answer : D

An incident response plan is the documented strategy that defines how an organization detects, analyzes, contains, eradicates, recovers from, and learns from cybersecurity incidents or disruptive events. It assigns responsibilities, escalation paths, communication rules, evidence-handling expectations, and recovery procedures so that teams can act quickly under pressure. MTTR, or mean time to respond/recover, is a performance metric that measures how long response or recovery takes. MTTD, or mean time to detect, measures detection speed. Security framework alignment helps map controls and practices to recognized standards, but it is not the operational response document itself. A strong incident response plan reduces confusion during an event because teams do not need to invent roles and procedures while an attack is unfolding. It also improves post-incident review by creating a baseline for what should have happened. Reference/topics: Security Operations 6.3, incident response plan and disaster recovery plan; Security Operations 6.1, investigate, mitigate, improve functions.

Answer : B

VPN clients on compatible devices secure remote employee connections by creating encrypted tunnels to company resources. This allows employees outside the office to access sensitive documents at a branch office while protecting traffic over untrusted networks such as home internet, public Wi-Fi, or cellular networks. Public FTP is not appropriate for sensitive documents because FTP is traditionally plaintext unless secured by additional protocols, and public exposure increases risk. Unsecured email attachments are unsafe for sensitive data because they can be intercepted, misdirected, or forwarded without control. Steganography hides information inside other files but is not a standard enterprise access method. VPN access should be paired with strong authentication, device compliance checks, least privilege, logging, and segmentation. The encrypted tunnel protects data in transit, while access policy determines which users and devices are allowed to reach the branch resources. Reference/topics: Network Security 3.3, VPNs; Identity Security 7.1.2, MFA.

Answer : C

A routed protocol establishes the method used to transport data across networks. IP is the most common routed protocol because it provides logical addressing and packet structure that routers can forward between networks. This differs from a routing protocol, which is used by routers to exchange route information and determine forwarding paths. Answer D describes a routing protocol function, not a routed protocol. Answer B is also closer to route selection, though routing decisions may consider metrics rather than simply ''fastest.'' Answer A is not a standard definition. Understanding this distinction prevents confusion: routed protocols carry user data, while routing protocols help infrastructure decide where to send that data. Examples of routing protocols include OSPF, BGP, and RIP; they advertise reachability and path information. Routed protocols, such as IP, define how packets are addressed and transported across routed networks. Reference/topics: Network Fundamentals 2.5, routed protocols and routing protocols.

Answer : B

A virtual machine is a self-contained operating environment that behaves like a separate computer while running on a physical host. A VM includes its own guest operating system, virtual CPU, memory, storage, and network interfaces. Multiple VMs can run on a single physical server through a hypervisor, which allocates and manages physical resources. A hypervisor enables virtualization, but it is not the guest operating environment itself. A container packages an application and dependencies while sharing the host operating system kernel, making it lighter than a VM. A WAN accelerator improves performance over wide area links and is unrelated to virtualization. VMs are foundational to cloud computing because they allow providers to abstract physical hardware and offer flexible compute resources to customers. Security teams must secure VMs by hardening guest operating systems, patching, controlling access, monitoring activity, and applying cloud network policies. Reference/topics: Cloud Security 5.4, virtualization and virtual machine; Cloud Security 5.2, IaaS.

Answer : C

Reconnaissance is the information-gathering stage of the cyber attack lifecycle. During this phase, attackers attempt to understand the target environment before selecting a delivery path or exploit. A host sweep is a reconnaissance activity because it identifies live systems within an address range. This helps an attacker map reachable hosts, discover exposed services, and prioritize later scanning or exploitation. File exfiltration occurs much later, during actions on objectives, after access has been obtained. SQL injection is an exploitation technique against an application or database-backed service. A phishing campaign is normally associated with delivery, where the attacker attempts to place a malicious link, attachment, or credential-harvesting page in front of a user. Reconnaissance is the attacker's ''survey the terrain'' phase: it does not yet require compromise, but it materially improves the attacker's chance of success. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, common attack types.