Free Palo Alto Networks Cybersecurity Apprentice Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks Cybersecurity Apprentice practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A security analyst finds a software flaw that could allow an attacker to bypass authentication. The flaw has not been exploited. What does the flaw represent?

   1. A.A security control
   2. B.A system vulnerabilityCorrect answer: B
   3. C.A threat source
   4. D.A security incident

   Explanation: NIST defines a vulnerability as a "Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source." The unexploited authentication flaw is a weakness, rather than an actual incident or its potential source.

   Reference: NIST Cybersecurity and Privacy Reference Tool: vulnerability glossary — Definitions, first entry

2. 2A company connects office networks in several states to exchange data. What kind of network describes the connection across those locations?

   1. A.Local area network
   2. B.Personal area network
   3. C.Wide area networkCorrect answer: C
   4. D.Metropolitan area network

   Explanation: NIST defines a wide area network as "A physical or logical network that provides data communications to a larger number of independent users than are typically served by a local area network (LAN) and that is usually spread over a larger geographic area than that of a LAN." The interoffice connection spans multiple states, beyond the individual local networks.

   Reference: NIST CSRC Glossary: Wide Area Network — Definitions

3. 3A network administrator groups firewall interfaces and their connected network segments so they can receive common security policy. What is this grouping called?

   1. A.A security zoneCorrect answer: A
   2. B.An IP subnet
   3. C.A virtual LAN
   4. D.A routing domain

   Explanation: The exam owner defines a security zone as "a group of one or more physical or virtual firewall interfaces and the network segments connected to the zone’s interfaces." This is the grouping described in the scenario.

   Reference: Network Segmentation Using Zones — Network Segmentation Using Zones, introduction

4. 4A network-connected building device measures room temperature and converts the measurement into a signal for monitoring. Which component performs the measurement?

   1. A.Actuator
   2. B.Gateway
   3. C.SensorCorrect answer: C
   4. D.Controller

   Explanation: NIST describes a sensor as "A device that measures a physical quantity and converts it into a signal which can be read by an observer or by an instrument." Temperature measurement and signal production fit that role.

   Reference: NIST CSRC: Sensors — Sensors topic definition

5. 5Several organizations with common security requirements use cloud infrastructure reserved for their group. Under NIST's deployment models, what kind of cloud is this?

   1. A.Public cloud
   2. B.Private cloud
   3. C.Community cloudCorrect answer: C
   4. D.Hybrid cloud

   Explanation: NIST describes a community cloud as "provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns". The shared infrastructure is reserved for the organizations with common requirements.

   Reference: The NIST Definition of Cloud Computing — Section 2, Deployment Models, Community cloud

6. 6After a security team confirms an incident, an analyst isolates an affected endpoint to contain it. Which NIST CSF incident-response function includes taking action on a detected incident?

   1. A.Identify
   2. B.Detect
   3. C.RespondCorrect answer: C
   4. D.Recover

   Explanation: NIST states that "Respond (RS): Actions regarding a detected cybersecurity incident are taken." Isolating an affected endpoint after confirmation is a response action.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Section 2, Respond function

7. 7An access system requires two distinct authentication factors. Which combination meets that requirement?

   1. A.A password and a PIN
   2. B.A password and a hardware tokenCorrect answer: B
   3. C.A fingerprint and a face scan
   4. D.A smart card and a hardware token

   Explanation: NIST defines multifactor authentication as "Authentication using two or more different factors" and identifies a password as knowledge and a token as possession. The other pairs use two examples of the same factor category.

   Reference: NIST CSRC Glossary: Multi-Factor Authentication — Definitions, first entry

8. 8An analyst is classifying a vulnerability using CISA's Stakeholder-Specific Vulnerability Categorization. Which evidence supports an Active exploitation state?

   1. A.A published proof of concept demonstrating a plausible attack
   2. B.Reliable reporting of threat actors using the exploit in the wildCorrect answer: B
   3. C.A publicly known method for exploiting the vulnerability
   4. D.A vendor advisory confirming the vulnerability exists

   Explanation: CISA defines Active as "Shared, observable, and reliable evidence that cyber threat actors have used the exploit in the wild; the public reporting is from a credible source." A proof of concept, known method, or confirmation that a vulnerability exists does not by itself establish observed use in the wild.

   Reference: CISA Stakeholder-Specific Vulnerability Categorization Guide — (State of) Exploitation, Table 2, Active

9. 9An SD-WAN selects a WAN link for a delay-sensitive application by evaluating the application's traffic policy and the current latency and loss of each link. Which combination guides this decision?

   1. A.Application policy and measured link conditionsCorrect answer: A
   2. B.Application policy and static destination prefixes
   3. C.Application policy and route administrative distance
   4. D.Application policy and configured next-hop preference

   Explanation: The exam owner states that "SD-WAN dynamically steers traffic across WAN connections based on application policies and network conditions." These factors guide path selection across available WAN connections.

   Reference: What Is SD-WAN Architecture? — SD-WAN architecture FAQs, Is SD-WAN a load balancer?

10. 10A packet-filtering firewall tracks the state of each connection and rejects packets that deviate from the expected connection state. Which inspection method is being used?

    1. A.Stateless packet filtering
    2. B.Stateful packet inspectionCorrect answer: B
    3. C.Application proxy inspection
    4. D.Circuit-level proxy inspection

    Explanation: NIST defines stateful inspection as "Packet filtering that also tracks the state of connections and blocks packets that deviate from the expected state." The firewall is using the recorded connection state to evaluate the packet.

    Reference: NIST CSRC Glossary: Stateful Inspection — Definitions