Palo Alto Networks Cybersecurity Apprentice (CyberSec-Apprentice) Free Sample Questions

Reconnaissance is the first stage where the adversary identifies and selects targets, often using public information (OSINT) to map the organization's structure and personnel. Weaponization follows this stage.

App-ID is the NGFW technology that identifies applications. The PAN-OS Administrator's Guide says App-ID applies several classification mechanisms, namely application signatures, application protocol decoding and heuristics, to identify the application regardless of the port, protocol, evasive tactics or encryption it uses. The PCCET study guide adds that App-ID can decrypt TLS/SSL and SSH traffic to look inside it. Security policy can then be written for applications instead of ports, which replaces port-based stateful inspection. User-ID maps IP addresses to users. Content-ID scans allowed traffic for threats, files and data. WildFire analyzes unknown files to find new malware.

'Never trust, always verify' is the core principle of Zero Trust: no user, device or request is trusted because of where it is on the network. The PCCET study guide lists 'Inspect and log all traffic' as a core Zero Trust principle and says it reiterates the need to 'always verify'. Palo Alto Networks Cyberpedia adds that every access attempt is authenticated, authorized and validated, whether it comes from inside or outside the network. Least privilege access limits each user to the minimum access needed. Assume breach means designing controls that contain attackers who are already inside. 'Trust but verify' is the old perimeter approach: it trusts first and checks later, which is the opposite of Zero Trust.

A File Blocking profile controls the transfer of specific file types. The PAN-OS Web Interface Help says you attach it to a Security policy rule to block users from uploading or downloading specified file types, or to raise an alert when they try. Each rule in the profile lists applications, file types, a direction (upload, download or both) and an action: alert, continue or block. So a Security rule can allow an application while the profile still blocks files such as .exe or .bat. An Antivirus profile blocks known malware, not whole file types. A Vulnerability Protection profile blocks exploit attempts. A Data Filtering profile blocks content that matches sensitive data patterns, such as credit card numbers.

Security orchestration, automation and response (SOAR) platforms connect security tools, automate repetitive tasks and manage incident response. Cortex XSOAR (formerly Demisto) is the Palo Alto Networks SOAR platform. It combines security orchestration, incident management and interactive investigation. Playbooks automate the response steps, integrations connect third-party products, and the War Room supports collaboration on each incident. Cortex XDR is an extended detection and response product that detects and investigates threats across endpoint, network and cloud data. Cortex Data Lake (now Strata Logging Service) stores logs, and Prisma Access is a cloud-delivered security service for remote networks and mobile users.

Prisma Cloud covers both the build stage and the run stage of a cloud application. For running resources, its Cloud Security Posture Management (CSPM) continuously monitors the cloud accounts for misconfigurations and compliance violations. For the build stage, it scans Infrastructure as Code (IaC) templates, such as Terraform or CloudFormation files, before they are deployed. The PCCSE study guide says Prisma Cloud scans these files for vulnerabilities and compliance problems before they become a working configuration. Finding problems this early is the 'shift left' idea. Prisma Cloud does not replace the cloud provider's Identity and Access Management (IAM); its IAM policies monitor identities for excess or unused permissions. It is a cloud service, not physical firewall hardware for on-premises data centers.