Palo Alto Networks Certified Cybersecurity Apprentice Practice Exam

What the Palo Alto Networks Certified Cybersecurity Apprentice exam covers

• Cybersecurity72 questions
• Network Fundamentals70 questions
• Network Security61 questions
• Endpoint Security36 questions
• Cloud Security58 questions
• Security Operations52 questions
• Identity Security77 questions

Free Palo Alto Networks Certified Cybersecurity Apprentice practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 426-question bank.

1. Question 1Cybersecurity

   A new analyst reads an incident summary: an attacker used a small piece of code to take advantage of a flaw in a web browser, and that code then placed ransomware on the computer. Which statement correctly describes the two pieces of software?

   • ABoth pieces are malware, because each one was used to attack the computer.
   • BThe code is malware, and the ransomware is the exploit that the code delivered.
   • CThe code is a vulnerability, and the ransomware is the exploit that made use of it.
   • DThe code is an exploit, and the ransomware is the malware that the exploit delivered.Correct
   ✓ Correct answer: D

   Palo Alto Networks defines an exploit as a piece of code or a program that takes advantage of a weakness, or vulnerability, in an application or system. Malware is the malicious software that does the harmful work, such as demanding a ransom. The source states that exploit code may be used to deliver malware, but the code is not the malware itself. In the summary, the code that used the browser flaw is the exploit, and the ransomware it placed on the computer is the malware.

   Why the other options are wrong

   • APalo Alto Networks says exploit code may be used to deliver malware, but the code is not the malware itself. Only the ransomware here is malware; the code that used the flaw is the exploit.
   • BThe roles are reversed. Code that takes advantage of a weakness is an exploit, and ransomware is a type of malware, the harmful software that the exploit delivered.
   • CA vulnerability is the weakness itself, not code. The browser flaw is the vulnerability, and the code that took advantage of it is the exploit.
2. Question 2Cybersecurity

   Which description matches a network-based intrusion detection system (NIDS)?

   • AIt runs on one endpoint and checks the traffic and activity of that host
   • BIt sits at the front end of a web server and watches that server's protocol
   • CIt sits at key points such as vulnerable subnets and judges packets and metadataCorrect
   • DIt sits inline between sender and receiver and blocks traffic it finds harmful
   ✓ Correct answer: C

   Palo Alto Networks describes a network IDS as monitoring a complete protected network. It is deployed across the infrastructure at strategic points, such as the most vulnerable subnets. The NIDS monitors all traffic flowing to and from devices on the network and makes its determinations based on packet contents and metadata. Like other IDSes, it detects and alerts rather than blocking.

   Why the other options are wrong

   • ARunning on a single endpoint and protecting that host describes a host-based IDS (HIDS).
   • BSitting at the front end of a web server and monitoring the protocol between users and the server describes a protocol-based IDS (PIDS).
   • DSitting inline in the traffic flow and blocking threats describes an intrusion prevention system (IPS); an IDS is placed out of band.
3. Question 3Network Fundamentals

   Which firewall type does Palo Alto Networks describe as providing inspection and control directly at the host level, and as a key tool for managing east-west traffic between the tiers of a virtualized application?

   • APerimeter firewall
   • BDistributed firewallCorrect
   • CProxy firewall
   • DCircuit-level gateway
   ✓ Correct answer: B

   Palo Alto Networks explains that distributed firewalls provide inspection and control directly at the host level, which helps against internal threats and lateral movement. It names managing east-west traffic as a key application, securing communication within and across the tiers of a virtualized application. Because rules are applied at each host, a compromised device can be contained. That host-by-host enforcement suits traffic between application tiers.

   Why the other options are wrong

   • AA perimeter firewall deploys at the boundary of the network and mainly handles north-south traffic entering and leaving it.
   • CA proxy firewall acts as an intermediary between user requests and the resources they access, filtering at the application layer. It is not described as host-level control of east-west traffic.
   • DA circuit-level gateway monitors and validates network sessions at the session layer. It is not the type described for host-level control between application tiers.
4. Question 4Network FundamentalsSelect all that apply

   RFC 1122 treats ICMP as an integral part of IP, even though ICMP uses IP to carry its own messages. Which TWO functions does ICMP provide? (Choose TWO)

   • AError reportingCorrect
   • BAddress assignment
   • CGateway redirectionCorrect
   • DHost name lookup
   • EReliable delivery
   ✓ Correct answer: A, C

   RFC 1122 describes ICMP as a control protocol that is considered an integral part of IP. Architecturally it sits on top of IP, because it uses IP to carry its data end to end just as TCP or UDP does. RFC 1122 says ICMP provides error reporting, congestion reporting and first-hop gateway redirection. RFC 1122 adds that Redirect messages are sent only by gateways, and a host that receives one must update its routing information.

   Why the other options are wrong

   • BAllocating addresses to hosts is a function of DHCP, which delivers configuration parameters from a server to a host, not of ICMP.
   • DMapping host names to addresses is the job of the Domain Name System, not of ICMP.
   • EICMP reports problems but does not make delivery reliable; RFC 1122 leaves reliable delivery to the layers above IP.
5. Question 5Network Security

   A security awareness slide sorts proxy types into business and consumer use. One type is marked as consumer and noted as rarely deployed by companies because it often lacks the inspection, control or trust models they need. Which proxy type is the slide describing?

   • ATransparent proxy
   • BAnonymous proxyCorrect
   • CExplicit proxy
   • DReverse proxy
   ✓ Correct answer: B

   The Cyberpedia proxy page groups proxy types by role, by transparency and by protocol, and labels each as business or consumer. Anonymous proxies mask a user's IP address to increase online privacy or bypass content restrictions. The page says they are rarely used in enterprise environments and often lack the inspection, control or trust models required for secure deployment. It labels them as applying to consumers.

   Why the other options are wrong

   • ATransparent proxies are labelled business, and the page says they are common in enterprises and still inspect, filter and log traffic.
   • CExplicit proxies are labelled business, and the page says they give organizations tighter control over which traffic is proxied.
   • DReverse proxies are labelled business and are used for load balancing, TLS termination and web application protection in front of servers.
6. Question 6Endpoint Security

   According to Palo Alto Networks guidance on applying Zero Trust to IoT, which set of activities should Zero Trust security for IoT devices include?

   • ADiscover and identify devices, authenticate them, set policy and segment, keep assessingCorrect
   • BPlace devices behind the perimeter firewall, then review its rules at yearly audits
   • CBlock threats with antivirus, catch what slips through with EDR, then remediate
   • DInstall a security agent on each device, scan it for malware, then patch monthly
   ✓ Correct answer: A

   Palo Alto Networks guidance says Zero Trust security for IoT must include discovering and identifying the devices. It must authenticate them, define policy and segment them, and keep assessing them continually. Zero Trust removes the assumption that anything inside the network is safe. The approach also works without software agents, which many IoT devices are not designed to take.

   Why the other options are wrong

   • BRelying on the perimeter and checking once a year is the castle-and-moat model that Zero Trust replaces, and it has no continual assessment.
   • CAntivirus followed by EDR is an endpoint protection stack for computers, not the Zero Trust steps the guidance lists for IoT.
   • DThe page says traditional endpoint solutions need software agents that IoT devices are not designed to take, so agent-based scanning cannot protect them.
7. Question 7Cloud Security

   A firm changes how it handles payroll. ``` | Before | After | |------------------------------------------------|--------------------------------------------------------| | Payroll software installed on its own servers | An online payroll service from a provider, by subscription | | IT team patches and backs up the payroll app | Provider runs and maintains the application | ``` Which cloud migration strategy from the Cyberpedia cloud security glossary does this describe?

   • ALift and shift
   • BReplatforming
   • CRepurchasingCorrect
   • DRelocating
   ✓ Correct answer: C

   The Cyberpedia glossary lists common cloud migration strategies. It says repurchasing involves replacing an existing workload or application with a cloud-based equivalent, such as a SaaS application. The firm did not move its own payroll software; it replaced that software with a provider's online service. That replacement with a SaaS equivalent is repurchasing.

   Why the other options are wrong

   • AThe glossary says lift and shift migrates an entire workload to the cloud without significant changes, which would have moved the firm's own payroll software rather than replacing it.
   • BThe glossary says replatforming modifies the existing workload to use cloud features such as a cloud database, but the firm stopped using its own payroll software.
   • DThe glossary says relocating moves a workload from one cloud provider or region to another, while the firm's payroll started on its own servers.
8. Question 8Security Operations

   After an incident ticket is opened at a regional bank, the analyst checks which accounts and servers the infected workstation touched and works out how the malware first got onto it. Which security operations function is this?

   • AIdentify
   • BMitigate
   • CInvestigateCorrect
   • DContinuous Improvement
   ✓ Correct answer: C

   The Cyberpedia SOC page says the Investigate function looks into the root cause and impact of the incident. Working out how the malware first arrived is finding the root cause. Checking which accounts and servers the workstation touched is measuring the impact. Both tasks belong to Investigate.

   Why the other options are wrong

   • AIdentify means recognizing an alert as potentially malicious and opening an incident, which already happened when the ticket was opened.
   • BMitigate means recommending options to isolate and remove the threat, not tracing how it arrived or what it touched.
   • DContinuous Improvement means adapting process, visibility and technology as incidents occur, not examining one incident.
9. Question 9Security Operations

   According to the Cyberpedia SOAR vs SIEM page, why can incident response take longer when a team relies on a SIEM alone rather than adding SOAR?

   • AA SIEM can collect logs from only one kind of device at a time
   • BA SIEM raises alerts but relies on analysts to investigate and respondCorrect
   • CA SIEM reviews events in batches long after they occur, not in real time
   • DA SIEM displays events on dashboards but cannot generate any alerts
   ✓ Correct answer: B

   The Cyberpedia SOAR vs SIEM page compares the two tools on incident response. It says SIEM systems provide visibility into security events and can generate alerts. However, a SIEM relies on human analysts to investigate, assess and respond to incidents, which can lead to longer response times. SOAR platforms instead automate repetitive tasks and orchestrate incident workflows, which reduces mean time to resolution.

   Why the other options are wrong

   • AThe page says SIEM tools collect data from various sources and integrate with firewalls, intrusion detection systems and antivirus software.
   • CThe page says SIEM tools monitor network activity and security events in real time.
   • DThe page says SIEM systems can generate alerts and describes real-time alerting as one of their benefits.
10. Question 10Identity Security

    Which privileged access management (PAM) practice does Cyberpedia recommend for identifying shadow admins and refining access control policies?

    • APeriodic red team simulations
    • BContinuous auditing of session logsCorrect
    • CRotating passwords after each use
    • DVaulting secrets used by CI/CD tools
    ✓ Correct answer: B

    Shadow admins are users who hold high-level access that no one intended, often because they granted temporary rights for troubleshooting and never removed them. Cyberpedia's PAM table lists continuous auditing under governance and validation: reviewing session logs reveals who is actually using privileged access. Those findings show which permissions should be removed. The access control policies can then be tightened.

    Why the other options are wrong

    • ARed team exercises are periodic simulations that test the strength of PAM controls against real-world attacks, not a review of session logs to find shadow admins.
    • CAutomatic rotation after every use protects the vaulted passwords themselves; it does not reveal who holds unintended privileges.
    • DVaulting secrets used by pipeline tools protects credentials in automated pipelines and the cloud; it is not the practice for finding shadow admins.

Who this Palo Alto Networks Certified Cybersecurity Apprentice practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified Cybersecurity Apprentice exam - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified Cybersecurity Apprentice practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified Cybersecurity Apprentice exam.

Related Palo Alto resources

• Palo Alto Networks Certified Cybersecurity Apprentice study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Palo Alto Networks Certified Network Security Architect practice examRelated
• Palo Alto Networks Certified SD-WAN Engineer practice examRelated
• Palo Alto Networks Certified Security Operations Architect practice examRelated

Palo Alto Networks Certified Cybersecurity Apprentice practice exam FAQ