Palo Alto Cybersecurity Apprentice Study Guide

Domain 1: Cybersecurity

Key concepts you must know · 72 practice questions

An exploit is code that takes advantage of a vulnerability, and it can deliver malware such as ransomware without being the malware itself. Malware families, such as worms, Trojans, botnets, spyware and viruses, are named for the payload or action they perform, not how they arrive; adware brings unwanted ads, redirects and tracking. Exploits are grouped by result: arbitrary code execution, privilege escalation, denial of service or data exposure.
A zero-day vulnerability is a flaw the vendor has not yet discovered, a zero-day exploit is code engineered to trigger it, and a zero-day attack is its use against a live system. The flaw leaves zero-day status when reported and given a CVE identifier. The window of vulnerability runs from discovery until the patch is widely deployed. CVE databases mostly list public software, so internal applications can hold unlisted flaws.
Security misconfigurations, such as a firewall change that exposes a file share to the internet, are non-patchable vulnerabilities in current, authorized software. Vulnerability management inventories every possible entry point whether or not anyone is attacking, while threat management tracks which doors attackers are actually trying. A virtual patch, enforced by an IPS or web application firewall, blocks the exploit path without changing the vulnerable application, operating system or firmware.
The cyber attack lifecycle, also called the Cyber Kill Chain, runs from reconnaissance to exfiltration, and attackers must pass every stage, so blocking any one breaks the chain: attackers must do everything right, defenders only one thing. In reconnaissance, attackers research targets on social media, LinkedIn and corporate websites. Defenses include inspecting traffic for port scans and host sweeps, awareness training on what not to post and minimal public infrastructure details.
In Palo Alto Networks' lifecycle, weaponization and delivery form one stage where attackers pick a method such as exploit kits, spear phishing or malvertising. Exploitation precedes installation, where malware is placed to persist and escalate privileges. At command and control the attacker owns both sides of the connection and passes instructions over a channel, so controls act on outbound traffic, such as URL filtering that blocks known malicious URLs.
Lateral movement is an attacker moving host to host inside a compromised network in search of data, privileges or critical assets. After entry, the usual order is internal reconnaissance, credential theft, privilege escalation and finally executing objectives while covering tracks. It is hard to detect because it mimics legitimate users logging in, and detected attackers often leave backdoors to re-enter after incident response removes them.
Password spraying tries a few common passwords across many usernames, low and slow, to avoid lockouts, and needs no breached data; credential stuffing replays username-password pairs from earlier breaches; a dictionary attack cycles through a curated list of likely values. Insider threats are malicious (gain or grievance), careless (negligence) or moles planted for an outside party, and their authorized logins make them hard to spot.
Social engineering exploits psychology rather than technical flaws. The urgency trigger creates artificial time pressure, such as an account deleted within an hour, while reciprocity offers something first, such as a free tool that is really malware. Generative AI creates deepfake audio or video that impersonates executives. Awareness training aims at behavioral change, a human firewall that also enables automatic updates and stops postponing patches.
Once command and control is set up, the infected machine asks the attacker's server for instructions, often blending into HTTP, HTTPS or DNS. The centralized C2 model is the most common and easiest to block; peer-to-peer passes commands between bots and is much harder to detect; the random model, using IRC, CDNs, social media comments and email, is the hardest. Botnet zombies usually keep working normally, so owners stay unaware.
Model poisoning injects malicious data during AI training, while an adversarial attack crafts inputs that make an already trained model misclassify. Prompt injection embeds instructions the model follows as normal input; indirect prompt injection plants them in web content or data the model pulls in. A man-in-the-middle attack needs interception, such as a fake Wi-Fi hotspot, then decryption so content can be read or changed.
A host-based IDS (HIDS) runs on one computer, analyzing its traffic and notifying designated people, while a network-based IDS (NIDS) sits at strategic points such as vulnerable subnets and judges packet contents and metadata. A protocol-based IDS sits at a web server's front end. Signature-based detection cannot catch unknown attacks, while anomaly-based detection models normal activity and flags rare but healthy behavior as false positives. An IDS alerts rather than blocks.
Intruders evade an IDS with fragmentation, flooding, obfuscation and encryption. Network detection and response (NDR) profiles behavior metadata, not payloads, so encryption does not blind it. A high-interaction honeypot simulates a full server, web app or database, a low-interaction honeypot emulates limited SSH, SMB or HTTP responses, and a honeytoken is a fake record, cloud key or credential whose access alerts defenders because nothing legitimate touches it.
An intrusion prevention system sits inline, so it can block exploits in the window between a vulnerability's discovery and its patch. Exploit-facing signatures match one exploit attempt; vulnerability-facing signatures target the flaw itself, covering unknown exploits with more false-positive risk. Policy-based detection alerts when activity breaks administrator-defined policy. A WIPS removes unauthorized Wi-Fi devices, and a HIPS guards one machine as a last line of defense behind a NIPS.
Threat prevention stops threats before they run, spread or cause damage, and is cheaper than mitigation; detection applies when prevention fails, and threat protection covers both. Signature-based antivirus misses script-based, multi-vector and fileless attacks and advanced ransomware. Behavioral detection flags actions such as mass file encryption or disabling security services regardless of signature, while heuristic analysis flags traits such as code obfuscation, with some false positives.
Zero Trust replaces the castle-and-moat model that trusted anyone inside the perimeter. It is a mindset, not a product: never trust, always verify, least privilege and assume breach, which treats a breach as inevitable and stresses containment. Protection becomes data-centric, and access decisions weigh identity, device posture, location and data sensitivity, so correct credentials can still be refused. Any identity, human, machine or AI, may be compromised, and workloads authenticate too.
NIST SP 800-207 describes Zero Trust as a decision-and-enforcement loop. The Policy Engine evaluates each request and decides allow, deny or revoke. The Policy Administrator carries out the decision by setting up or tearing down the session. The Policy Enforcement Point sits between requester and resource, such as a gateway in front of an application, enforcing the decision and able to monitor and terminate sessions.

Domain 2: Network Fundamentals

Key concepts you must know · 70 practice questions

A LAN connects devices over a limited area, a few square kilometers or less, so any device can reach any other, while a traditional WAN joins multiple LANs or MANs across large geographic areas. MPLS forwards traffic over private WANs using short labels on each packet instead of network addresses, avoiding a routing decision at every router, and is called Layer 2.5 because it sits between the OSI data link and network layers.
SD-WAN applies software-defined networking to build a virtual overlay across broadband, LTE and MPLS links. It separates the control plane from the data plane: the edge forwards traffic at a site, the controller makes central policy decisions and the orchestrator pushes configurations. Legacy WANs backhauled traffic through one hub, adding latency for cloud apps, and new MPLS circuits take months while SD-WAN sites come online in days.
North-south traffic is client-to-server traffic crossing the perimeter; east-west traffic is workload-to-workload traffic inside it. One north-south web request can spawn hundreds of east-west API calls between microservices. Perimeter defenses see little east-west traffic, which attackers use to move laterally. Traditional segmentation with VLANs, firewalls and routers targets north-south flows, while microsegmentation isolates individual workloads to limit east-west movement.
An external, or perimeter, firewall guards north-south traffic at the network edge as the first line of defense. An internal firewall scrutinizes east-west traffic, assuming threats may already be inside, so it detects as well as prevents. Distributed firewalls enforce rules at each host, suiting traffic between application tiers. Data center firewalls adapt to changes such as VM migration, and virtual firewalls protect both directions in cloud and physical sites.
A host compares the network bits of the destination, under its address mask, with its own. With mask 255.255.255.0, a destination sharing the first three numbers is reached by direct routing with no router. Any other goes through a gateway: the destination IP address stays the far computer's, but the destination Ethernet address becomes the router's. A router has an IP and an Ethernet address on each attached network.
A default route, written 0.0.0.0, is the routing table entry of last resort for networks not explicitly listed, and a host's default gateway plays the same role. RFC 1122 requires a host's IP address, address mask and a list of default gateways with preference levels to be configurable, and a host whose current default gateway fails must switch to another known one. BOOTP, and later DHCP, can supply these at boot.
Basic NAT maps addresses from one group to another, while NAPT also translates TCP and UDP ports, letting many private devices share one public address, as in small and home offices. Traditional NAT sessions are outbound only, with inbound exceptions through static maps for chosen hosts. NAT removes the end-to-end meaning of an IP address and adds network state, so end-to-end IPsec cannot be assumed, but hosts and routers need no changes.
DHCP's dynamic allocation is the only mechanism that automatically reuses addresses no longer needed, suiting temporary clients sharing a limited pool. An address is lent for a lease that the client can extend or release. The client broadcasts DHCPDISCOVER, servers reply with DHCPOFFER, the client sends DHCPREQUEST to one server, declining the rest, and that server commits the address with DHCPACK. Relay agents let one server cover many subnets.
DNS has three components: the domain name space with resource records, name servers and resolvers. A server holding complete data for part of the tree is its authority, organized into zones that can be copied for redundancy. In recursive resolution a server pursues the query for the client; in iterative resolution it refers the client onward, and DNS requires iterative. A record's TTL, set by the zone administrator, limits caching.
In a DNS lookup the resolver asks a root server, which points to the top-level domain server for .com, .edu or .net; the TLD server points to the domain's name servers, and one returns the address record. Lowering a TTL before a planned change limits stale cached answers. Dynamic DNS updates a name's record automatically when its IP address changes, keeping devices on provider-assigned changing addresses reachable by one name.
IP is a routed protocol: it moves datagrams across interconnected networks from module to module by internet address, and implements two functions, addressing and fragmentation. Routing protocols such as BGP, OSPF and RIP exchange information so routers build the table used to pick each next hop. An autonomous system is routers under one administrative authority; interior gateway protocols work inside one, and exterior gateway protocols such as BGP connect them.
OSPF is a link-state protocol inside one autonomous system: every router keeps an identical topology database and computes routes with a shortest-path tree. RIP is a distance vector interior gateway protocol limited to a longest path of 15 hops, with metric 16, called infinity, meaning unreachable. BGP, the inter-autonomous system protocol, exchanges reachability information including the list of autonomous systems a route crossed, which helps prune routing loops.
The seven-layer OSI model stayed conceptual, while TCP/IP was built as the practical foundation of the internet. RFC 1122 names its layers application, transport, internet and link. The TCP/IP link layer equals the OSI physical and data link layers, and the internet layer equals the network layer. The physical layer moves raw bits over copper, fiber or radio; the data link layer builds frames and uses MAC addresses with error detection.
In encapsulation the transport layer splits data into segments with a TCP or UDP header carrying ports, then the network layer adds an IP header to form a packet; each layer serves those directly above and below. IP is connectionless, so datagrams may arrive damaged, duplicated, out of order or not at all, and higher layers add reliability. ICMP, an integral part of IP, reports errors and congestion and redirects first-hop gateways.
A repeater propagates electrical signals between cables, and a modem converts digital data into a telephone-channel signal and back; both are physical layer devices. A bridge forwards between segments using data link information, so bridged segments form one IP subnet, while a brouter bridges some packets and routes others by configuration. A wireless access point connects wireless devices to a wired network. Logical Link Control sits above media-specific Media Access Control.
Packet filtering firewalls use IP addresses, ports and protocols and are cost efficient because routers often include them. Stateful inspection firewalls work up to Layers 3 and 4, using rules plus connection state. A circuit-level gateway works at Layer 5, building separate TCP connections to each side and relaying only approved sessions. Layer 3 firewalls trade content inspection for throughput. Layer 4 load balancers use IP and port details; Layer 7 balancers read message content.

Domain 3: Network Security

Key concepts you must know · 61 practice questions

Physical segmentation splits a network into subnets with a physical or virtual firewall as each subnet's gateway, and its fixed topology is simple to administer. Logical segmentation builds subnets with VLANs or addressing schemes and is more flexible because it needs no rewiring. A VLAN is a broadcast domain isolated at the data link layer: one physical LAN can hold several VLANs, and devices on different physical LANs can share one.
Subnetting relieves congestion caused by too many hosts on one network. In CIDR notation the number after the slash counts the leading network bits of the 32-bit address, so 192.168.99.0/24 leaves 8 host bits and /16 equals mask 255.255.0.0. Classless prefixes replaced three fixed class sizes with any power-of-two block. RFC 1918 private space needs no IANA or registry coordination, so many enterprises reuse it internally.
Microsegmentation controls are agent-based, using software on each workload, network-based, using load balancers, switches, SDN and overlays, or native cloud controls such as an Amazon security group or Azure firewall. Containers and Kubernetes workloads come and go in seconds with ephemeral IP addresses, making IP-based rules unworkable, so microsegmentation writes policy with identities or attributes such as env=prod or app=hrm and updates it automatically.
Stateful firewalls are also called stateful inspection, stateful packet and dynamic packet filtering firewalls. They watch the connection initiation, typically the TCP three-way handshake, and record each connection as open, established or closed in a state table. A packet matching an approved connection passes; one matching no entry is checked against the rules. Stateful suits complex, dynamic networks, while cheaper stateless firewalls can suit small businesses without sensitive data.
The term firewall began as building partitions that confine fire. First-generation stateless packet filters gave way in the early 2000s to stateful firewalls, the second generation, and next-generation firewalls became the third. Unified threat management put stateful inspection, a web proxy with antivirus and a separate IPS in one box, but without native integration, causing gaps and complex policy. Stateful failover keeps active sessions; stateless failover drops them.
A next-generation firewall identifies and controls applications, users and content beyond ports and protocols, integrating firewall, intrusion prevention and threat detection for in-line protection. NGFWs arose in the late 2000s when applications shared ports or tunneled through SSL, hiding which application was running. Traditional firewalls often judge only a session's first packet and can only allow or block, so they cannot separate collaboration from exfiltration in one cloud storage app.
URL filtering compares web traffic with a categorized database: local lookups cover a limited set of frequently visited sites for low latency, a master cloud database covers the newest sites, and caches hold recent results. Once used to keep staff off unproductive sites, it now blocks malware and phishing categories. Stand-alone filtering cannot coordinate with an IPS or sandbox, and a secure web gateway combines URL filtering, malware scanning and content inspection.
A forward proxy acts for internal clients toward the internet, while a reverse proxy routes outside requests to backend systems. A business proxy keeps the client session open and opens a second connection to the destination, gaining full visibility for decryption and inspection. Transparent proxies need no user settings yet still inspect and log. Anonymous proxies mask a user's IP address and are consumer tools, and a plain proxy mainly conceals addresses and caches content.
A corporate VPN relies on a gateway at the network edge bridging internal and external networks, plus client software that starts the connection. A session begins with user authentication, then a handshake choosing protocol version and cipher suite, agreement on a tunneling protocol such as IPsec or L2TP, and a key exchange, often Diffie-Hellman, which creates a shared key without sending it. The client then receives an address from a pool.
SSH secures remote login over an insecure network through three stacked protocols. The transport layer protocol, usually over TCP, provides server authentication, confidentiality and integrity. The user authentication protocol runs over it and authenticates the client-side user to the server. The connection protocol runs on top and multiplexes the encrypted tunnel into several logical channels. At a VPN tunnel's end, by contrast, the server decrypts, strips encapsulation and forwards the original data.
A TLS handshake starts with the hello exchange: the ClientHello lists supported versions, cipher suites and random bytes, and the ServerHello picks the highest common version and strongest shared suite. A cipher suite names the algorithms for key exchange, encryption and message authentication. Random nonces from both sides stop a recorded handshake being replayed. TLS 1.3 removed RSA key transport and SHA-1 and made perfect forward secrecy mandatory.
IKE automates negotiation of IPsec Security Associations: Phase 1 builds a trusted channel using Main or Aggressive Mode, and Phase 2 sets the SAs that protect tunnel data; IKEv2's MOBIKE keeps a VPN up across network changes. Authentication Header gives integrity without encrypting the payload, while ESP also encrypts it and allows NAT traversal. IPsec uses UDP port 500 to negotiate keys and UDP port 4500 when NAT is involved.
Data loss prevention covers data in use, in motion and at rest. It starts by discovering and classifying sensitive information, then monitors, enforces and tunes in a cycle. Exact data match fingerprints structured records and indexed document match fingerprints documents for higher accuracy than regular expressions. DLP also weighs context and behavior, such as a surge of uploads, and can block, quarantine, encrypt or demand justification, logging every decision.
Endpoint DLP runs on user devices and watches USB copying, printing, screenshots and clipboard use. Cloud DLP scans files already stored in SaaS applications through APIs, and a CASB or security service edge adds inline control of uploads and sharing. DLP cannot always see encrypted or obfuscated traffic and does not control data after it legitimately leaves managed environments, so information and digital rights management protections travel with the file.
A secure enterprise browser is a managed browser that protects data, controls access and enforces policy on the user's device, with single sign-on integration and a familiar Chromium-based experience. It gives contractors on unmanaged devices controlled access without full device management, replaces VDI for users who mainly need web apps, and enforces policy on traffic network tools cannot decrypt, such as QUIC or some Microsoft 365 flows.
Because users read and share data in the browser, an enterprise browser applies last-mile controls: masking data, blocking screenshots, restricting uploads and watermarking, adapted to content, identity and context. It can also catch sensitive data typed into generative AI tools in real time, before it leaves. Remote browser isolation differs: it runs the session in a remote container and sends only a sanitized view, so website code never executes on the device.

Domain 4: Endpoint Security

Key concepts you must know · 36 practice questions

An endpoint is any physical or virtual device that connects to a corporate network and terminates data exchange, such as a laptop, server, smartphone or IoT sensor. Categories are user devices, server and cloud workloads including containers and serverless functions, operational technology and IoT. Remote work and cloud access dissolved the network edge, so every device reaching company resources is its own security boundary and the most common entry point.
IT manages electronic data, while operational technology (OT), such as industrial control systems and SCADA, controls physical processes in manufacturing, energy and telecommunications. IT security puts data confidentiality first; OT security puts safety and availability first, because failed equipment has safety and financial consequences. IT is inherently connected, OT was traditionally isolated, and the industrial internet of things (IIoT) is bridging the two.
IoT security addresses weaknesses from limited device controls, diverse connectivity and inconsistent updates. An insecure industrial IoT device can disrupt production, damage equipment or compromise safety, not only data. The Internet of Medical Things covers connected devices, from wearable monitors to infusion pumps, that act on health data. Zero Trust for IoT means discovering, identifying and authenticating devices, defining policy and segmenting them, and assessing them continually, without agents.
Securing endpoints supports protection against diverse threats, data integrity and confidentiality, regulatory compliance, operational continuity and risk mitigation. Endpoint security works in three steps: prevention with antivirus, firewalls and intrusion prevention; detection with tools such as endpoint detection and response for incidents that bypass prevention; and response and remediation, which isolates affected endpoints, removes malware and restores systems.
A comprehensive endpoint solution protects unpatchable legacy systems by preventing exploitation of known or unknown vulnerabilities, and turns threat intelligence into prevention automatically by correlating outside and in-house data and distributing protections. Since no enterprise can block every attack while staying productive, prevention is paired with detection and response. At the endpoint, Zero Trust means continuously verifying device posture, identity and application health to limit lateral movement.
Modern endpoint security uses a client-server model: a central management console, on a server or in the cloud, enforces policy, while a lightweight agent on each endpoint sends telemetry and receives updates in real time. Endpoint protection platforms continuously monitor behavior, analyze anomalies and respond automatically, often before a human steps in, using machine learning and threat intelligence to catch fileless malware, ransomware and zero-day exploits.
Network controls such as firewalls and IPS act as border guards between segments, while endpoint tools on the device give final-stage protection after a threat passes the perimeter, which matters for remote laptops on insecure connections. A firewall allows or blocks connections and does not scan files; antivirus detects, quarantines and removes malicious code. Because spyware must send its data out, network controls can block its communications.
Antivirus became common in the 1990s, when signature detection stopped most file and disk threats. By the early 2000s attackers tested code against antivirus before release, so most new exploits went undetected at first, and by 2010 products caught only a fraction of active malware. Next-generation antivirus added detection beyond signatures and is no longer standalone: its techniques now sit inside endpoint protection platforms.
Patch management and vulnerability assessment find and fix flaws before attackers exploit them, and automated deployment closes gaps faster. For security teams patching is a frontline defense; for IT operations it keeps systems stable. A hotfix is an urgent patch deployed rapidly for a critical flaw, often skipping standard testing. When an emergency patch for an exploited zero-day ships, defenders race attackers scanning for unpatched systems.
A host-based firewall checks every incoming and outgoing packet against rules on IP addresses, ports and protocols, blocking disallowed or unmatched traffic. Running on the device, it protects a laptop the same way on public Wi-Fi or at a client site, and can limit insider risk by restricting activity by application, user or role. Its rules need regular updates, and it can produce security logs for monitoring.
Host-based firewalls consume the host's resources, are hard to keep consistent across many devices and can be disabled by local malware or users, unlike gateway firewalls. Device control regulates removable media and peripherals such as USB ports to stop data theft and malware. Mobile device management and unified endpoint management enforce policy on BYOD and remote devices, and UEM unifies laptops, phones, tablets and IoT in one platform.

Domain 5: Cloud Security

Key concepts you must know · 58 practice questions

NIST SP 800-145 builds its cloud model from five essential characteristics, three service models and four deployment models. Broad network access means capabilities are reached over the network by phones, tablets, laptops and workstations through standard mechanisms. Measured service meters storage, processing, bandwidth or active accounts for both parties. A cloud infrastructure has a physical hardware layer and a software abstraction layer above it.
NIST deployment models are defined by who the infrastructure serves. A private cloud is dedicated to one organization, on premises or hosted, and typically offers more control and security. A public cloud is open to the general public, usually from vendors such as AWS, Microsoft Azure or Google Cloud, offering cost savings and flexibility. A community cloud serves only organizations with shared mission, security, policy or compliance concerns.
A hybrid cloud binds two or more distinct private, community or public clouds that stay separate but share technology enabling data and application portability; NIST's example is cloud bursting, shifting peak load to a public cloud. Hybrid security needs controls that work in both environments and secure transfer between them. Cloud traits can clash with security: segmentation versus shared resources, process-oriented security versus dynamic environments.
Under NIST, SaaS lets the consumer use the provider's applications through a thin client such as a browser, as with web-based email, managing nothing beneath them except limited user settings. IaaS, also called hardware as a service, lets the consumer provision processing, storage and networks to run arbitrary software including operating systems, controlling the OS and applications and possibly some networking components such as host firewalls.
PaaS lets the consumer deploy applications it created or acquired with the provider's supported languages and tools, while the provider keeps the network, servers, operating systems and storage; the consumer controls its applications and possibly hosting settings. Developers use it to build, compile and run programs. Multitenancy means tenants share one application instance while each tenant's data and configuration stay logically separated, lowering costs.
Network as a service delivers enterprise network infrastructure by subscription, removing the work of buying, deploying and managing network hardware, and can replace VPNs, MPLS connections and firewalls. It can be a managed service, where the provider maintains subscribed hardware, rented provider-owned hardware the customer installs and runs, or fully outsourced operations. Among migration strategies, repurchasing replaces an application with a cloud equivalent such as SaaS.
The shared responsibility split depends on the service model: in IaaS the customer manages more, including operating systems and applications, while in SaaS the provider handles more. In a private cloud in its own data center, the organization owns everything, including the hypervisor. Managed databases hide infrastructure but still need customer access controls and encryption. Organizations should define each internal team's cloud security duties clearly.
Security and compliance teams must enable the business without becoming a bottleneck, and end users must follow cloud governance and guard entrusted data as their own. Third-party SaaS apps connected by APIs bring risk the customer inherits but cannot fix when vendors patch slowly. Virtualization simulates hardware so several operating systems share one computer, and the hypervisor manages each virtual machine's guest OS and its access to hardware.
A container is a lightweight, portable, self-sufficient unit packaging an application with its dependencies, libraries and runtime, so it runs the same anywhere. Because containers abstract the application from the host OS, they deploy without special host configuration if the container runtime is supported. Cloud native means building applications to exploit cloud delivery, using containers, serverless functions, PaaS and microservices that are loosely coupled to infrastructure.
A microservices application consists of small, loosely coupled services, each with a distinct business function, communicating mostly through RESTful APIs. Unlike a monolith, where one change means updating everything, each service deploys independently, only busy services are scaled, and one failure rarely stops the application. NIST defines an API as an access point with well-defined syntax, and an API gateway is a reverse proxy handling routing, authentication and rate limiting.
A cloud native security platform (CNSP), which Gartner calls a cloud native application protection platform (CNAPP), is a unified platform spanning the CI/CD lifecycle. It arose because security tools did not fit developer-driven, API-centric cloud work and stitched point products could not keep policy consistent. A CNSP shares context across components, gives SecOps and DevOps unified visibility and automates remediation across build, deploy and run.
CNSP tenets include asset inventory, which discovers resources across accounts and providers and keeps an audit trail of each asset's changes; network security, which ingests provider flow logs, threat intelligence and cloud firewall rules; and IAM security, which builds machine learning behavior profiles, known as UEBA, to flag signs of compromised credentials. Vulnerability management stack-ranks risks across containers, images, hosts and functions.
CNSP automated investigation and response integrates directly with SOAR and draws on contextual data, forensics and machine learning to speed investigations. Immutable infrastructure replaces components instead of modifying them after deployment, reducing configuration drift and making deployments predictable and repeatable. Continuous integration means developers merge code into a central repository often, with automated builds and tests after each merge to catch integration errors.
Continuous delivery automates the pipeline but keeps the final push to production manual as a safety net, while continuous deployment releases every passing change automatically. CI/CD is the backbone of DevOps, bridging development, testing and operations with shared responsibility for quality. In Kubernetes-native pipelines, RBAC limits each stage's permissions to shrink the blast radius, and monorepo pipelines build and test only affected projects.
A standard pipeline runs source, build, test and deploy stages. The source stage watches version control such as Git, Mercurial or Subversion and triggers on each commit. The build stage compiles code into executable artifacts; the application is then packaged, for example as a Docker image, and pushed to a registry. The test stage runs unit, integration and end-to-end tests before deployment.

Domain 6: Security Operations

Key concepts you must know · 52 practice questions

Security operations has four functions. Identify recognizes an alert as potentially malicious and opens an incident. Investigate finds the root cause, such as how malware arrived, and the impact, such as which systems were touched. Mitigate recommends options to isolate and remove the threat, such as disconnecting and wiping a laptop. Continuous Improvement keeps adapting process, visibility and technology in real time as incidents occur.
Effective security operations rest on the People, Process and Technology model, which treats security as a holistic function rather than a pile of tools. The SOC is the centralized command hub, virtual or physical, often staffed around the clock. Continuous monitoring, 24/7 visibility into network, endpoint and cloud activity, is the backbone of SecOps, and SecOps convergence joins security and IT operations teams.
Operations security (OPSEC) protects critical information before any incident in five steps: identify critical information, analyze threats, analyze vulnerabilities, assess risks by probability and impact, and apply countermeasures. Forensic analysis happens after an incident: the team examines systems and logs, recovers deleted data and sometimes reverses malware to build an attack timeline that improves defenses and supports legal or regulatory reporting.
A risk-based approach finds gaps in security strategy and sets remediation priorities by assigning risk levels to vulnerabilities. The modern way to scale a SOC is automation built on AI and machine learning, which handles bulk low-risk alerts so analysts focus on a few high-impact incidents. NIST CSF 2.0 has six functions, Govern, Identify, Protect, Detect, Respond and Recover, with Govern newly added to tie security to enterprise risk.
Alert fatigue comes from floods of non-actionable alerts, often caused by poorly tuned rules, generic signatures and missing context that fire on benign activity. Analysts become desensitized and real threats get lost, and attackers exploit this with SEO poisoning, malvertising and fake browser prompts that generate low-level or misclassified alerts. NIST defines a false positive as an alert wrongly indicating a vulnerability, statistically a type 1 error.
Two remedies for alert fatigue recur. Suppression and deduplication collapse redundant alerts that several tools, such as a SIEM, an EDR tool and a firewall, raise for the same event, leaving only unique, actionable notifications. Refining alert thresholds lowers rule sensitivity for common benign activity, which requires a deep understanding of the organization's baseline behavior, since a team cannot ignore normal activity without knowing what normal is.
NIST defines an incident response plan as documented, predetermined instructions to detect, respond to and limit the consequences of cyber attacks. The core team draws on security operations, security management, legal and privacy, with an extension team such as HR, marketing, physical security and law enforcement liaisons. Ransomware, malware, denial of service, customer data breaches and critical insider threats warrant immediate activation, and the plan is reviewed at least yearly.
An incident response plan should also be reviewed after major environment changes and after each simulated or real use. Its recovery section explains how normal operations are restored, typically by referencing a disaster recovery plan or runbooks. Its deactivation section sets criteria for formally ending the response once the incident is contained and recovered. A communications plan defines tools, templates, timing, owners and audiences.
DevSecOps and DevOps are mindsets that create a culture, not tools or processes; in DevSecOps everyone in software delivery puts security first in every decision. Security reviews used to come after development, sometimes once code was in production, which became inefficient and dangerous at cloud speed. Within a SOC, the security engineer or architect designs and implements protections such as firewalls, intrusion detection systems and antivirus.
Syslog, defined in RFC 5424, conveys event notification messages, and its layered architecture lets any transport protocol carry them; NIST calls it a protocol specifying a log entry format and transport mechanism. An originator generates syslog content, and a relay accepts messages from originators or other relays and forwards them to collectors or further relays. Originator, relay and collector roles can reside on one system.
Syslog severity runs from 0, Emergency, to 7, Debug, so a lower number is more severe; 3 is Error. The Facility value, 0 to 23, names the source type, such as kernel (0), mail (2), security and authorization (4) and local use (16 to 23). The Priority value is the Facility times 8 plus the Severity, so Facility 4 with Severity 2 gives 34.
Security event management (SEM) aims to separate normal activity from suspicious behavior and supports compliance with audit trails and reports. Log management collects and stores logs with retention and basic search but may lack real-time detection. A SIEM adds real-time correlation using if-then rules, alerting and incident workflows, often with UEBA and SOAR add-ons, yet still relies on human analysts to investigate and respond.
Gartner defines SOAR by three capabilities: threat and vulnerability management, security incident response and security operations automation. Automation is machine execution of a security action without human intervention; orchestration is machine coordination of a series of interdependent actions across many tools. SOAR ingests alerts SIEMs often miss, such as vulnerability scans, cloud and IoT alerts, easing deduplication, and runs playbooks that cut resolution time.
Early SIEMs relied on static rules and signatures, producing many false positives and missing threats that fit no rule, so AI and machine learning were added to analyze large datasets in real time. They support collection, normalization, which converts differing log formats into one consistent model, and enrichment, which adds context such as threat intelligence. They also filter alert noise so only credible threats reach analysts.
AI-powered SIEMs can respond automatically, blocking suspicious connections or quarantining a device where malware is found. Next-generation SIEMs use machine learning on past incidents to predict similar attacks and defend preemptively. Machine-learning incident scoring ranks incidents by risk so analysts open the most dangerous first. Over-automation, however, reduces human vigilance, and teams relying entirely on AI may miss novel attacks it was never trained on.

Domain 7: Identity Security

Key concepts you must know · 77 practice questions

Identity lifecycle management (ILM) runs from provisioning, which creates the account and assigns its initial role and entitlements, through modification to deprovisioning. On a role change, ILM performs a delta sync, granting new access and removing old access to prevent privilege creep. Accounts not revoked at departure become abandoned identities attackers exploit. ILM also gives machine identities owners and automated secret rotation, and ends manual onboarding delays.
Access certification is a governance process in which designated reviewers confirm or remove each user's rights, clearing permissions accumulated through role changes and producing audit trails. Multifactor authentication needs at least two factors from different categories, so a password plus a security question is still only something you know, while an authenticator app code adds something you have. All 2FA is MFA, but MFA allows three or more factors.
An MFA flow verifies the primary factor, usually a password, then the second factor, and grants access only after both succeed, often holding a session that policy may interrupt for sensitive actions or time limits. Adaptive MFA weighs device posture, location, IP reputation and behavior, stepping up checks for risky logins and cutting prompts and MFA fatigue for normal ones. Passwordless authentication replaces the knowledge factor with a biometric, device or hardware key.
In single sign-on, the identity provider (IdP) verifies the user, the service provider is the application being reached, and a federation protocol such as SAML or OpenID Connect lets them trust each other. The app redirects the user to the IdP, which authenticates, often with MFA, and returns a signed assertion. A compromised SSO account has a bigger blast radius. NIST defines identity federation as organizations following a shared trust framework.
Active Directory authenticates mainly with Kerberos, authorizes through groups and permissions, and often uses LDAP for lookups. A domain shares one directory database and policies, a tree holds domains with a contiguous namespace, and a forest is the top boundary. Organizational units group objects so administration can be delegated. Domain controllers host the directory and handle authentication, making them Tier 0 assets, and Group Policy Objects push consistent settings to endpoints.
Role-based access control (RBAC) attaches permissions to roles reflecting job functions, optionally inherited through a role hierarchy, so a job change means swapping roles rather than editing a person's rights. Other models are discretionary, where the owner decides, mandatory, and attribute-based, which evaluates user, resource and environment attributes such as time and location. In Kubernetes, administrators define roles and bind them to users, groups or service accounts.
Least privilege, also called minimum privilege or least authority access, gives a user or group only the permissions a task needs. Zero Trust is related but distinct: it grants no rights until an entity is verified as trustworthy, and least privilege then limits that entity to its role. In a shared cloud, IAM roles keep developers on dev/test VMs and engineers on production VMs, limiting what a compromised account exposes.
Privileged access management (PAM) replaces passwords kept in spreadsheets or shared files with a central, audited gateway. Credentials live in an encrypted vault, and users receive a temporary token or an injected credential instead of the password. Well-known admin passwords rotate after every use to stop reuse, and SSH keys are vaulted and rotated on a schedule. A PAM program starts by discovering every elevated account, including forgotten shadow accounts.
Shared local administrator passwords enable pass-the-hash, where attackers reuse stolen credential hashes to log in elsewhere without the cleartext password. Auditing privileged session logs exposes shadow admins holding unintended high access, and secrets vaults can integrate with PAM to monitor and end admin sessions. Enterprise browsers add in-browser controls for privileged users and insider leakage, such as blocking uploads to personal drives, preventing copy-paste and watermarking sessions.
Just-in-time (JIT) access follows a justified request with identity verification, often MFA, and policy checks of context, then approval, automatic for low-risk tasks or manual and time-bound for sensitive ones, temporary provisioning and monitoring. Session brokering prevents direct connections, ephemeral credentials are destroyed after use, and access is revoked at expiry, completion or a policy violation. Modern PAM makes JIT the default, achieving zero standing privilege.
A root certificate is self-signed, its subject matching its issuer, and acts as a trust anchor in trust stores kept by vendors such as Google, Apple and Microsoft. Enterprise PKIs keep the root CA offline and let intermediate issuing CAs handle daily issuance. Path validation starts at the leaf and moves upward, verifying each signature with the issuer's public key, checking validity dates and possibly revocation through CRL or OCSP.
A certificate authority receives a key pair owner's certificate signing request (CSR), validates identity or domain ownership, then signs a certificate binding that identity to the public key. ACME automates issuance, installation and renewal. The most common chain error is a leaf installed without its intermediate bundle: browsers often fetch it, but non-browser clients abort. Browsers do not trust self-signed certificates by default, and their revocation is impractical.
An X.509 certificate binds a distinguished name to a public key anyone can see, while the private key stays secret; its theft allows full impersonation and decryption, mitigated by HSMs and strict access controls. Code signing proves authorship and integrity, unsigned software triggers Unknown Publisher warnings, and signing should be mandatory in CI/CD. PKI also secures S/MIME email and smart-card logins, and SHA-1 should give way to SHA-256.
Secrets are authentication credentials such as passwords, API keys, tokens, SSH keys, private certificates, encryption keys and database credentials. Secrets sprawl is their uncontrolled spread across repositories, chats and spreadsheets, and every third-party API integration adds more. Developers often share .PEM files and SSH keys in cleartext. Non-human identities, the machine identities software uses, need owners, vaulting, rotation, JIT policies, reviews and revocation when projects end.
Short-lived credentials and regular rotation mean a stolen secret works only briefly, and every secret access should be logged with requester, time and secret. Kubernetes secrets are only base64-encoded, which is not encryption, so they need RBAC and etcd encryption at rest. OWASP CICD-SEC-6 covers poor credential hygiene such as hard-coded credentials and shared keys, and CICD-SEC-4, poisoned pipeline execution, abuses repository access to reach pipeline secrets.
Pipeline credentials that are never rotated keep widening the set of people and artifacts with valid access, and deploy keys often go unrotated for years. An attacker who finds an exposed credential, such as one in a container image, first validates it from a disposable system, then gains access, escalates or moves laterally and exfiltrates data. Defenses inject secrets at run time and vault those used by Ansible, Jenkins and Docker.

Palo Alto Cybersecurity Apprentice exam tips

Drill the look-alike pairs that recur across Cybersecurity and Security Operations: exploit versus malware, zero-day vulnerability versus exploit versus attack, password spraying versus credential stuffing versus dictionary attack, model poisoning versus adversarial attack, HIDS versus NIDS, signature versus anomaly detection, security automation versus orchestration, and log management versus SEM versus SIEM versus SOAR.
Memorize the small set of numbers and fixed values that networking and operations topics rely on: the /24 and /16 prefix lengths and their masks, RIP's 15-hop limit and metric 16, the 0.0.0.0 default route, IPsec's UDP ports 500 and 4500, syslog severity 0 to 7, and the Priority formula of Facility times 8 plus Severity.
Learn ordered sequences step by step, because scenarios often name one step and ask what comes before or after it: the attack lifecycle and lateral movement stages, the DHCP discover-offer-request-acknowledge exchange, the DNS root-TLD-name server lookup, VPN session setup, IKE Phase 1 and Phase 2, CI/CD stages, the JIT access flow, certificate issuance and leaf-to-root path validation.
For every control, know what it does not do as well as what it does: an IDS alerts but does not block, a firewall does not scan files, AH does not encrypt the payload, DLP does not govern data after it legitimately leaves, base64 is not encryption, NDR reads metadata rather than payloads, and correct credentials alone do not satisfy Zero Trust.
Practice classifying short scenarios by the single detail that decides them: north-south versus east-west traffic, which SOC function an analyst is performing, which insider type fits, which cloud deployment or service model is described, who owns a task under shared responsibility, and whether a Zero Trust component decides, carries out or enforces access.

Study guide FAQ

What does the Palo Alto Networks Certified Cybersecurity Apprentice exam cover?

Seven domains: Cybersecurity (vulnerabilities, exploits, the attack lifecycle, attack types, detection and prevention systems and Zero Trust), Network Fundamentals (LAN, WAN, SD-WAN, traffic flows, default gateways, NAT, DNS, DHCP, routing and the OSI and TCP/IP models), Network Security (segmentation, stateful firewalls and NGFWs, URL filtering, proxies, VPNs, tunneling protocols, DLP and enterprise browsers), Endpoint Security (endpoints, IoT and OT, objectives and components), Cloud Security (deployment and service models, shared responsibility, cloud terms, CNSP and CI/CD), Security Operations (SOC functions and optimization, incident response, alerts, syslog, SIEM, SOAR and AI) and Identity Security (lifecycle, MFA, SSO, directories, RBAC, privileged access, certificates and secrets).

What score is needed to pass?

Palo Alto Networks sets the passing score at 860 on a scale of 300 to 1000. It does not publish an official question count or exam length, so measure preparation by how consistently you can explain each concept and tell similar concepts apart rather than by a target number of items.

Do I need hands-on experience with Palo Alto Networks products?

No. The blueprint is entry level and vendor-agnostic, aimed at students, career changers and non-technical professionals. The concepts come from general definitions in NIST publications, IETF RFCs and Palo Alto Networks Cyberpedia articles, so the focus is on understanding terms, how technologies differ and what each control does, not on configuring any product.

How do Zero Trust and least privilege differ?

They are related but distinct. Zero Trust grants no access rights to any user, device, workload or AI identity until it has been verified as trustworthy, and it keeps evaluating each request using context such as identity, device posture, location and data sensitivity. Least privilege applies after trust is established, limiting that entity to the minimum permissions its role or task requires. Just-in-time access extends the idea by granting privileges only for a limited time.

Official exam sources

The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.

Palo Alto Networks - Cybersecurity Apprentice datasheetBlueprint revised MAY 2026 · link and content verified 25 October 2026Seven domains totalling 100%: Cybersecurity 16%, Network Fundamentals 16%, Network Security 14%, Endpoint Security 10%, Cloud Security 13%, Security Operations 13%, Identity Security 18%; entry-level, vendor-agnostic audience (students, career changers and non-technical professionals).
Palo Alto Networks - certification handbooklink and content verified 22 October 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own internal threshold, not the vendor figure.

The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 60 minutes and 50 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.

Related Palo Alto resources

Test yourself: 426 Palo Alto Cybersecurity Apprentice practice questions

Palo Alto Networks Certified Cybersecurity Apprentice Study Guide