Apprentice Paloalto Networks Palo Alto Networks Cybersecurity Apprentice Free Practice Exam Questions (2026 Updated)

Network as a Service is a cloud service model in which networking capabilities are delivered on demand rather than owned and operated entirely through fixed physical infrastructure. NaaS can include virtual routing, secure connectivity, bandwidth services, policy enforcement, remote access, and other network functions consumed as a service. The key concept is elasticity: the customer uses network resources when needed while the provider operates much of the underlying service delivery platform. Answer B describes a monitoring application, not a service model. Answer C describes a traditional enterprise-owned network model, which is the opposite of NaaS. Answer D describes protocol standardization, not cloud-delivered networking. NaaS reflects the broader cloud pattern of abstracting infrastructure into consumable services. In security architecture, NaaS can support distributed users, cloud workloads, and branch connectivity without requiring all enforcement to sit in a single physical data center. Reference/topics: Cloud Security 5.2, cloud service models including NaaS; Network Fundamentals 2.1, SD-WAN and area networks.

A next-generation firewall and an intrusion prevention system are the strongest choices for securing a data center against network-based threats. An NGFW provides application-aware policy enforcement, traffic inspection, segmentation support, and threat prevention capabilities at network control points. An IPS is designed to inspect traffic inline and block malicious packets before they reach protected systems. IDS technology is useful for monitoring and alerting, but a traditional IDS is normally passive and does not directly prevent traffic from reaching a target. A proxy can mediate certain types of traffic, especially web traffic, but it is not the broadest or most direct answer for data center infrastructure protection against network-based threats. Data centers require controls that can inspect both north-south and east-west traffic, enforce policy, and stop exploit attempts or known malicious patterns. NGFW and IPS capabilities are therefore aligned with preventive infrastructure security. Reference/topics: Network Security 3.2, NGFWs; Cybersecurity 1.5, intrusion prevention systems and firewalls.

Batch 3 — Questions 26–40

A hybrid cloud model combines private cloud or private infrastructure with public cloud resources. It allows an organization to keep sensitive workloads or data in a controlled private environment while using public cloud capacity for elasticity, scalability, geographic reach, or cost optimization. This model is common when organizations have regulatory requirements, legacy systems, or sensitive datasets that cannot be moved fully into a public cloud, but still need the flexibility of public services. A public cloud is shared provider-operated infrastructure available to many customers. A private cloud is dedicated to one organization but does not inherently provide public cloud scalability unless integrated with it. A community cloud is shared by organizations with common requirements, such as sector-specific compliance needs. Hybrid cloud security requires consistent visibility, identity controls, policy enforcement, and shared responsibility awareness across both private and public components. Reference/topics: Cloud Security 5.1, cloud-computing deployment models; Cloud Security 5.3, shared responsibility model.

An initial action in incident investigation is to identify indicators of compromise, often called IOCs. IOCs are observable artifacts that suggest malicious activity, such as suspicious IP addresses, domains, file hashes, registry keys, process names, login patterns, or unusual network connections. Identifying IOCs helps determine whether an incident exists, what systems may be affected, and what evidence should be collected next. Creating a timeline is important, but it normally depends on first gathering relevant indicators and event data. Writing a threat intelligence report is a later analytical or communication activity. Removing threats from the system is part of containment or eradication and should be performed carefully after enough evidence is preserved and scope is understood. In security operations, moving too quickly to remove artifacts can destroy evidence and weaken understanding of the incident. The investigation process should establish source, scope, impact, and containment priorities. Reference/topics: Security Operations 6.1, investigate and mitigate; Security Operations 6.3, incident response plan.

Batch 4 — Questions 41–55

Dynamic routing protocols improve scalability because routers can exchange route information and automatically adapt to topology changes. In a small network, static routes may be manageable because administrators manually define where traffic should go. As networks grow, manual route maintenance becomes error-prone and operationally expensive. Dynamic protocols allow routing tables to update when links fail, new networks are added, or better paths become available. They do not provide only a default route; they can advertise many routes. They should not be chosen because they increase latency, since the goal is resilient and efficient path selection. Configuration templates may be useful in management platforms, but they are not the core advantage of dynamic routing protocols. From a security and operations perspective, scalable routing supports predictable traffic flow, faster recovery, and cleaner segmentation designs. The key distinction is that routed protocols carry traffic, while routing protocols help determine where that traffic should be forwarded. Reference/topics: Network Fundamentals 2.5, routed protocols and routing protocols.

Antivirus software contributes to endpoint security by scanning files, programs, and sometimes memory or processes for known malware signatures and suspicious patterns. Signature-based detection compares observed files or code characteristics against known malicious indicators. This helps identify viruses, trojans, worms, spyware, and other malicious software before or during execution. Antivirus may also include heuristic or behavioral detection, but the answer specifically identifies known malware signatures, which is a classic antivirus function. Strong password policies are part of identity security, not antivirus. Filtering unsolicited commercial email is a function of email security or spam filtering. Isolating untested applications describes sandboxing or application isolation rather than standard antivirus scanning. Antivirus remains a basic endpoint control, although modern endpoint protection platforms often add behavior analytics, exploit prevention, device control, and response capabilities. The objective is to reduce the chance that malicious files can execute or persist on user systems. Reference/topics: Endpoint Security 4.3, antivirus and endpoint security components; Cybersecurity 1.5, threat prevention practices.

A hub operates at Layer 1, the Physical layer of the OSI model. It repeats electrical or signaling information received on one port out to other ports without understanding frames, MAC addresses, IP addresses, sessions, or applications. Because a hub does not make intelligent forwarding decisions, every connected device receives the same signal, creating a shared collision domain in older Ethernet environments. This differs from a switch, which operates primarily at Layer 2 and forwards frames based on MAC addresses. Routers operate at Layer 3 using IP addressing and routing tables. Layer 4 devices or functions evaluate transport information such as TCP or UDP ports. The purpose of knowing where devices sit in the OSI model is to understand what data each device can inspect and what security decisions it can support. A hub provides connectivity but not meaningful segmentation or filtering. Reference/topics: Network Fundamentals 2.6, OSI model; Network Fundamentals 2.7, devices operating at Layers 1 through 4.

In the cloud shared responsibility model, the provider secures the underlying cloud infrastructure, including physical host servers. These servers are part of the provider-operated environment that supports customer workloads. Customers generally do not manage physical access, hardware maintenance, power, cooling, or the foundational physical network in public cloud services. Virtual machines are usually customer-managed in IaaS because the customer controls the guest operating system, configuration, applications, and data. On-premises connectivity to hosts remains the customer’s responsibility because it involves the customer’s network, VPN, routing, or direct connectivity. Website authentication is an application and identity responsibility controlled by the customer or application owner. The provider secures the cloud; the customer secures what they deploy and configure in the cloud. Understanding this boundary prevents dangerous assumptions, such as believing the provider automatically secures customer workloads or identities. Reference/topics: Cloud Security 5.3, shared responsibility model; Cloud Security 5.2, IaaS and SaaS.

Identity and Access Management, or IAM, defines and manages identities, groups, roles, authentication methods, and permissions in software environments. IAM determines who a user or service is and what resources that identity is allowed to access. It commonly includes user lifecycle management, authentication, authorization, role-based access control, federation, single sign-on, and access policy enforcement. WAN refers to a wide area network and has no direct role in defining user identities. IKE is used to establish authenticated communication channels for IPsec VPNs. DNS translates domain names to IP addresses. IAM is central to modern cybersecurity because identity often becomes the new perimeter in cloud and SaaS environments. If attackers compromise credentials or overprivileged identities, they may access sensitive data without exploiting a traditional network vulnerability. Strong IAM requires least privilege, MFA, access reviews, logging, and proper lifecycle management. Reference/topics: Identity Security 7.1, IAM components; Identity Security 7.1.5, RBAC.

The Presentation layer exists in the OSI model but is not represented as a separate layer in the TCP/IP model. The OSI model uses seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. The Presentation layer is responsible for data formatting, translation, encoding, compression, and encryption-related representation functions. In the TCP/IP model, these responsibilities are generally absorbed into the Application layer rather than separated into their own layer. The Network, Transport, and Application concepts all exist in both models, although naming and boundaries differ. For example, TCP/IP uses an Internet layer that maps closely to the OSI Network layer, and it has a Transport layer for protocols such as TCP and UDP. Understanding these differences matters because security controls often operate at different layers. Palo Alto Networks includes the TCP/IP model and OSI model, as well as devices operating across Layers 1 through 4, in the Network Fundamentals domain. Reference: Cybersecurity Apprentice Datasheet, Network Fundamentals 2.6 and 2.7.

An exploit is a technique, code path, or attack method that takes advantage of a vulnerability. A buffer overflow attack is an exploit because it abuses improper memory handling to overwrite memory and potentially execute malicious code, crash a process, or alter program behavior. Misconfigured access control is a vulnerability: it is the weakness that may allow unauthorized access. Unpatched software is also a vulnerability because known flaws remain present. An exposed password is a credential exposure or security weakness, not the exploit itself. The distinction is essential: vulnerabilities are conditions, exploits are methods that use those conditions, and attacks are the broader malicious actions performed by threat actors. Defenders reduce exploitability by patching, secure coding, configuration hardening, input validation, exploit prevention, segmentation, and monitoring. Reference/topics: Cybersecurity 1.1, vulnerabilities and exploits; Cybersecurity 1.5, threat prevention practices.

A Wide Area Network, or WAN, connects systems, offices, users, or data centers across large geographic areas. WANs commonly link branch offices to headquarters, cloud resources, remote sites, or regional facilities. This distinguishes a WAN from a LAN, which is usually limited to a local environment such as a building, office, or campus segment. A PAN, or Personal Area Network, covers a very small range around an individual user, such as Bluetooth-connected personal devices. A SAN, or Storage Area Network, is a specialized network for storage access and is not defined by large geographic coverage in the same way as a WAN. WAN knowledge is foundational for cybersecurity because security teams must understand how traffic traverses distributed environments, how remote sites connect, and where controls such as VPN, SD-WAN, firewalls, and routing policies apply. Palo Alto Networks lists area network types, including WAN, LAN, and SD-WAN, as part of the Network Fundamentals blueprint. Reference: Cybersecurity Apprentice Datasheet, Network Fundamentals 2.1.

Two of the four Cs of cloud-native security are Code and Clusters. The four-Cs model is commonly used to organize cloud-native security responsibilities across layers: cloud, cluster, container, and code. Code is the application logic and dependencies that developers produce, and it must be secured through review, scanning, dependency management, and secrets control. Cluster refers to the orchestration environment that runs workloads, commonly Kubernetes, and must be secured through access control, configuration hardening, network policy, and runtime monitoring. Configurations are extremely important in cloud security, but “Configurations” is not one of the four Cs in this model. Connections are also important, especially for service communication and network policy, but they are not one of the named four Cs. The model is useful because cloud-native risk is layered: weak code, vulnerable containers, misconfigured clusters, or insecure cloud infrastructure can each become an attack path. Reference/topics: Cloud Security 5.5, CNSP; Cloud Security 5.4, container, microservice, and cloud terms.