Apprentice Paloalto Networks Palo Alto Networks Cybersecurity Apprentice Free Practice Exam Questions (2026 Updated)

A proxy server acts as an intermediary between a client and an online resource. Instead of the user system connecting directly to the destination server, the request is sent to the proxy, which forwards, filters, logs, or inspects the traffic according to policy. This design allows organizations to control web access, enforce acceptable use policies, inspect content, apply authentication, and hide some internal network details from external destinations. A proxy does not increase the processing power of the user’s device. It is not limited to email, although mail security gateways can perform similar intermediary functions for email traffic. It also does not directly connect endpoint agents to web servers as its core function. In security architecture, proxies are useful control points because they sit in the request path and can make decisions before a user reaches a site or downloads content. Reference/topics: Network Security 3.3, proxies and URL filtering; Network Security 3.6, enterprise browsers.

Mitigate is a core security operations function. Security operations teams identify, detect, investigate, mitigate, and improve. Mitigation means reducing the impact or likelihood of an incident, threat, vulnerability, or unsafe condition. In practice, mitigation may include isolating an endpoint, blocking a malicious domain, disabling a compromised account, applying a firewall rule, removing malware, or containing suspicious traffic. Migration is an IT or cloud transformation activity and is not a standard SOC function. Elimination may be a desired outcome in some contexts, but security operations generally uses containment, mitigation, eradication, and recovery language. Orchestrate is related to SOAR tooling, but it describes coordination of automated actions rather than a named security operations function in the objective set. Mitigation is the practical bridge between investigation and recovery: after the team understands enough about the incident, it acts to reduce damage and prevent further spread. Reference/topics: Security Operations 6.1, Identify/Detect, Investigate, Mitigate, Improve.

East-west traffic is internal traffic moving between systems within the same environment or data center. Packets moving between virtual servers across a virtual switch are east-west because they remain inside the data center or virtualized environment. This traffic may never pass through a traditional perimeter firewall unless the architecture specifically routes it through inspection points. Internet-originated traffic to a public IP address is north-south because it enters the environment from outside. Traffic from a virtual desktop to a cloud-based proxy leaves toward an external or cloud service, making it north-south or external service traffic. Traffic from a cloud-based server to a virtual desktop crosses environment boundaries and is not the clearest east-west example. East-west visibility is critical because attackers who compromise one workload often attempt lateral movement to other internal systems. Segmentation, internal firewalls, workload security, and telemetry help control this risk. Reference/topics: Network Fundamentals 2.2, east-west and north-south traffic; Cloud Security 5.4, virtualization.

A VPN, or virtual private network, creates an encrypted connection that secures data transmission between devices or sites over an untrusted network such as the internet. VPNs are commonly used for remote access by employees and for site-to-site connectivity between offices, cloud networks, or data centers. The encryption protects confidentiality and helps prevent interception or tampering while traffic crosses networks not controlled by the organization. A WAN is a broad network spanning geographic areas and is not inherently encrypted. MPLS is a carrier service used for private network connectivity, but it is not by itself the same as an encrypted VPN. A CASB is a cloud access security broker used to enforce security controls for cloud applications. VPNs are important because they extend trusted access across untrusted transport, but they must still be combined with authentication, authorization, segmentation, endpoint posture checks, and monitoring. Reference/topics: Network Security 3.3, VPNs; Network Security 3.4, tunneling protocols.

Antivirus detects and helps prevent malicious software on endpoint devices. It scans files, programs, and sometimes running processes for known malware signatures, suspicious characteristics, or malicious behavior. Antivirus is a core endpoint security component because endpoints are frequent targets for trojans, viruses, spyware, ransomware, and malicious scripts. A VPN secures network communication over an encrypted tunnel, but it does not detect malware on the host. A packet filter enforces network rules, usually based on packet attributes, and is not focused on malicious software detection. A proxy mediates traffic between users and online resources but does not replace endpoint malware protection. Modern endpoint protection often expands beyond traditional antivirus by including behavioral detection, exploit prevention, endpoint detection and response, and host firewall controls. Still, antivirus remains the best answer for detecting and preventing malicious software on a device. Reference/topics: Endpoint Security 4.3, antivirus; Cybersecurity 1.3, malware.

A clear and well-documented incident response plan reduces the time required to identify, contain, and recover from a breach. During an incident, confusion costs time. A documented plan defines roles, escalation paths, communication requirements, evidence handling, containment steps, decision authority, and recovery procedures. This allows teams to act quickly and consistently instead of improvising under pressure. Increasing log storage may support investigations, but it is not the purpose of the response plan. User identification methods belong to identity security. Code deployment efficiency is a CI/CD concern. Incident response plans also support training and tabletop exercises, allowing teams to rehearse before real attacks occur. After incidents, the plan can be updated with lessons learned so future response improves. The value of the plan is operational readiness: everyone knows who does what, when to escalate, and how to reduce damage. Reference/topics: Security Operations 6.3, incident response plan; Security Operations 6.1, investigate, mitigate, improve.

Batch 7 — Questions 86–100

NAT, or Network Address Translation, converts one IP address to another IP address. It is commonly used to translate private internal addresses to public addresses when devices access the internet. NAT can also be used for inbound access to internal services through destination NAT. Some NAT implementations use port address translation, where multiple internal private addresses share one public IP address by tracking different ports, but the fundamental NAT function is IP address translation. Therefore, “IP address to IP address” is the best answer. NAT does not simply convert ports to ports or IP addresses to ports as its main purpose. NAT helps conserve public IPv4 addresses and can hide internal addressing schemes, but it should not be treated as a complete security control. Security still requires firewall policies, logging, segmentation, and threat prevention. NAT changes addressing; it does not decide whether traffic is safe. Reference/topics: Network Fundamentals 2.4, NAT; Network Security 3.2, firewall policy.

A firewall is an inline security control that can inspect traffic destined for a host and determine whether to allow, block, or further analyze it. Modern firewalls, especially next-generation firewalls, can identify malicious traffic using application awareness, threat prevention, signatures, URL categories, and policy context. Quality of service prioritizes or manages traffic performance, not security inspection. Endpoint protection resides on the host and is not primarily an inline network option. A WAN accelerator improves performance over wide area networks but does not serve as the main malicious traffic enforcement device. Inline placement matters because it allows the firewall to stop traffic before it reaches the target. This differs from passive monitoring tools that may alert after seeing suspicious traffic but do not block it directly. Firewalls are foundational network security controls because they define trust boundaries and enforce policy between zones, networks, users, applications, and destinations. Reference/topics: Network Security 3.2, firewalls and NGFWs; Cybersecurity 1.5, firewalls as threat prevention systems.

A core purpose of security operations is investigating security events to determine whether they represent real threats, policy violations, or benign activity. Security operations teams monitor alerts, analyze evidence, investigate suspicious behavior, contain incidents, and improve detection and response processes. Asset tracking is important for security and IT operations, but it is not the main purpose described here. Installing endpoint security software is a deployment task usually handled by endpoint, infrastructure, or IT teams, although the SOC may consume the telemetry. Aligning applications to compliance standards is part of governance, risk, and compliance activities. Security operations is the day-to-day defensive function that turns telemetry into decisions and action. It asks: what happened, what is affected, how severe is it, what should be done, and how can recurrence be reduced? Investigation is therefore central to the SOC mission. Reference/topics: Security Operations 6.1, Identify/Detect, Investigate, Mitigate, Improve; Security Operations 6.3, event and alert.

Command and Control, or C2, is the phase in which compromised systems communicate with attacker-controlled infrastructure to receive instructions, send status updates, download additional payloads, or coordinate malicious activity. This back-and-forth communication allows attackers to operate the compromised device remotely and adapt their actions after initial compromise. Weaponization and Delivery involve preparing and transmitting the malicious payload, not managing an already infected host. Exploitation is the act of using a vulnerability or weakness to gain unauthorized access. Reconnaissance is information gathering before compromise. C2 is especially important in detection engineering because outbound traffic patterns, unusual domains, beaconing intervals, and connections to suspicious infrastructure can reveal that an endpoint is under external control. Blocking C2 can disrupt an attacker’s ability to move laterally, exfiltrate data, or complete actions on objectives. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, command and control as a common attack type.

A vulnerability is a weakness that can be exploited by a threat actor. A code misconfiguration is a vulnerability because it represents an error or unsafe condition in how software, infrastructure, or access is configured. Examples include exposed administrative interfaces, missing authentication checks, overly permissive storage permissions, or insecure default settings. A trojan and a virus are forms of malware, not vulnerabilities. An attack on flawed code is an exploit or exploitation attempt, because it uses the weakness rather than being the weakness itself. The distinction is important: vulnerability is the condition, exploit is the method used to take advantage of it, and threat actor is the entity performing the action. Security programs reduce risk by discovering vulnerabilities, prioritizing them by severity and exposure, and applying remediation such as patching, configuration changes, compensating controls, or access restrictions. Reference/topics: Cybersecurity 1.1, vulnerabilities and exploits; Cybersecurity 1.3, common attack types.

IP subnetting divides a larger IP network into smaller logical networks by changing the subnet mask or prefix length. Because each subnet has a defined address range, subnetting directly limits how many usable host addresses are available inside that segment. For example, a smaller subnet provides fewer assignable private IP addresses, which restricts the number of devices that can be placed in that network. NAT translates addresses between networks, but it does not itself define the size of the internal address pool. Static routing controls forwarding paths and does not limit how many devices can receive private IP addresses. VLANs segment Layer 2 broadcast domains, but the host count is ultimately determined by the IP subnet assigned to that VLAN. In secure network design, subnetting is often paired with VLANs and zones so that addressing, routing, and policy enforcement align cleanly. Reference/topics: Network Security 3.1, network segmentation methods; Network Fundamentals 2.4, NAT; Network Fundamentals 2.5, routing.

Multi-factor authentication uses two or more distinct categories of authentication factors. The standard categories include something you know, such as a password or PIN; something you have, such as a smart card, hardware token, or authenticator device; and something you are, such as a fingerprint or facial biometric. Therefore, “something you know” and “something you have” are valid MFA components. “Something you observe” and “something you create” are not standard MFA factor categories in this context. MFA improves security because a stolen password alone is not enough to authenticate if another independent factor is required. However, not all MFA is equally strong. Push fatigue attacks and phishing can still defeat weak implementations, so phishing-resistant MFA and proper user education are preferred. MFA is one of the most practical identity controls for reducing account takeover risk. Reference/topics: Identity Security 7.1.2, single-factor and multifactor authentication; Identity Security 7.1, IAM components.

A next-generation firewall is designed to inspect traffic at higher layers, including application-layer information, before deciding whether traffic should be forwarded. It can identify applications, users, content, and threats instead of relying only on ports and IP addresses. This application awareness enables more precise policy decisions, such as allowing sanctioned business applications while blocking evasive or risky applications using the same port. A switch forwards frames using Layer 2 information. A router forwards packets based on Layer 3 addresses and routing decisions. A WAN accelerator improves performance over wide area links and does not primarily make application-layer security enforcement decisions. The application-layer capability is what makes NGFW policy more effective than traditional port-based filtering. In modern networks, many applications use web ports, so inspecting only TCP 80 or 443 is insufficient. Reference/topics: Network Security 3.2, NGFWs; Network Fundamentals 2.6 and 2.7, OSI model and network devices.

An exploit takes advantage of a vulnerability. A vulnerability is a weakness in software, hardware, configuration, process, or design that could allow unauthorized access, privilege escalation, data exposure, or system disruption. An exploit is the method or code used to trigger that weakness. An alert is a notification generated by a security tool when suspicious or policy-relevant activity is detected. A threat actor is the person, group, or automated entity conducting malicious activity. An event is an observable occurrence in a system or network, such as a login, file execution, or connection attempt. The exploit-vulnerability relationship is foundational: defenders identify vulnerabilities so they can reduce the opportunity for exploitation. Patching, configuration hardening, input validation, segmentation, and intrusion prevention all reduce exploitability. In simple terms, a vulnerability is the unlocked window; an exploit is the technique used to climb through it. Reference/topics: Cybersecurity 1.1, vulnerabilities and exploits; Security Operations 6.3, event and alert.

When a device or router does not have a more specific route for a destination, traffic is sent to the default gateway or default route. The default gateway acts as the next hop for traffic destined outside the local network when no exact path is known locally. On an endpoint, the default gateway is usually a router interface. On a router, the default route points to another router or upstream path. A VPN gateway may be used for encrypted tunnel traffic, but it is not always the default path. A hub repeats signals and does not make routing decisions. The internet may be the eventual destination path for many routes, but traffic must first be forwarded to the configured default gateway. Default gateways are essential because without them, hosts could communicate only with systems on their local subnet unless specific routes were manually configured. Reference/topics: Network Fundamentals 2.3, function of a default gateway; Network Fundamentals 2.5, routing.

East-west traffic refers to communication that occurs inside an environment, such as between internal hosts, workloads, virtual machines, or servers. A host computer communicating with a virtual machine in the same network is east-west because the traffic stays internal rather than entering or leaving through a perimeter. This type of traffic is especially important in modern data centers and cloud environments because attackers often move laterally after compromising one system. North-south traffic, by contrast, moves between an internal environment and an external network such as the internet. A VM communicating with a host on the internet is north-south. Traffic passing through perimeter-focused defenses is also typically north-south. A host communicating with an infected offsite server leaves the local environment and is therefore not east-west. Security designs increasingly inspect east-west traffic because perimeter defenses alone cannot stop lateral movement once an internal foothold exists. Reference/topics: Network Fundamentals 2.2, north-south and east-west traffic flow patterns.

An incident response plan is the documented strategy that defines how an organization detects, analyzes, contains, eradicates, recovers from, and learns from cybersecurity incidents or disruptive events. It assigns responsibilities, escalation paths, communication rules, evidence-handling expectations, and recovery procedures so that teams can act quickly under pressure. MTTR, or mean time to respond/recover, is a performance metric that measures how long response or recovery takes. MTTD, or mean time to detect, measures detection speed. Security framework alignment helps map controls and practices to recognized standards, but it is not the operational response document itself. A strong incident response plan reduces confusion during an event because teams do not need to invent roles and procedures while an attack is unfolding. It also improves post-incident review by creating a baseline for what should have happened. Reference/topics: Security Operations 6.3, incident response plan and disaster recovery plan; Security Operations 6.1, investigate, mitigate, improve functions.

CI/CD improves the secure development pipeline by making software build, test, delivery, and deployment processes more automated, repeatable, and controlled. Continuous integration encourages developers to merge code frequently into a shared repository where automated tests and checks can run. Continuous delivery keeps software in a deployable state, while continuous deployment can automatically release changes that pass required tests. Security can be embedded into this pipeline through static analysis, dependency scanning, container image scanning, secrets detection, infrastructure-as-code checks, and policy gates. The goal is not merely faster software delivery, but safer and more reliable delivery. Network threat alert potential is a SOC concern, not the primary CI/CD outcome. API interaction optimization may occur in development, but it is too narrow. Storage quotas for code are repository management settings. Secure CI/CD reduces late-stage security surprises and helps organizations detect weaknesses earlier when they are cheaper and easier to fix. Reference/topics: Cloud Security 5.6, CI/CD; Identity Security 7.4.2, CI/CD pipeline secrets.