Free Practice Questions for Paloalto Networks Apprentice Exam

A clear and well-documented incident response plan reduces the time required to identify, contain, and recover from a breach. During an incident, confusion costs time. A documented plan defines roles, escalation paths, communication requirements, evidence handling, containment steps, decision authority, and recovery procedures. This allows teams to act quickly and consistently instead of improvising under pressure. Increasing log storage may support investigations, but it is not the purpose of the response plan. User identification methods belong to identity security. Code deployment efficiency is a CI/CD concern. Incident response plans also support training and tabletop exercises, allowing teams to rehearse before real attacks occur. After incidents, the plan can be updated with lessons learned so future response improves. The value of the plan is operational readiness: everyone knows who does what, when to escalate, and how to reduce damage. Reference/topics: Security Operations 6.3, incident response plan; Security Operations 6.1, investigate, mitigate, improve.

Batch 7 — Questions 86–100

A false positive occurs when a security control identifies normal or benign activity as malicious. If a firewall categorizes a benign application as malicious, it generates an alert or enforcement decision that incorrectly indicates threat activity. That is the definition of a false positive. A network sensor being unable to identify a custom application is a visibility or classification limitation, but not necessarily a false positive unless it incorrectly labels the traffic as malicious. A tunnel switching routes may be a network event or availability issue. An employee attempting to access an unauthorized application may be a true policy violation, even if it is not malicious. False positives matter because they consume analyst time, reduce trust in alerts, and contribute to alert fatigue. SOC teams reduce false positives by tuning rules, improving context, using baselines, adding allow lists carefully, and refining detection logic. Reference/topics: Security Operations 6.4, false positive and false negative alerts; Network Security 3.2, firewall policy enforcement.

A routed protocol establishes the method used to transport data across networks. IP is the most common routed protocol because it provides logical addressing and packet structure that routers can forward between networks. This differs from a routing protocol, which is used by routers to exchange route information and determine forwarding paths. Answer D describes a routing protocol function, not a routed protocol. Answer B is also closer to route selection, though routing decisions may consider metrics rather than simply “fastest.” Answer A is not a standard definition. Understanding this distinction prevents confusion: routed protocols carry user data, while routing protocols help infrastructure decide where to send that data. Examples of routing protocols include OSPF, BGP, and RIP; they advertise reachability and path information. Routed protocols, such as IP, define how packets are addressed and transported across routed networks. Reference/topics: Network Fundamentals 2.5, routed protocols and routing protocols.

Least privilege means users, services, and systems receive only the permissions required to perform their legitimate duties. This reduces risk because a compromised account or misused identity has a smaller blast radius. For example, an employee who only needs to read reports should not have administrator rights to modify databases or deploy code. Temporary access may be part of just-in-time access, but providing temporary access to all users is not least privilege. Granting permission to all resources is the opposite of least privilege. Giving every user the same access level may simplify administration, but it creates excessive privilege and increases exposure. Least privilege should be enforced through IAM policies, RBAC, privileged access management, access reviews, and strong authentication. It is one of the most important identity security principles because many breaches become severe only after attackers obtain accounts with broader permissions than necessary. Reference/topics: Identity Security 7.2.3, least privilege; Identity Security 7.1.5, RBAC.

Integrating threat intelligence feeds with security technology improves SOC effectiveness by enriching alerts with external context about malicious infrastructure, indicators, tactics, vulnerabilities, campaigns, and attacker behavior. When indicators such as IP addresses, domains, URLs, file hashes, or techniques are correlated with internal telemetry, analysts can prioritize events more accurately and respond faster. Purely reactive response is insufficient because mature SOCs also hunt, tune detections, and improve controls. Focusing only on network traffic creates blind spots in endpoints, cloud services, identities, and applications. Concentrating only on internal data without external threat intelligence limits context and may cause analysts to miss known adversary patterns. Threat intelligence should not be blindly trusted or used without tuning, but when integrated properly, it increases detection quality and reduces investigation time. Effective SOC performance depends on people, process, technology, automation, collaboration, and continuous improvement. Reference/topics: Security Operations 6.2, collaboration and information sharing; Security Operations 6.7, AI and alert analysis.

The Improve function focuses on learning from operations and incidents to strengthen future performance. Updating incident response plans based on lessons learned is a direct example. After an incident, the SOC and response teams should review what happened, what worked, what failed, what was delayed, and which controls or procedures need revision. That feedback can improve playbooks, escalation paths, logging requirements, alert logic, containment steps, and communication plans. Deploying new tools may support improvement, but tool deployment alone is not the core Improve activity. Routine hardware upgrades are IT maintenance tasks. User awareness training is valuable prevention, but the specific Improve function in security operations is more closely tied to operational feedback and process refinement. A mature SOC treats incidents as learning opportunities. The goal is not only to close the current case, but to reduce the chance, duration, or impact of similar incidents in the future. Reference/topics: Security Operations 6.1, Improve function; Security Operations 6.3, incident response plan.

Antivirus software contributes to endpoint security by scanning files, programs, and sometimes memory or processes for known malware signatures and suspicious patterns. Signature-based detection compares observed files or code characteristics against known malicious indicators. This helps identify viruses, trojans, worms, spyware, and other malicious software before or during execution. Antivirus may also include heuristic or behavioral detection, but the answer specifically identifies known malware signatures, which is a classic antivirus function. Strong password policies are part of identity security, not antivirus. Filtering unsolicited commercial email is a function of email security or spam filtering. Isolating untested applications describes sandboxing or application isolation rather than standard antivirus scanning. Antivirus remains a basic endpoint control, although modern endpoint protection platforms often add behavior analytics, exploit prevention, device control, and response capabilities. The objective is to reduce the chance that malicious files can execute or persist on user systems. Reference/topics: Endpoint Security 4.3, antivirus and endpoint security components; Cybersecurity 1.5, threat prevention practices.

Infrastructure as a Service provides cloud-hosted infrastructure resources such as compute, storage, and networking. In IaaS, the customer uses provider-operated hardware resources without owning the physical servers, racks, power, cooling, or data center facilities. The customer typically remains responsible for securing operating systems, applications, data, identities, and workload configurations. PaaS provides a managed platform for developing and deploying applications, where the provider handles more of the runtime environment. SaaS delivers a complete application that customers consume directly. NaaS delivers networking capabilities as a service. The phrase “hardware resources from a cloud service provider” points directly to IaaS because the customer consumes virtualized infrastructure backed by provider hardware. Security teams must understand IaaS because it creates a shared responsibility boundary: the provider secures the physical infrastructure, while the customer secures what they build, configure, and run on top of it. Reference/topics: Cloud Security 5.2, IaaS, PaaS, SaaS, NaaS; Cloud Security 5.3, shared responsibility.

A hub operates at Layer 1, the Physical layer of the OSI model. It repeats electrical or signaling information received on one port out to other ports without understanding frames, MAC addresses, IP addresses, sessions, or applications. Because a hub does not make intelligent forwarding decisions, every connected device receives the same signal, creating a shared collision domain in older Ethernet environments. This differs from a switch, which operates primarily at Layer 2 and forwards frames based on MAC addresses. Routers operate at Layer 3 using IP addressing and routing tables. Layer 4 devices or functions evaluate transport information such as TCP or UDP ports. The purpose of knowing where devices sit in the OSI model is to understand what data each device can inspect and what security decisions it can support. A hub provides connectivity but not meaningful segmentation or filtering. Reference/topics: Network Fundamentals 2.6, OSI model; Network Fundamentals 2.7, devices operating at Layers 1 through 4.

The Installation phase occurs after exploitation, when an attacker attempts to establish persistence on the compromised system. A rootkit is a strong example because it can hide malicious processes, files, registry entries, drivers, or system changes from users and security tools. Its purpose is to maintain access while reducing the chance of detection. Exploiting web application vulnerabilities belongs to the exploitation phase. Brute force attacks against user accounts are credential attacks and may occur before or during compromise, but they are not the best example of installation persistence. Sending spear phishing emails is a delivery or social engineering activity. Persistence mechanisms may include rootkits, backdoors, scheduled tasks, malicious services, startup items, or modified authentication paths. Defenders counter this phase with endpoint detection, integrity monitoring, least privilege, hardening, and incident response procedures that remove persistence artifacts. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, malware and attack types.