I85PREP
⌘ K
PANW Cybersecurity Apprentice study materials
PANW Cybersecurity Apprentice study resources

PANW Cybersecurity Apprentice practice questions

One question at a time. Build your PANW Cybersecurity Apprentice understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security

A workstation must reach a public web server on TCP port 443. Which destination port appears in the TCP header of the packets leaving the workstation?

  1. 1024
  2. 443 Correct answer.
  3. 80
  4. 53

Explanation

The destination port identifies the service being contacted on the remote host, so a request to a web server's HTTPS service carries destination port 443. The source port is chosen randomly by the client and does not identify the service.

Question 2Network Security

Which protocol provides connection-oriented, reliable delivery with sequencing and acknowledgment of segments?

  1. UDP
  2. ICMP
  3. ARP
  4. TCP Correct answer.

Explanation

TCP establishes a connection, numbers segments, and requires acknowledgments so lost data can be retransmitted. The other listed protocols either lack reliability mechanisms or are not transport protocols at all.

Question 3Network Security

An administrator wants to confirm the IP address bound to a Windows host's network adapter without sending traffic to a remote device. Which command should be used?

  1. tracert
  2. ping
  3. nslookup
  4. ipconfig Correct answer.

Explanation

The ipconfig utility reports the local adapter configuration, including IP address, subnet mask, and default gateway. The other commands generate traffic toward remote hosts or DNS servers.

Question 4Network Security

Which device forwards frames based on MAC addresses within a single broadcast domain?

  1. Router
  2. Firewall
  3. Load balancer
  4. Layer 2 switch Correct answer.

Explanation

A Layer 2 switch learns MAC addresses per port and forwards frames only to the port associated with the destination MAC. Routers instead forward packets between networks using IP addresses.

Question 5Network Security

What is the primary purpose of NAT on a perimeter device?

  1. Resolving hostnames to IP addresses
  2. Translating private addresses to a routable public address Correct answer.
  3. Assigning VLAN tags to frames
  4. Encrypting traffic between sites

Explanation

Network address translation rewrites private source addresses to a public address so internal hosts can communicate across the internet. It conserves public address space and hides internal addressing, but it is not an encryption or naming service.

Question 6Network Security

Which three-way handshake sequence correctly opens a TCP connection?

  1. ACK, SYN, SYN-ACK
  2. SYN, SYN-ACK, ACK Correct answer.
  3. SYN, ACK, FIN
  4. SYN, FIN, ACK

Explanation

The client sends SYN, the server replies with SYN-ACK, and the client completes with ACK, after which data can flow. The FIN flag belongs to connection teardown rather than establishment.

Question 7Network Security

Which address range is reserved for private use under RFC 1918?

  1. 192.168.0.0/15
  2. 172.32.0.0/12
  3. 172.16.0.0/12 Correct answer.
  4. 11.0.0.0/8

Explanation

RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as private ranges that are not routed on the public internet. The other options fall outside those blocks.

Question 8Network Security

What does a subnet mask of 255.255.255.0 indicate about an IPv4 network?

  1. Only 8 bits are available for host addressing
  2. The first 24 bits identify the network portion Correct answer.
  3. The last 24 bits identify the network portion
  4. The network supports exactly 24 hosts

Explanation

A mask of 255.255.255.0 sets the first 24 bits as the network prefix, leaving the final 8 bits for host addressing. Host capacity is derived from the remaining bits, not from the mask length directly.

Question 9Network Security

A user reports that a browser resolves a hostname but cannot load the page. Which step best isolates whether the problem is name resolution or connectivity?

  1. Flush the DNS cache and retry the page
  2. Renew the DHCP lease
  3. Ping the resolved IP address directly Correct answer.
  4. Disable the browser proxy settings

Explanation

Pinging the resolved IP address tests reachability without relying on DNS, so success points to an application-layer issue while failure points to network connectivity. The other actions do not separate naming from reachability.

Question 10Network Security

An analyst sees many SYN packets arriving from spoofed sources without completing the handshake. Which attack is this?

  1. Ping of death
  2. SYN flood Correct answer.
  3. ARP spoofing
  4. DNS tunneling

Explanation

A SYN flood exhausts the server's pending-connection table by sending numerous half-open requests from spoofed addresses. The server replies with SYN-ACK but never receives the final ACK, so resources remain allocated.

Question 11Network Security

Which control most directly limits lateral movement between segments of a flat corporate network?

  1. Enabling DNS forwarders
  2. Segmenting the network with internal firewalls and ACLs Correct answer.
  3. Deploying additional access points
  4. Increasing DHCP lease duration

Explanation

Dividing a flat network into segments with enforced firewall rules or ACLs restricts which hosts can reach one another, limiting an attacker's ability to move laterally. The other actions change convenience or availability rather than inter-segment reachability.

Question 12Network Security

Which characteristic distinguishes a stateful firewall from a stateless packet filter?

  1. It inspects only source and destination addresses
  2. It tracks active connections and permits return traffic automatically Correct answer.
  3. It encrypts all traffic leaving the perimeter
  4. It assigns IP addresses to internal hosts

Explanation

A stateful firewall maintains a connection table so replies belonging to an allowed session are permitted without a separate inbound rule. A stateless filter evaluates each packet independently against static criteria.

Question 13Network Security

A company wants remote employees to access internal applications over the internet with encrypted tunnels terminating at the corporate edge. Which technology fits?

  1. VLAN trunking
  2. Site-to-site IPsec VPN
  3. Port mirroring
  4. Remote-access VPN Correct answer.

Explanation

A remote-access VPN lets individual endpoints establish encrypted tunnels to a corporate gateway, giving them access to internal resources. Site-to-site VPNs instead connect entire networks at fixed locations.

Question 14Network Security

Which record type maps a hostname to an IPv6 address in DNS?

  1. CNAME
  2. AAAA Correct answer.
  3. MX
  4. A

Explanation

An AAAA record stores a 128-bit IPv6 address for a name, while an A record stores a 32-bit IPv4 address. MX and CNAME records serve mail routing and aliasing respectively.

Question 15Network Security

Why is DNS traffic over port 53 sometimes used to exfiltrate data from a restricted network?

  1. DNS queries are usually permitted through egress filters Correct answer.
  2. DNS uses only UDP and cannot be inspected
  3. DNS packets are always encrypted
  4. DNS servers cannot log queries

Explanation

Because name resolution must work for most networks, outbound DNS is commonly allowed, and attackers can encode stolen data in query names to a domain they control. Filtering and monitoring of DNS are therefore important controls.

Question 16Network Security

A technician sees the address 169.254.10.5 assigned to a host. What does this most likely indicate?

  1. The host is on a public internet segment
  2. The host has a statically assigned address
  3. The host received a lease from the DHCP server
  4. The host could not contact a DHCP server Correct answer.

Explanation

The 169.254.0.0/16 range is link-local and is self-assigned when DHCP fails to provide a lease, commonly called APIPA. Seeing such an address usually points to a DHCP reachability problem.

Question 17Network Security

Which statement correctly describes the difference between a collision domain and a broadcast domain?

  1. A collision domain spans all switches connected by trunk links
  2. A broadcast domain is limited to one switch port
  3. A collision domain is defined by IP subnets
  4. A broadcast domain contains all devices that receive a frame sent to the broadcast MAC address Correct answer.

Explanation

A broadcast domain is the set of devices that receive a frame addressed to the broadcast MAC, and each router interface or VLAN typically bounds it. A collision domain is the set of devices whose transmissions can collide, which a switch port separates.

Question 18Network Security

Which protocol is used by a host to learn the MAC address associated with a known IPv4 address on the local subnet?

  1. ICMP
  2. SNMP
  3. ARP Correct answer.
  4. DHCP

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address. DHCP assigns addresses, while ICMP and SNMP serve diagnostics and management.

Question 19Network Security

A security team wants to detect unauthorized devices plugged into switch ports in a lobby area. Which control best addresses this?

  1. Enabling DNS recursion
  2. Shortening DHCP leases
  3. Increasing the VLAN count
  4. Port security with MAC address limits Correct answer.

Explanation

Port security restricts which MAC addresses may appear on a switch port and can limit the number of learned addresses, blocking unknown devices. The other options change addressing or naming behavior without controlling physical port access.

Question 20Network Security

A packet capture shows a client sending a request to port 53 and receiving a response containing multiple answer records for one name. Which service is in use?

  1. SMTP
  2. DNS Correct answer.
  3. SNMP
  4. NTP

Explanation

Port 53 carries DNS queries and responses, and a single response may include several answer records for a name. The other services use different well-known ports and serve time, mail, or management functions.

Question 21Network Security

Which practice most reduces the risk of a rogue DHCP server handing out false gateway addresses?

  1. Using static DNS entries only
  2. Disabling ARP on the router
  3. Increasing the address pool size
  4. Enabling DHCP snooping on access switches Correct answer.

Explanation

DHCP snooping designates trusted ports for legitimate DHCP servers and drops server messages arriving on untrusted access ports, preventing rogue leases. The other actions do not distinguish legitimate from unauthorized DHCP servers.

Question 22Network Security

An attacker on the same VLAN sends forged ARP replies claiming the gateway's IP address. What is the immediate effect?

  1. The attacker gains the gateway's private key
  2. All DNS queries fail permanently
  3. The attacker can intercept traffic destined for the gateway Correct answer.
  4. The VLAN is automatically disabled

Explanation

Forged ARP replies poison victims' ARP caches so they send gateway-bound traffic to the attacker's MAC, enabling interception or modification. This is a man-in-the-middle condition on the local segment, not a compromise of cryptographic keys.

Question 23Network Security

A network architect must place a firewall so that it inspects traffic between two internal departments that must remain isolated from each other. Where should the firewall be deployed?

  1. On each endpoint as host software only
  2. At the internet edge only
  3. Between the two departmental segments Correct answer.
  4. Behind the core switch on a mirrored port

Explanation

Enforcing isolation between internal segments requires the firewall to sit on the path between them, often as an internal or transparent firewall. An internet-edge device sees only external traffic and cannot enforce inter-department policy.

Question 24Network Security

A remote worker's VPN traffic is encrypted, yet an internal application rejects the connection because the source address is not in an allowed range. What is the most likely cause?

  1. The client's DNS resolver is misconfigured
  2. The VPN uses UDP instead of TCP
  3. The VPN concentrator assigns addresses from a pool outside the permitted range Correct answer.
  4. The application server has no default gateway

Explanation

Remote-access VPNs assign virtual addresses from a configured pool, and if that pool is not included in the application's allow list, the connection is refused. The issue concerns address assignment policy rather than transport or name resolution.

Question 25Network Security

An engineer must summarize four contiguous /24 networks starting at 10.20.4.0 into a single route. Which prefix accomplishes this?

  1. 10.20.4.0/22 Correct answer.
  2. 10.20.4.0/24
  3. 10.20.4.0/23
  4. 10.20.0.0/21

Explanation

Four /24 blocks occupy 1,024 addresses, which corresponds to a /22, and 10.20.4.0 is aligned on a /22 boundary because the third octet 4 is a multiple of 4. The resulting summary covers 10.20.4.0 through 10.20.7.255.

Question 26Network Security

Which OSI layer is responsible for logical addressing and routing of packets between different networks?

  1. Layer 2, the data link layer
  2. Layer 3, the network layer Correct answer.
  3. Layer 4, the transport layer
  4. Layer 1, the physical layer

Explanation

The network layer (Layer 3) handles logical addressing such as IP and decides how packets are forwarded between networks via routers. Layers 1 and 2 deal with signaling and local frame delivery, while Layer 4 manages end-to-end transport sessions.

Question 27Network Security

Which protocol provides connectionless, best-effort delivery and is commonly used for DNS queries and streaming media?

  1. ICMP
  2. UDP Correct answer.
  3. ARP
  4. TCP

Explanation

UDP is connectionless and does not guarantee delivery, ordering, or retransmission, which keeps overhead low for DNS queries and real-time streaming. TCP adds handshakes and acknowledgments, while ICMP and ARP serve diagnostic and address-resolution roles rather than general data transport.

Question 28Network Security

Which type of device forwards frames only to the port where the destination MAC address is known to reside?

  1. A media converter
  2. A repeater
  3. A switch Correct answer.
  4. A hub

Explanation

A switch learns source MAC addresses per port and forwards frames only out the port associated with the destination, reducing unnecessary traffic. Hubs and repeaters simply regenerate signals to all ports, and a media converter only changes the physical medium.

Question 29Network Security

A firewall rule set must allow inbound HTTPS to a public web server while blocking all other inbound traffic. Which rule ordering achieves this on a typical first-match firewall?

  1. Deny TCP 443 to the server, then permit all inbound
  2. Deny all inbound first, then permit TCP 443 to the server
  3. Permit TCP 443 to the server first, then deny all inbound Correct answer.
  4. Permit all inbound, then deny TCP 443 to the server

Explanation

A first-match firewall evaluates rules top-down, so the specific permit for TCP 443 must precede the general deny. Once the broad deny is reached, no later rule is evaluated, so placing it first would block the web traffic.

Question 30Network Security

An analyst notices that a host's ARP cache maps the default gateway IP to a MAC address that belongs to an unknown workstation. Which conclusion is best supported?

  1. The gateway interface has failed over to a standby unit
  2. The host has an expired DHCP lease and needs renewal
  3. Traffic to off-subnet destinations may be intercepted by the unknown host Correct answer.
  4. The host is receiving duplicate IPv6 router advertisements

Explanation

ARP has no authentication, so a forged reply can poison the cache and redirect traffic destined for the gateway through the attacker's MAC. This is the basis of on-path interception on a local segment. DHCP renewal and IPv6 router advertisements do not alter ARP mappings for IPv4.

Question 31Network Security

A company must let branch offices reach a central data center over the public internet with encrypted, authenticated tunnels that terminate on a dedicated appliance. Which technology fits this requirement?

  1. Site-to-site IPsec VPN Correct answer.
  2. Spanning Tree Protocol
  3. Captive portal authentication
  4. Port address translation

Explanation

IPsec provides confidentiality and integrity for traffic between two gateways, making it the standard choice for encrypted site-to-site tunnels over untrusted networks. Captive portals gate user access, PAT conserves addresses, and STP prevents Layer 2 loops.

Question 32Network Security

A network team needs to segment a data center so that a compromise in the web tier cannot directly reach the database tier, while still allowing defined application flows. Which design best meets this goal?

  1. Connect all tiers to a single unmanaged switch to simplify cabling
  2. Put each tier in its own subnet and enforce inter-tier policy on a firewall Correct answer.
  3. Use a hub between tiers so traffic is visible to all hosts
  4. Place all tiers on one VLAN and rely on host-based antivirus

Explanation

Separating tiers into distinct subnets and routing inter-tier traffic through a firewall allows explicit allow rules and default-deny between zones, limiting lateral movement. Flat Layer 2 designs and hubs expose all hosts to the same broadcast domain.

Question 33Network Security

An engineer must allow a partner's access only to a single management host on TCP 8443, while the partner's source addresses are unknown and change frequently. Which control best enforces this with least exposure?

  1. A permit rule for TCP 8443 to any destination
  2. An implicit deny followed by no explicit permit rules
  3. A permit rule for TCP 8443 to the management host, with authentication at the application layer Correct answer.
  4. A permit rule for any protocol from the partner's current IP range

Explanation

Restricting the rule to the specific destination host and port limits exposure to the one intended service, and application-layer authentication compensates for unknown source addresses. Broad permits to any destination or any protocol expand the attack surface unnecessarily.

Question 34Network Security

A capture shows a workstation repeatedly sending DNS queries for long, random-looking subdomains of a single registered domain, with responses of similar size. Which interpretation is most consistent with these observations?

  1. A DNS tunneling channel used for command and control or data transfer Correct answer.
  2. Normal web browsing with HTTP keep-alive
  3. Standard NTP time synchronization traffic
  4. A DHCP relay misconfiguration on the local segment

Explanation

High-volume queries with high-entropy labels under one parent domain are a hallmark of DNS tunneling, where data is encoded in query names and responses. Browsing, DHCP relay, and NTP do not produce that pattern of random subdomain labels.

Question 35SASE

In a SASE architecture, which component is responsible for enforcing security policy at the edge closest to the user, regardless of where the user connects from?

  1. The data center core firewall
  2. The on-premises mail gateway
  3. The cloud-hosted security service edge Correct answer.
  4. The branch SD-WAN router's routing table

Explanation

SASE merges network-as-a-service connectivity with security delivered from cloud points of presence. The security service edge enforces policy near the user instead of backhauling traffic to a data center appliance.

Question 36SASE

Which pair of capabilities is delivered by the security service edge portion of SASE?

  1. Load balancing and WAN acceleration
  2. DNS and DHCP
  3. SD-WAN and WAN optimization
  4. CASB and secure web gateway Correct answer.

Explanation

The security service edge bundles cloud-delivered security functions such as secure web gateway, cloud access security broker, and zero trust network access. SD-WAN and WAN optimization belong to the networking side of SASE.

Question 37SASE

A remote worker's traffic must be inspected for malware and policy violations before reaching the internet. In a SASE model, where is that inspection typically performed?

  1. At the destination web server
  2. At the nearest cloud security PoP Correct answer.
  3. On the user's laptop by the endpoint agent only
  4. At the corporate headquarters egress

Explanation

SASE steers user traffic to the closest cloud point of presence, where security inspection happens inline. This avoids sending traffic through headquarters and keeps latency low.

Question 38SASE

What does zero trust network access (ZTNA) primarily replace in a traditional remote access design?

  1. Endpoint disk encryption
  2. The need for any user authentication
  3. Broad network-level VPN access with per-application access Correct answer.
  4. The organization's DNS resolver

Explanation

ZTNA grants access to specific applications based on identity and context rather than placing users on the corporate network. This removes the broad lateral reach that traditional VPN tunnels provide.

Question 39SASE

Which statement best describes the role of a cloud access security broker (CASB) in SASE?

  1. It replaces the corporate identity provider
  2. It assigns IP addresses to branch devices
  3. It provides visibility and control over sanctioned and unsanctioned SaaS usage Correct answer.
  4. It encrypts traffic between two data centers

Explanation

A CASB discovers cloud applications in use and applies policy such as blocking, coaching, or data controls. It sits between users and cloud services to enforce that visibility and control.

Question 40SASE

Why does SASE reduce the need for backhauling branch traffic to a central data center?

  1. Because security inspection is available from cloud PoPs near the branch Correct answer.
  2. Because branches no longer use the internet
  3. Because data centers can no longer host firewalls
  4. Because branch traffic no longer requires encryption

Explanation

When security services are delivered from cloud points of presence, branch traffic can be inspected locally in the cloud. The hairpin trip to a central data center is no longer required for policy enforcement.

Question 41SASE

A company wants a single policy that follows users whether they work at home, in a branch, or on mobile. Which SASE characteristic enables this?

  1. Policy tied to physical switch ports
  2. Policy stored only on the data center firewall
  3. Identity- and context-based policy enforced in the cloud Correct answer.
  4. Per-site ACLs configured on each router

Explanation

SASE policy is expressed in terms of user identity, device posture, and application rather than network location. Because enforcement is cloud-delivered, the same policy applies wherever the user connects.

Question 42SASE

Which benefit is most directly associated with the networking half of a SASE offering?

  1. Improved WAN path selection and connectivity to cloud applications Correct answer.
  2. Malware sandboxing of email attachments
  3. Identity federation with a third-party IdP
  4. Data loss prevention for SaaS uploads

Explanation

The networking side of SASE, often built on SD-WAN and cloud interconnect, optimizes how traffic reaches applications. Security functions such as sandboxing, DLP, and identity federation belong to the security side.

Question 43SASE

An administrator configures a secure web gateway rule that blocks categories of websites for all users except the finance group. Which policy element makes this rule user-aware?

  1. The user or group identity from the identity provider Correct answer.
  2. The source port number
  3. The destination IP address
  4. The TCP window size

Explanation

User-aware policy relies on identity information supplied by an identity provider or directory. Group membership lets the gateway apply different actions to different populations without relying on IP address.

Question 44SASE

A security team wants to prevent uploads of customer records to unsanctioned file-sharing sites while allowing an approved service. Which SASE capability combination fits best?

  1. DNS filtering alone
  2. SD-WAN with QoS plus DHCP
  3. VPN concentrator with split tunneling
  4. CASB with DLP plus a secure web gateway Correct answer.

Explanation

CASB provides visibility into SaaS use and can distinguish sanctioned from unsanctioned services. DLP inspects content to block sensitive data, and the secure web gateway enforces the resulting web policy.

Question 45SASE

In a ZTNA deployment, a user requests access to an internal application. Which check sequence best reflects zero trust principles?

  1. Allow access to the whole subnet, then log the session
  2. Trust any request originating from the corporate IP range
  3. Grant access after the first successful login for the rest of the day
  4. Authenticate the user, verify device posture and context, then authorize the specific application Correct answer.

Explanation

Zero trust evaluates identity, device health, and contextual signals before granting least-privilege access to a single application. Continuous verification replaces implicit trust based on network location.

Question 46SASE

Which scenario best justifies using a SASE cloud point of presence rather than a regional data center firewall for internet-bound traffic?

  1. All users are in one building with a dedicated appliance
  2. The organization has no internet-facing applications
  3. The organization wants to eliminate all endpoint security
  4. Users are distributed globally and need low-latency inspection Correct answer.

Explanation

Cloud PoPs place enforcement close to distributed users, reducing latency compared with a single central inspection point. A globally dispersed workforce is the classic driver for cloud-delivered security.

Question 47SASE

A company uses a SASE platform and wants to inspect traffic from unmanaged personal devices without installing an agent. Which approach is most appropriate?

  1. Full tunnel VPN installed on the device
  2. Static route pushed to the device
  3. Agentless proxy configuration on the device's browser Correct answer.
  4. On-premises firewall at the user's home

Explanation

Agentless access uses a browser proxy so unmanaged devices can reach protected applications without endpoint software. This is a common SASE pattern for contractors and BYOD users.

Question 48SASE

What is the primary purpose of a cloud access security broker's inline versus API-based deployment modes?

  1. Inline mode encrypts disks, while API mode manages passwords
  2. Inline mode only works with email, while API mode only works with web traffic
  3. Inline mode is for on-premises applications, while API mode is for endpoints
  4. Inline inspects traffic in real time, while API mode inspects data at rest in sanctioned cloud services Correct answer.

Explanation

Inline CASB sits in the traffic path and can block actions in real time. API-based CASB connects directly to sanctioned SaaS to scan stored data and apply retroactive controls.

Question 49SASE

A branch office has two internet links. The SASE design should send traffic over the best link and still apply cloud security inspection. Which combination achieves this?

  1. A hub-and-spoke VPN to headquarters plus a proxy
  2. Round-robin DNS plus a local content filter
  3. SD-WAN for path selection plus cloud security service edge for inspection Correct answer.
  4. A single static default route plus host-based antivirus

Explanation

SD-WAN selects the best available path based on policy and link health. Steering traffic to the cloud security service edge ensures inspection still occurs regardless of which link is chosen.

Question 50SASE

Which identity-related practice most improves the effectiveness of SASE policy enforcement?

  1. Using a single local account per branch
  2. Relying on IP address as the only user identifier
  3. Federating identities through a central identity provider with MFA Correct answer.
  4. Sharing service accounts among many users

Explanation

Federated identity with multi-factor authentication gives SASE services trustworthy, consistent user context. Policy based on verified identity is far more reliable than policy based on shared accounts or IP addresses.