Pass the Paloalto Networks Certified Cybersecurity Associate Apprentice Questions and answers with ExamsMirror

A trojan is malware disguised as legitimate or useful software. It tricks the user or system into running it, then performs malicious actions such as installing backdoors, stealing data, downloading additional payloads, or giving attackers remote access. The key characteristic is deception: the malware is hidden inside or presented as a trusted application. A botnet is a network of compromised devices controlled by an attacker, often through command-and-control infrastructure. Ransomware encrypts or locks systems and demands payment. A virus is malware that attaches to files or programs and replicates when executed, but the scenario specifically describes malicious code hidden within an application to avoid detection, which fits a trojan. Trojans are common because they exploit user trust and can bypass purely technical controls if users install unauthorized software. Endpoint protection, application control, user training, and least privilege help reduce trojan risk. Reference/topics: Cybersecurity 1.3, malware types; Endpoint Security 4.3, antivirus.

Reconnaissance is the information-gathering stage of the cyber attack lifecycle. During this phase, attackers attempt to understand the target environment before selecting a delivery path or exploit. A host sweep is a reconnaissance activity because it identifies live systems within an address range. This helps an attacker map reachable hosts, discover exposed services, and prioritize later scanning or exploitation. File exfiltration occurs much later, during actions on objectives, after access has been obtained. SQL injection is an exploitation technique against an application or database-backed service. A phishing campaign is normally associated with delivery, where the attacker attempts to place a malicious link, attachment, or credential-harvesting page in front of a user. Reconnaissance is the attacker’s “survey the terrain” phase: it does not yet require compromise, but it materially improves the attacker’s chance of success. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, common attack types.

An Intrusion Detection System monitors traffic or host activity and generates alerts when it identifies suspicious patterns. The correct answer is monitoring network traffic for specific patterns because detection is the central IDS function. An IDS can use signatures, anomaly detection, protocol analysis, or behavioral indicators to identify potential attacks. However, unlike an IPS, a traditional IDS is not usually placed inline to block traffic. Rejecting connections, filtering malicious packets, and dropping inline packets are prevention or enforcement actions more closely associated with an IPS or firewall. IDS alerts are valuable to security operations because they create visibility into attempted attacks, policy violations, scanning activity, or suspicious behavior that may require investigation. A NIDS monitors network traffic, while a HIDS monitors activity on a specific host. The certification expects candidates to distinguish detection systems from prevention systems and understand where each operates. Reference/topics: Cybersecurity 1.4, IDS, HIDS, and NIDS; Cybersecurity 1.5, threat prevention systems.

A Network-Based Intrusion Detection System monitors network traffic and reports suspicious findings to administrators or security tools. It observes packets traversing a network segment and compares activity against signatures, patterns, protocol anomalies, or behavior models. Because it is detection-focused, a NIDS typically alerts rather than blocks traffic inline. Scanning and quarantining infected files on a host machine is an endpoint security function. Proxying traffic before it reaches an internal network is a proxy function. Blocking malicious traffic in real time is more closely associated with an IPS or firewall. A NIDS is useful because it can provide visibility across multiple hosts without installing an agent on each one. However, encrypted traffic, high throughput, and east-west blind spots can limit visibility if sensors are not placed correctly. SOC teams use NIDS alerts as evidence during investigation and correlation. Reference/topics: Cybersecurity 1.4, NIDS and other threat detection systems; Security Operations 6.3, alerts and events.