Cybersecurity Apprentice Practice Exam 2025: Latest Questions

A user reports they can access websites by IP address but not by hostname (for example, they can reach https://1.1.1.1 but not https://example.com). Which service is most likely failing?

Which statement best describes the purpose of a firewall in a network security architecture?

An analyst reviews an email that appears to come from the company’s CEO and asks for gift card purchases. The sender address looks similar to the real domain but is slightly misspelled. What type of attack is this?

Which is the BEST immediate action after you suspect your corporate account password has been compromised?

A small office has a switch connecting multiple PCs and a router connecting to the internet. Which OSI layer is the switch primarily operating at?

A company wants to reduce risk if an attacker steals a user’s password. Which control most directly addresses this risk?

A security team wants a policy that blocks unknown applications but allows business-approved apps and can identify traffic regardless of port. Which Palo Alto Networks next-generation firewall capability best fits this requirement?

A SOC analyst sees many failed login attempts across multiple user accounts from a single external IP, followed by a successful login to one account. What is the MOST likely explanation?

A company is moving a public web application to a cloud environment. They want to reduce exposure by allowing inbound connections only to the web app, while preventing direct access to database servers. Which architecture approach best supports this goal?

A user reports they connected to a public Wi-Fi network and then could not access corporate resources over VPN. The help desk discovers the user’s device has an incorrect system time. Why can incorrect time prevent VPN connectivity?

A user cannot reach an internal web server (10.10.20.50) by name, but can reach it by IP address. Other internal websites resolve normally. Which issue is MOST likely?

An administrator wants to reduce the attack surface on user endpoints. Which action BEST supports the principle of least privilege?

Which statement BEST describes multi-factor authentication (MFA)?

A company is segmenting its network into separate VLANs for Finance, HR, and Guests. What is the PRIMARY security benefit of this design?

You are investigating suspicious outbound traffic from a workstation to an unknown IP on TCP port 443. The traffic volume is high and occurs at regular intervals. Which next step is MOST appropriate to determine whether this is malicious or legitimate?

An employee receives an email claiming to be from IT asking them to "verify" their password using a link to an external site. What is the BEST immediate action for the employee?

A security team wants to ensure that if an attacker compromises one user account, they still cannot access a sensitive internal application without additional verification. Which control BEST achieves this goal?

A small organization is choosing between symmetric and asymmetric encryption for protecting a large backup file at rest. Which statement is MOST accurate?

A company is moving a public-facing application to a cloud environment. They want to reduce exposure of databases and internal services while still allowing the application to function. Which architecture is MOST appropriate?

During an incident, an analyst suspects data exfiltration over DNS. Which indicator MOST strongly supports DNS tunneling rather than normal DNS usage?

A small office reports that users can access websites by IP address (for example, https://142.250.72.206) but not by name (for example, https://www.google.com). Which component is MOST likely causing the issue?

A user receives an email that appears to be from the IT team asking them to "verify" their password via a link. The sender address looks similar to the company domain, but not exact. What is the BEST immediate action for the user?

Which security control is primarily intended to ensure data is not altered in transit without detection?

A firewall policy allows users to browse the web. The security team wants to reduce risk from unknown or newly registered domains without blocking well-known business sites. Which approach is MOST appropriate?

A company is designing a segmented network with a user VLAN and a server VLAN. The requirement is to allow only specific application flows from users to servers while preventing all other lateral movement. Which design choice BEST supports this goal?