Apprentice Exam Dumps : Palo Alto Networks Cybersecurity Apprentice

Infrastructure as a Service provides cloud-hosted infrastructure resources such as compute, storage, and networking. In IaaS, the customer uses provider-operated hardware resources without owning the physical servers, racks, power, cooling, or data center facilities. The customer typically remains responsible for securing operating systems, applications, data, identities, and workload configurations. PaaS provides a managed platform for developing and deploying applications, where the provider handles more of the runtime environment. SaaS delivers a complete application that customers consume directly. NaaS delivers networking capabilities as a service. The phrase “hardware resources from a cloud service provider” points directly to IaaS because the customer consumes virtualized infrastructure backed by provider hardware. Security teams must understand IaaS because it creates a shared responsibility boundary: the provider secures the physical infrastructure, while the customer secures what they build, configure, and run on top of it. Reference/topics: Cloud Security 5.2, IaaS, PaaS, SaaS, NaaS; Cloud Security 5.3, shared responsibility.

Multi-factor authentication requires two or more different categories of authentication factors. The standard categories are something you know, something you have, and something you are. Answering a security question is something you know, while providing a thumbprint is something you are, so answer A is MFA. Entering a PIN is something you know, while scanning a smart card is something you have, so answer B is also MFA. Scanning the palm of one hand followed by the other hand uses the same factor category twice: biometrics, or something you are. That may be stronger biometric checking, but it is not multi-factor. Answering three sequential security questions also repeats the knowledge factor and therefore remains single-factor authentication. MFA improves identity security because stolen passwords alone are less useful to attackers when another independent proof is required. Strong MFA should use phishing-resistant methods where possible. Reference/topics: Identity Security 7.1.2, single-factor and multifactor authentication.

The Installation phase occurs after exploitation, when an attacker attempts to establish persistence on the compromised system. A rootkit is a strong example because it can hide malicious processes, files, registry entries, drivers, or system changes from users and security tools. Its purpose is to maintain access while reducing the chance of detection. Exploiting web application vulnerabilities belongs to the exploitation phase. Brute force attacks against user accounts are credential attacks and may occur before or during compromise, but they are not the best example of installation persistence. Sending spear phishing emails is a delivery or social engineering activity. Persistence mechanisms may include rootkits, backdoors, scheduled tasks, malicious services, startup items, or modified authentication paths. Defenders counter this phase with endpoint detection, integrity monitoring, least privilege, hardening, and incident response procedures that remove persistence artifacts. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, malware and attack types.