Certified Cybersecurity Associate Changed Practitioner Questions

Local systems can eliminate vulnerabilities by patching systems and software effectively and continuously. Patching is the process of applying updates or fixes to software or hardware components that have known vulnerabilities or bugs. Patching can prevent attackers from exploiting these vulnerabilities and compromising the security or functionality of the systems. Patching should be done regularly and promptly, as new vulnerabilities are constantly discovered and exploited by cybercriminals. Patching should also be done effectively, meaning that the patches are tested and verified before deployment, and that they do not introduce new vulnerabilities or issues. Patching should also be done continuously, meaning that the systems are monitored for new vulnerabilities and patches are applied as soon as they are available. Continuous patching can reduce the window of opportunity for attackers to exploit unpatched vulnerabilities and cause damage or data breaches. References:

•1: What is Patch Management? | Palo Alto Networks

•2: Patch Management Best Practices: How to Keep Your Systems Secure | Snyk

•3: Vulnerability Remediation Process - 4 Steps to Remediation | Snyk

A SASE solution converges networking and security services into one unified, cloud-delivered solution (see Figure 3-12) that includes the following:

● Networking

○ Software-defined wide-area networks (SD-WANs)

○ Virtual private networks (VPNs)

○ Zero Trust network access (ZTNA)

○ Quality of Service (QoS)

● Security

○ Firewall as a service (FWaaS)

○ Domain Name System (DNS) security

○ Threat prevention

○ Secure web gateway (SWG)

○ Data loss prevention (DLP)

○ Cloud access security broker (CASB)

To maximize the use of a network address, the administrator should use the subnet that can accommodate the required number of hosts with the least amount of wasted IP addresses. The subnet mask determines how many bits are used for the network portion and the host portion of the IP address. The more bits are used for the network portion, the more subnets can be created, but the fewer hosts can be assigned to each subnet. The formula to calculate the number of hosts per subnet is

2(32−n)−2

, where

n

is the number of bits in the network portion of the subnet mask. For example, a /30 subnet mask has 30 bits in the network portion, so the number of hosts per subnet is

2(32−30)−2=2

A /25 subnet mask has 25 bits in the network portion, so the number of hosts per subnet is

2(32−25)−2=126

The subnet 192.168.6.0/25 can accommodate 126 hosts, which is enough for the network with 120 hosts. The subnet 192.168.6.168/30 can only accommodate 2 hosts, which is not enough. The subnet 192.168.6.160/29 can accommodate 6 hosts, which is also not enough. The subnet 192.168.6.128/27 can accommodate 30 hosts, which is enough, but it wastes more IP addresses than the /25 subnet. Therefore, the best option is B. 192.168.6.0/25. References:

Getting Started: Layer 3 Subinterfaces - Palo Alto Networks Knowledge Base

DotW: Multiple IP Addresses on an Interface - Palo Alto Networks Knowledge Base

Configure NAT - Palo Alto Networks | TechDocs

Security Operations (SecOps) is the process of coordinating and aligning security teams and IT teams to improve the security posture of an organization. SecOps involves implementing and maintaining security controls, technologies, policies, and procedures to protect the organization from cyber threats and incidents. When dealing with a known attack, SecOps must take the following action: document, monitor, and track the incident. This action is important because it helps SecOps to:

•Record the details of the attack, such as the source, target, impact, timeline, and response actions.

•Monitor the status and progress of the incident response and recovery efforts, as well as the ongoing threat activity and indicators of compromise.

•Track the performance and effectiveness of the security controls and technologies, as well as the lessons learned and improvement opportunities. References:

•Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)

•6 Incident Response Steps to Take After a Security Event - Exabeam

•Dealing with Cyber Attacks–Steps You Need to Know | NIST