Cybersecurity-Apprentice Exam Questions & Answers

When a device or router does not have a more specific route for a destination, traffic is sent to the default gateway or default route. The default gateway acts as the next hop for traffic destined outside the local network when no exact path is known locally. On an endpoint, the default gateway is usually a router interface. On a router, the default route points to another router or upstream path. A VPN gateway may be used for encrypted tunnel traffic, but it is not always the default path. A hub repeats signals and does not make routing decisions. The internet may be the eventual destination path for many routes, but traffic must first be forwarded to the configured default gateway. Default gateways are essential because without them, hosts could communicate only with systems on their local subnet unless specific routes were manually configured. Reference/topics: Network Fundamentals 2.3, function of a default gateway; Network Fundamentals 2.5, routing.

A VPN is used to secure connectivity, including site-to-site connectivity between networks. Site-to-site VPNs create encrypted tunnels between locations such as branch offices, data centers, and cloud environments. The purpose is to protect traffic as it crosses an untrusted or shared network. Requesting IP addressing is a DHCP function. Arranging packets in the correct order is associated with transport-layer reliability, especially TCP sequencing, not VPN. Creating virtual machines is a virtualization or cloud infrastructure function. VPNs can also support remote access, allowing users to securely connect to enterprise resources from outside the corporate network. Security teams must remember that VPNs protect transport but do not automatically guarantee authorization. Strong authentication, least privilege, device posture checks, logging, and segmentation should also be applied. In simple terms, a VPN creates a protected tunnel, but policy still determines who can use it and what they can reach. Reference/topics: Network Security 3.3, VPNs; Network Security 3.4, tunneling protocols.

In the cloud shared responsibility model, the provider is responsible for securing the underlying infrastructure that delivers the cloud service. This includes physical data centers, facilities, power, cooling, physical networking, storage hardware, and host servers that support customer workloads. Therefore, the host server is the correct answer. A customer is generally responsible for securing what they configure or deploy in the cloud, such as virtual machines, operating systems, applications, identities, and data, depending on the service model. Website authentication is an application or identity-layer responsibility and usually belongs to the customer or application owner. On-premises connectivity to hosts is also customer-controlled because it involves the organization's network design, VPN, routing, and access policies. The exact boundary shifts across SaaS, PaaS, and IaaS, but the provider consistently secures the cloud infrastructure itself. Palo Alto Networks explicitly includes the cloud shared responsibility model as a Cloud Security objective for Apprentice candidates. Reference: Cybersecurity Apprentice Datasheet, Cloud Security 5.3.

Multi-factor authentication requires two or more different categories of authentication factors. The standard categories are something you know, something you have, and something you are. Answering a security question is something you know, while providing a thumbprint is something you are, so answer A is MFA. Entering a PIN is something you know, while scanning a smart card is something you have, so answer B is also MFA. Scanning the palm of one hand followed by the other hand uses the same factor category twice: biometrics, or something you are. That may be stronger biometric checking, but it is not multi-factor. Answering three sequential security questions also repeats the knowledge factor and therefore remains single-factor authentication. MFA improves identity security because stolen passwords alone are less useful to attackers when another independent proof is required. Strong MFA should use phishing-resistant methods where possible. Reference/topics: Identity Security 7.1.2, single-factor and multifactor authentication.

VLANs segment Layer 2 traffic using VLAN tags. In Ethernet networks, 802.1Q tagging marks frames with a VLAN identifier so switches can keep traffic from different logical networks separated even when it traverses shared physical links. This allows organizations to divide a physical switching infrastructure into multiple logical broadcast domains. Protocol is not the primary VLAN segmentation characteristic. Identity-based segmentation can be performed by more advanced access control or policy systems, but VLANs themselves rely on VLAN IDs. MAC addresses are used by switches to forward frames, but a MAC address alone is not the VLAN segmentation marker. VLANs are commonly paired with IP subnetting, routing, access control lists, and firewall zones to create stronger segmentation. The VLAN tag is the label that tells the switching infrastructure which logical segment a frame belongs to. Reference/topics: Network Security 3.1, VLAN segmentation; Network Fundamentals 2.7, Layer 2 switching.