Cybersecurity-Practitioner Exam Questions & Answers

An Intrusion Prevention System (IPS) includes automated security actions, such as blocking malicious traffic, resetting connections, or alerting administrators when it detects suspicious activity, helping to stop attacks in real time.

Endpoint Detection and Response (EDR) technologies provide comprehensive visibility and real-time threat prevention directly on endpoint devices. EDR continuously monitors process activities, file executions, and system calls to detect malware, suspicious behaviors, and zero-day threats at the source. Palo Alto Networks' Cortex XDR platform exemplifies this by correlating endpoint telemetry with network and cloud data to provide a holistic defense against attacks. Operating locally on endpoints allows EDR to prevent lateral movement and respond to threats quickly, filling security gaps that network-centric tools alone cannot address. This endpoint-level insight is critical to identifying sophisticated threats that initiate or manifest on user devices.

A host-based architecture uses virtual machines (VMs) to run workloads on a shared host, commonly found in public cloud environments. Each VM operates independently with its own OS, making this model suitable for traditional and isolated application deployments.

Prisma SaaS connects directly to the applications themselves, therefore providing continuous silent monitoring of the risks within the sanctioned SaaS applications, with detailed visibility that is not possible with traditional security solutions.

An effective Attack Surface Management (ASM) process requires a real-time, data-rich inventory of all internet-facing assets. This enables continuous visibility, timely detection of vulnerabilities, and identification of exposures that attackers could exploit.