Prisma Access Services

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?

An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

An enterprise is deploying Prisma Access and wants to ensure that user identity mapping is gathered efficiently from Microsoft Entra ID (formerly Azure AD) without deploying physical User-ID agents inside the cloud network. Which integration method should be used?

An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?

An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?

A security engineer is configuring a Prisma Access Remote Network location with redundant IPsec tunnels to ensure high availability. What configuration requirement must be met on the customer premise equipment (CPE) router to support dynamic routing over these redundant tunnels?

When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?

An administrator is setting up Prisma Access and needs to ensure that mobile users connecting from managed corporate laptops can access internal resources, while unmanaged contractor laptops are restricted to web-based applications only. Which Prisma Access mechanism distinguishes between managed and unmanaged endpoints during connection?

An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?

An enterprise using Prisma Access has configured a Service Connection to their primary data center. Users at remote branches report that they cannot reach internal applications hosted in the data center. Upon checking Panorama, the Service Connection status shows 'Connected', but routing is failing. What configuration step is required on Prisma Access to advertise the remote network subnets to the data center?

An administrator wants to configure Prisma Access Secure Web Gateway to block access to sites categorized as 'Gambling' during working hours, but allow them during lunch breaks. Which Panorama feature enables time-based policy enforcement?

Which log category in Prisma Access records events when a user's host information profile (HIP) changes or fails a compliance check?

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?

An enterprise wants to ensure that all internet-bound traffic from mobile users is decrypted and inspected for malware and sensitive data using Prisma Access SWG. Which GlobalProtect client traffic forwarding configuration ensures that all traffic is sent to Prisma Access?

An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)

A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)

An administrator is configuring Prisma Access Secure Web Gateway and wants to restrict access to high-risk web categories. Which TWO options represent configurable actions within a Prisma Access URL Filtering profile? (Choose two)

An administrator needs to configure Prisma Access ZTNA to verify endpoint hygiene before granting access to internal applications. Which TWO posture checks can be evaluated using GlobalProtect Host Information Profiles (HIP)? (Choose two)

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)

An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)

An administrator is configuring authentication for Prisma Access mobile users. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)

A deployment of Prisma Access requires ZTNA 2.0 posture check enforcement for remote users. The administrator must ensure that mobile devices attempting to connect to internal corporate apps are evaluated for disk encryption and active endpoint protection agents prior to tunnel establishment. Which component performs this real-time device posture assessment?

An organization is migrating their branch offices to Prisma Access Firewall as a Service (FWaaS). What is the primary method used to connect a physical branch office location to the Prisma Access cloud infrastructure securely?

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)

An administrator is configuring Prisma Access Firewall as a Service (FWaaS) to protect outbound internet traffic from remote networks. They want to ensure that known command-and-control (C2) traffic and vulnerability exploits are blocked dynamically in real time. Which security profile should be applied to the security policy rules?

An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)

An administrator is troubleshooting a connectivity issue where remote mobile users cannot reach internal private applications via Prisma Access ZTNA. Which THREE diagnostic steps or verification checks should the administrator perform? (Choose three)

An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?

A security engineer manages a Prisma Access deployment with 5,000 mobile users. The organization wants to enforce different security policies for users in the Finance department versus the Engineering department, without deploying separate GlobalProtect portals or gateways. The identity provider is SAML-based and already integrated. What is the most operationally efficient way to achieve this?

An administrator is configuring Prisma Access to provide secure access to private applications for mobile users using ZTNA 2.0. The administrator must ensure that the solution enforces least-privilege access and continuous trust verification. Which TWO configurations are required to meet these requirements? (Choose two.)

An administrator is troubleshooting a Prisma Access mobile users deployment where some users cannot access a critical internal web application. The application is hosted in a remote network that is connected to Prisma Access via a service connection. Other users in the same region can access the application successfully. The affected users are able to access other internal resources. What is the most likely cause?

An administrator is configuring Prisma Access for the first time and needs to ensure that mobile users can resolve internal domain names. The administrator has enabled DNS proxy in the Mobile Users settings. Which additional configuration is required to resolve internal domains?

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. They want to ensure that all web traffic is scanned for threats and that file downloads are restricted based on file type. Which Prisma Access service should they configure to achieve this?

A security engineer is configuring Prisma Access to inspect traffic from remote networks. The requirement is to apply different security policies based on the source IP address of the traffic. Which configuration object in Prisma Access should be used to define the source IP addresses for policy enforcement?

An administrator is deploying Prisma Access with a service connection so that branch users can reach internal applications hosted in a data center. The branch traffic is tunneled to a Prisma Access mobile user location, and the administrator wants to confirm which component forwards traffic from the Prisma Access infrastructure to the data center. Which component provides this forwarding?

An administrator is configuring Prisma Access for a branch office to provide secure internet access. They want to ensure that the branch users' traffic is inspected for threats and that access to risky URLs is blocked. Which two components are required in the Prisma Access configuration to achieve this? (Choose two.)

An administrator is configuring Prisma Access for Secure Web Gateway (SWG) and needs to ensure that SSL decryption is applied to traffic from mobile users. Which component must be configured to enable SSL decryption in Prisma Access?

A security engineer is troubleshooting a Prisma Access deployment where mobile users report that traffic to a specific SaaS application is being inspected but the CASB inline policy is not applying the expected data-loss prevention action. The engineer confirms the SaaS application is identified in the traffic logs. Which log or dashboard should the engineer examine to determine whether the CASB policy matched and what action was taken?

An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?

An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?

An administrator is configuring Prisma Access to provide secure access for mobile users. The requirement is to ensure that all traffic from mobile users is inspected by Prisma Access, including traffic to the internet and to private applications. Which TWO configurations are necessary to achieve this? (Choose two.)

A network security administrator is configuring Prisma Access to provide secure web gateway services to mobile users. The requirement is that all web traffic from the mobile users must be inspected for threats and URL filtering, and the administrator wants the simplest deployment that does not require installing certificates on the endpoints. Which Prisma Access capability should the administrator enable?

An administrator needs to ensure that Prisma Access mobile users are authenticated using multi-factor authentication (MFA) before accessing corporate resources. Which Prisma Access component is responsible for enforcing MFA?

A security engineer is configuring Prisma Access to protect mobile users from malicious downloads. The requirement is that files downloaded from the internet by mobile users must be analyzed for zero-day malware, and the analysis must not delay the user's download. Which Prisma Access feature should the engineer configure?

An administrator is configuring Prisma Access to secure outbound internet traffic for mobile users. The requirement is to inspect all traffic for threats and sensitive data, but the organization wants to avoid decrypting traffic to financial and healthcare websites due to privacy regulations. Which Prisma Access feature should be used to meet this requirement?

An administrator needs to provide access to a private web application hosted in an on-premises data center for a group of remote contractors. The contractors will use personal devices and must authenticate via SAML. The application uses HTTPS on port 443. Which Prisma Access feature should be used to securely publish this application without requiring a GlobalProtect agent?

An administrator is configuring Prisma Access for mobile users and wants to ensure that all traffic to and from the internet is inspected by the Secure Web Gateway (SWG) service. The administrator has enabled the SWG license and configured a security policy rule to allow web traffic. However, users report that they can access malicious websites that should be blocked. What is the most likely missing configuration?

A security engineer is configuring Prisma Access to provide secure access to private applications hosted in an on-premises data center for mobile users. The engineer has set up a service connection and configured the private applications. However, users are unable to reach the applications. The engineer suspects that the issue is related to the service connection configuration. Which TWO items should the engineer verify to ensure the service connection is correctly established? (Choose two.)

An administrator is configuring Prisma Access to provide secure web gateway services for mobile users. The requirement is to decrypt outbound SSL traffic for inspection, but only for categories that are not in a predefined exemption list. Where should the administrator configure the SSL decryption policy in Prisma Access?

A security engineer is configuring Prisma Access to enforce threat prevention on all traffic from remote networks. The engineer wants to ensure that the threat prevention profile is applied to both inbound and outbound traffic. Where should the engineer attach the threat prevention profile in the Prisma Access policy?

A security engineer is deploying Prisma Access for a remote network that connects via a single IPsec tunnel to a service connection. The organization wants to provide redundancy in case the primary tunnel fails. The remote network has two ISP links with static public IP addresses. Which configuration should the engineer use to achieve tunnel redundancy?

A security engineer is deploying Prisma Access with a service connection to an on-premises data center. The data center hosts a critical application at 10.10.10.50/32. The engineer wants all traffic from mobile users destined to that IP to be routed through the service connection and inspected by Prisma Access security policies, while all other internet-bound traffic goes directly to the internet. Which configuration should the engineer use?

An administrator is configuring Prisma Access for a remote network that uses a single IPsec tunnel to a Prisma Access service connection. The remote network has two ISP links: a primary link and a backup link. The administrator wants to ensure that if the primary link fails, traffic automatically fails over to the backup link without manual intervention. Which Prisma Access feature should be configured to achieve this?

A security engineer needs to ensure that DNS queries from Prisma Access mobile users are resolved by Prisma Access's built-in DNS proxy rather than by external DNS servers. Which configuration should the engineer perform?

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. The engineer wants to ensure that all web traffic is inspected for threats and that certain high-risk web categories are blocked. Which TWO configurations are required to achieve this? (Choose two.)