Prisma Access Troubleshooting

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

An administrator configures a Service Connection in Prisma Access to reach an on-premises Active Directory domain controller for authentication. Users are able to log in, but User-ID is failing to map IP addresses to usernames for users behind the Remote Network. What is the most likely reason for this User-ID failure?

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

An administrator troubleshooting a Prisma Access environment notices that specific traffic is bypassing security inspection. Upon checking the Security Policy, the administrator sees that a security rule has the profile setting set to 'None'. What does this configuration mean for traffic matching that rule?

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

An administrator has deployed Prisma Access Remote Networks, but traffic from a branch office is failing to pass through the IPsec tunnel to Prisma Access. The IKE phase 1 negotiation is failing. Which Prisma Access operational command should the administrator run via the CLI to check the IPsec tunnel status and IKE SA parameters?

An administrator configures a new Service Connection in Prisma Access to allow mobile users to access resources in the corporate data center. However, traffic from mobile users cannot reach the data center. The administrator confirms that the IPsec tunnel is up. What is the most likely cause of this issue in Panorama?

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch office users cannot reach external websites. Which TWO configuration areas or logs should the administrator check to resolve this issue? (Choose two)

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

Users in a specific region are experiencing intermittent latency and packet loss when accessing SaaS applications through Prisma Access. The administrator wants to analyze the quality of the path between the remote network location and the Prisma Access cloud node. Which Prisma Access feature should be utilized?

A Prisma Access administrator is troubleshooting a Remote Network deployment where branch users cannot reach internal applications hosted in a data center connected via an IPsec tunnel. The administrator confirms that the Remote Network IPsec tunnel is up and that the branch firewall routes the internal subnets toward Prisma Access. Which action should the administrator take next to verify that Prisma Access is correctly routing traffic to the data center?

A Prisma Access administrator is troubleshooting a mobile user who reports that after connecting via GlobalProtect, they cannot access internal web servers by hostname, but can access them by IP address. Other mobile users in the same region do not have this issue. Which component should the administrator verify first?

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

A security administrator is troubleshooting a Prisma Access mobile user who cannot access an internal application hosted in a branch office. The user is connected via GlobalProtect and can reach the internet. The administrator has verified that the user's security policy allows the traffic. Which step should the administrator take next to diagnose the issue?

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch users experience slow throughput to SaaS applications. The IPsec tunnel to Prisma Access is up, but performance is degraded. The administrator suspects that traffic is not being forwarded to the optimal Service Connection. Which action should the administrator take to verify that Prisma Access is selecting the correct egress point for the branch?

A Prisma Access administrator needs to verify that a specific mobile user's traffic is being inspected by the correct security policy rule. The administrator wants to see the rule name that allowed or denied a recent session. Which log type should the administrator consult?

An administrator is troubleshooting a Prisma Access deployment where mobile users are unable to access certain SaaS applications. The users are connected via GlobalProtect, and the administrator has confirmed that the GlobalProtect tunnel is up. The administrator suspects that the issue is related to SSL decryption. Which action should the administrator take to verify that SSL decryption is functioning correctly?

A Prisma Access administrator is troubleshooting a mobile user who cannot access a specific internal web application. The application is reachable from other mobile users, and the user's GlobalProtect connection is established. The administrator wants to verify whether the user's traffic is being decrypted and inspected by the security policy. Which TWO actions should the administrator take to confirm that SSL decryption is applied to the user's session? (Choose two.)

A Prisma Access administrator notices that a specific remote network tunnel shows as up, but the branch users cannot reach any internet destinations. The tunnel interface on the branch CPE is up, and the administrator can ping the Prisma Access service IP. Which log type on the Prisma Access side should the administrator review first to determine whether traffic is being dropped by a security policy?

An administrator is troubleshooting a Prisma Access mobile user who reports that corporate applications are unreachable, yet public websites load normally. In the Prisma Access status dashboard, the user's GlobalProtect connection shows Connected and the tunnel is assigned a 10.201.x.x address, but the Service Connection to the corporate data center shows a status of Down. Which action should the administrator take to resolve the user's issue?

A network administrator is troubleshooting a Prisma Access remote network deployment where users at a branch office are experiencing slow access to cloud applications. The administrator has verified that the IPsec tunnel is up and that there is no packet loss on the tunnel. Which tool should the administrator use to monitor the performance and latency of the Service Connection?

A Prisma Access engineer is troubleshooting a mobile user who cannot access an internal application after successfully connecting via GlobalProtect. The engineer suspects that the issue is related to the split-tunnel configuration. Which TWO actions should the engineer take to verify that the correct routes are being pushed to the client? (Choose two.)

A Prisma Access administrator is investigating why a specific mobile user is unable to access a web application that is allowed by a security policy. The administrator suspects that the user is being blocked by a URL Filtering profile. Which log type should the administrator check first to confirm the block?

A help desk technician reports that a Prisma Access mobile user cannot reach any resources, and the GlobalProtect client displays 'Portal unreachable' before the user even authenticates. The administrator confirms the user's internet connectivity is fine and other users at the same site are connected successfully. Which troubleshooting step should the administrator perform first?

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being routed through a Service Connection in a different region than expected, causing high latency. The administrator wants to verify which Service Connection the user's session is currently using for that application. Which action should the administrator take?

A Prisma Access administrator is troubleshooting why a mobile user's traffic is not being inspected for threats. The administrator suspects that the security policy rule is not applying the correct security profiles. Which Prisma Access component should the administrator examine to confirm that the security profiles are attached to the rule?

Users connected through a Prisma Access remote network report that traffic to a partner's public web application is being blocked, while the same application works from a mobile user tunnel. The administrator confirms a URL Filtering profile is applied to both the remote network and mobile user policies. Which log type and filter should the administrator use to determine why the remote network traffic is blocked?

A Prisma Access administrator is troubleshooting a remote network site where IPsec tunnels are flapping. The administrator suspects that the tunnel monitoring settings are too aggressive. Which configuration parameter should be adjusted to reduce flapping?

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

A Prisma Access administrator is troubleshooting a Service Connection that repeatedly flaps, causing intermittent loss of access to internal applications for both mobile users and remote networks. The IPsec tunnel to the data center establishes but drops within minutes. Which TWO items should the administrator verify to isolate the cause? (Choose two.)

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application after a successful GlobalProtect connection. The administrator suspects that the issue is related to the split tunnel configuration. Which action should the administrator take to verify whether the application's subnet is included in the split tunnel?

A Prisma Access administrator is troubleshooting a remote network deployment where users experience intermittent connectivity failures. The administrator notices that the IPsec tunnel frequently flaps. Which component should the administrator check to determine if the tunnel is being renegotiated due to mismatched proposal settings?

An administrator is troubleshooting a Prisma Access deployment where mobile users authenticated through SAML intermittently lose access to internal resources after about an hour, though the GlobalProtect tunnel never drops. Reviewing logs shows the users still have valid tunnel sessions and assigned IP addresses. Which underlying condition is most likely causing the intermittent access loss?

An SSE engineer is investigating why a Prisma Access mobile user's traffic to a SaaS application is being inspected by a decryption policy that should be bypassed. The decryption policy has a source user group that should exclude this user, and the user is a member of a different group. The engineer confirms the user's group membership in the identity provider is correct. Which factor is most likely causing the decryption policy to match unexpectedly?

A Prisma Access engineer is troubleshooting a Service Connection that is not establishing. The engineer suspects that the issue is related to the Service Connection configuration or network reachability. Which two actions should the engineer perform to validate the Service Connection status and connectivity? (Choose two.)

An administrator is troubleshooting a Prisma Access remote network where IPsec tunnel status shows up, but traffic from the branch is intermittently dropped when it exceeds a certain throughput. The branch has a single ISP link with 500 Mbps capacity and the tunnel is configured with default settings. Which cause should the administrator investigate first?

A Prisma Access administrator is troubleshooting a mobile user who reports that they can connect via GlobalProtect but cannot access any internal resources. The administrator suspects that the issue is related to the user's group mapping. Which log type in Prisma Access should the administrator review to verify user-to-group mapping?

A Prisma Access administrator needs to verify that the GlobalProtect portal is presenting the correct certificate to mobile users during authentication. Which tool should the administrator use to inspect the certificate presented by the portal?

A Prisma Access administrator is troubleshooting an issue where remote network users experience slow throughput to a specific SaaS application. The administrator suspects that the traffic is not being optimized by the Prisma Access cloud. Which feature should the administrator verify is enabled to ensure optimal routing?

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

A Prisma Access administrator is troubleshooting a mobile user who reports that they cannot access any internal resources after connecting via GlobalProtect. The administrator checks the GlobalProtect status and sees that the user is connected. Which log should the administrator review first to determine why the user's traffic is being blocked?

A Prisma Access administrator is troubleshooting a remote network where users cannot reach a SaaS application that is accessed via a Service Connection. The administrator confirms that the IPsec tunnel is up and that the Service Connection is healthy. Which configuration element should the administrator verify next to ensure that traffic from the remote network is routed to the Service Connection?

A Prisma Access administrator is troubleshooting GlobalProtect mobile users who intermittently lose access to internal applications reachable through a service connection. The administrator confirms the service connection IPsec tunnels are up and BGP routes are present, but the users' sessions drop roughly every 30 minutes. Which action should the administrator take first to isolate the cause?

A Prisma Access administrator is troubleshooting an issue where mobile users are unable to access a specific internal application after a recent change. The administrator suspects that the issue is related to the service connection's routing. The administrator runs 'show routing route' on the service connection and sees the route to the internal subnet is missing. The remote network's BGP configuration shows the subnet is being advertised. What is the most likely cause?