Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?
BGP
Prisma Access natively supports BGP over its IPsec tunnels, allowing dynamic route exchange with the corporate data centre without extra overlay protocols. This satisfies the stem's requirement for a natively supported dynamic routing protocol across the Service Connection.
EIGRP
RIPv2
OSPF
An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?
Zone Protection profile
Antivirus profile
Data Filtering profile
A Data Filtering profile inspects traffic for sensitive data patterns and file types, blocking uploads of proprietary content to unsanctioned cloud storage. Applied to Security Policy rules, it satisfies the requirement to prevent data exfiltration via unauthorised applications.
URL Filtering profile
An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?
Monitor -> Traffic -> Session End
Objects -> Authentication -> SAML Test
Monitor -> Logs -> Authentication
Monitor → Logs → Authentication in Panorama records SAML assertion failures and IdP connectivity events for Prisma Access mobile users, directly satisfying the requirement to verify authentication timeouts. Unlike system or traffic logs, this log type captures the identity-provider exchange, letting the administrator confirm whether Microsoft Entra ID responses are reaching the gateway.
Panorama -> Cloud Services -> Health -> Infrastructure
A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?
Prisma Access DNS Security sinking
HTTP Header Insertion / Restricted Tenant Access
Prisma Access can insert specific HTTP headers (such as Restricted-Access-Current-Tenant) into outbound requests to cloud services, forcing corporate tenants only.
GlobalProtect Client-less VPN rewriting rules
SaaS Security API inline scanning
Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?
Threat log
Data Filtering log
HIP Match log
URL Filtering log
The URL Filtering log records each web request with its assigned category rating and the resulting allow or block action, giving the administrator the browsing detail required. It is the only log type that pairs URL category with user web activity.
Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?
Prisma Access Remote Network IPsec
Prisma Access Browser
Explicit Proxy Forwarding
GlobalProtect Client-less VPN
Client-less VPN renders access through a browser, requiring no GlobalProtect agent installation. This satisfies the constraint that contractors use managed or unmanaged devices where agent deployment is impossible, while still enforcing least-privilege, identity-based access policies.
Want more Prisma Access Services practice?
Practice this domainAn administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?
Check whether the GlobalProtect client version on the user's laptop is up to date.
Ensure that WildFire analysis is disabled for inbound decrypted traffic.
Verify that the correct server certificate and private key are imported into Panorama and bound to the Inbound Decryption rule.
Inbound decryption terminates TLS at Prisma Access, which then re-encrypts to the backend using a certificate bound to the rule. If that server certificate and private key are missing or mismatched in Panorama, clients receive warnings, so verify the binding first.
Verify the OCSP responder settings under Device > Setup > Sessions.
A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?
Panorama > Cloud Services > Setup > Management.
Prisma Access > Service Setup > Locations.
Policies > Security.
Monitor > Logs > Threat.
Monitor > Logs > Threat displays threat signatures and verdicts in real time, letting the administrator filter by the specific mobile user to see why the malicious file was blocked. Other log types lack threat verdict detail.
An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?
The GlobalProtect client software license has expired on Panorama.
Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.
SAML assertions carry NotBefore and NotOnOrAfter conditions. If the IdP and Prisma Access service nodes disagree on time beyond the tolerance window, Prisma Access rejects an assertion the IdP considered valid, producing exactly this split-log discrepancy.
The User-ID agent service on the Panorama management server is stopped.
WildFire cloud subscription has lapsed.
An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?
Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.
The split-tunnel DNS suffix list governs which queries GlobalProtect forwards to internal resolvers, so a missing or malformed corporate domain entry here directly explains internal-only resolution failures while external lookups succeed. Verify the DNS suffix and resolver settings under Client Config, since that configuration is pushed to mobile users and overrides local device DNS behaviour.
Panorama > Prisma Access > Monitoring > ACC.
Panorama > Cloud Services > Status > Traffic Log.
Panorama > Firewall > Network Profiles > Interface.
A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?
Panorama > Cloud Services > Status.
Panorama > Cloud Services > Status is the dedicated workspace aggregating Prisma Access infrastructure health, showing deployed Mobile User nodes and their operational state per region. Other Panorama areas cover policy or logs, not infrastructure status.
Objects > Certificates.
Policies > QoS.
Monitor > Managed Devices.
An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?
Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.
Custom App-IDs bind non-standard TCP ports to application signatures, so App-ID inspection recognises and permits that traffic. Without this mapping, the firewall cannot identify the application on those ports, and security rules referencing the custom App-ID will not match, causing connection failures through the Remote Network node.
Configure a static NAT rule for the non-standard ports on the service connection.
Disable GlobalProtect pre-logon mode.
Enable SSL Forward Proxy on the destination zones.
Want more Prisma Access Troubleshooting practice?
Practice this domainWhen planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?
Static IP assignment per user via Active Directory attributes
Static IP assignment via local DHCP server in each branch office
Manual entry by users upon connection
Automatic IP address allocation managed by Prisma Access
Prisma Access assigns virtual IPs to GlobalProtect clients automatically from its own pool, removing the need for external DHCP or manual configuration. This satisfies the mobile-user scenario's requirement for scalable, low-administration address assignment across distributed clients.
During the initial deployment of Prisma Access for remote networks, an administrator needs to define the bandwidth allocation for a specific compute location. Which tool is used to manage and push this bandwidth allocation?
Panorama
Panorama centrally manages Prisma Access configuration, including remote network bandwidth allocation for each compute location, then pushes it to the service. This satisfies the requirement to define and deploy bandwidth settings from a single management plane.
Prisma SD-WAN Cloud Controller
Prisma Access Plugin for AWS Console
GlobalProtect Portal standalone web GUI
An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?
Explicit Proxy PAC file routing
SD-WAN Traffic Steering Policies
GlobalProtect Split Tunneling based on Access Routes and Domains
GlobalProtect split tunnelling with access routes and domains directs only the specified SaaS traffic outside the tunnel, so that traffic egresses directly to the internet rather than through Prisma Access processing nodes. This satisfies the stem's requirement to bypass cloud security inspection for those applications while other traffic remains protected.
SSL Decryption Exclusion Objects
An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?
A dedicated hardware Panorama appliance in each branch office
Prisma SD-WAN appliances at every remote user laptop
A single centralized Prisma Access parent node in the headquarters region
Multiple Security Processing Nodes (SPNs) distributed across multiple geographic regions
Distributing SPNs across North America, Europe and Asia places security processing within each region, so remote workers' traffic is inspected at the nearest node rather than backhauled to a central location. This directly satisfies the low-latency requirement by minimising geographic distance between user and processing point.
An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?
Prisma SD-WAN Hub Integration
GlobalProtect Gateway Connection
Remote Network Connection
Service Connection
A service connection provides the IPSec tunnel and routing that carries headquarters-bound traffic from the data centre into Prisma Access, satisfying the requirement for secure connectivity to the corporate data centre rather than remote-user or internet-bound access.
A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?
In the Prisma SD-WAN DNS proxy forwarding table
In the Panorama GlobalProtect Client Settings configuration under Network Settings
GlobalProtect client settings in Panorama push DNS server addresses to the endpoint agent, so split-tunnel DNS queries for internal domains resolve against corporate resolvers. Configuring primary and secondary addresses under Network Settings satisfies the requirement that internal DNS resolution be used while users are connected through the GlobalProtect app.
Directly on the remote user local machine registry
In the cloud Managed Security Services Provider (MSSP) portal
Want more Prisma Access Planning And Deployment practice?
Practice this domainAn administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?
Objects > GlobalProtect > DNS Profile
Panorama > Cloud Services > Configuration > Mobile Users > Client Settings
Client Settings under Mobile Users in Panorama's Cloud Services configuration pushes DNS server addresses and suffix to GlobalProtect mobile users, forcing internal name resolution through corporate resolvers. This satisfies the stem's constraint that mobile users must not fall back to public DNS.
Device > Setup > Services > DNS
Network > GlobalProtect > Gateway > DNS
An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?
Prisma Access App > Traffic Steering > Remote Networks
Panorama > Cloud Services > Configuration > Remote Networks
Remote network configuration lives under Panorama's Cloud Services plugin, at Configuration > Remote Networks. This is the central management plane where branch onboarding, IPsec termination settings and licensing are defined before push to Prisma Access.
Policies > Security > Remote Networks
Device > Setup > Operations > Remote Networks
A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?
Configure a User-ID agent on every branch router.
Install the GlobalProtect agent with local syslog forwarding.
Enable captive portal authentication on all remote network firewalls.
Configure Cloud Identity Engine (CIE) settings in Panorama to sync directory services.
Configuring Cloud Identity Engine settings in Panorama syncs directory services and maps users to IP addresses for GlobalProtect mobile users in Prisma Access. This satisfies the User-ID requirement, since CIE supplies the user-to-IP mapping that the firewall consumes.
A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?
In the Source Device field, select the Cloud Identity Engine connector object.
In the IP/Netmask field, enter the subnet assigned by the CIE connector.
In the Destination field, specify the LDAP server IP address.
In the Source User field, add the fully qualified group name provided by CIE.
Cloud Identity Engine syncs Active Directory groups, so the Security rule's Source User field must reference the fully qualified group name CIE provides; this lets policy match users by synced group membership rather than individual accounts.
An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?
Antivirus and Anti-Spyware profiles
Antivirus and Anti-Spyware profiles are the only profile types that scan traffic streams for malware and spyware signatures. Attaching them to the Security policy rule satisfies the requirement to inspect outbound web traffic from mobile users through Prisma Access.
Decryption profile and URL filtering profile only
QoS Profile and Zone Protection profile
HIP Profile and WildFire analysis profile
Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?
WildFire Portal reporting
Panorama Packet Capture utility
Prisma Access ADEM (Autonomous Digital Experience Management)
Prisma Access ADEM delivers synthetic and real-user monitoring across the full traffic path, capturing hop-by-hop network telemetry, application response times and endpoint experience metrics. This satisfies the stem's demand for end-to-end visibility plus DEM, which basic health dashboards or log-only tools cannot provide.
GlobalProtect Syslog Analyzer
Want more Prisma Access Administration And Operation practice?
Practice this domainThe vendor does not publish an exact question count for the SSE-Engineer. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Prisma Access Services, Prisma Access Troubleshooting, Prisma Access Planning And Deployment, Prisma Access Administration And Operation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks SSE-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.