SSE-Engineer Practice Test 10 — 10 Questions

Question 1

A network security administrator is configuring Prisma Access to provide secure web gateway services to mobile users. The requirement is that all web traffic from the mobile users must be inspected for threats and URL filtering, and the administrator wants the simplest deployment that does not require installing certificates on the endpoints. Which Prisma Access capability should the administrator enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect with the Prisma Access security processing node inspecting the tunneled traffic.. GlobalProtect tunnels the mobile user's traffic to a Prisma Access security processing node, where it is inspected for threats and URL filtering without requiring proxy configuration or endpoint certificate installation. This is the standard and simplest way to provide secure web gateway services to mobile users, and it covers all traffic from the endpoint rather than only browser traffic. Explicit proxy requires client configuration, and SSL decryption requires a trust certificate on each endpoint.

Answer

A remote network connection that tunnels branch web traffic to Prisma Access for inspection.

Answer

Explicit proxy with authentication, requiring the browser to be configured with a proxy address and port.

Answer

SSL decryption with a forward proxy trust certificate installed on each endpoint.

Question 2

A Prisma Access administrator is troubleshooting a mobile user who cannot access a specific internal web application. The application is reachable from other mobile users, and the user's GlobalProtect connection is established. The administrator wants to verify whether the user's traffic is being decrypted and inspected by the security policy. Which TWO actions should the administrator take to confirm that SSL decryption is applied to the user's session? (Choose two.)

Accepted Answer

Review the decryption logs to see if the session appears. To confirm SSL decryption is applied to a specific session, the administrator should check both traffic logs and decryption logs. The traffic log's 'Decrypted' flag indicates whether the session was decrypted, while decryption logs provide detailed records of decrypted sessions, including the policy matched. Together, they verify that decryption occurred and can help identify why a security policy may not have blocked the traffic.

Answer

Check the system logs for decryption-related events

Answer

Examine the GlobalProtect app logs on the user's endpoint for SSL errors

Answer

Use the Prisma Access CLI to run 'show session all' for the user

Question 3

A security engineer is configuring Prisma Access to protect mobile users from malicious downloads. The requirement is that files downloaded from the internet by mobile users must be analyzed for zero-day malware, and the analysis must not delay the user's download. Which Prisma Access feature should the engineer configure?

Accepted Answer

WildFire cloud analysis with the forward file copy while the download proceeds.. WildFire cloud analysis forwards a copy of the downloaded file to the WildFire cloud for sandbox analysis while allowing the user's download to continue, so there is no delay. If the file is found malicious, a signature is delivered to the security processing node to block future downloads and to generate WildFire logs. Inline machine learning, file blocking, and decryption do not by themselves provide cloud sandbox analysis without delaying the user.

Answer

WildFire inline machine learning with real-time signature delivery to the security processing node.

Answer

A file blocking profile that blocks all executable files from the internet for mobile users.

Answer

A decryption policy with a forward proxy trust certificate to inspect the download content.

Question 4

An administrator needs to ensure that Prisma Access mobile users are authenticated using multi-factor authentication (MFA) before accessing corporate resources. Which Prisma Access component is responsible for enforcing MFA?

Accepted Answer

Identity Provider (IdP). MFA is enforced by the Identity Provider (IdP) that Prisma Access uses for SAML authentication. The IdP challenges users for additional credentials, and Prisma Access accepts the authentication result. Other components like the portal or gateway do not enforce MFA themselves.

Answer

Prisma Access security policy

Answer

GlobalProtect portal

Answer

GlobalProtect gateway

Question 5

A network administrator is troubleshooting a Prisma Access remote network deployment where users at a branch office are experiencing slow access to cloud applications. The administrator has verified that the IPsec tunnel is up and that there is no packet loss on the tunnel. Which tool should the administrator use to monitor the performance and latency of the Service Connection?

Accepted Answer

Prisma Access Dashboard's Service Connection health metrics. The Prisma Access Dashboard's Service Connection health metrics are specifically designed to monitor the performance of Service Connections, including latency, jitter, and packet loss. When remote network users experience slow access to cloud applications despite a healthy IPsec tunnel, the bottleneck may be at the Service Connection. Using the dashboard metrics allows the administrator to quickly assess if the Service Connection is experiencing degraded performance.

Answer

Panorama's Managed Devices health monitor

Answer

CLI commands on the remote network firewall to check tunnel statistics

Answer

GlobalProtect app logs on the branch office users' devices

Question 6

A Prisma Access administrator is troubleshooting a mobile user who cannot access an internal application after a successful GlobalProtect connection. The administrator suspects that the issue is related to the split tunnel configuration. Which action should the administrator take to verify whether the application's subnet is included in the split tunnel?

Accepted Answer

Check the GlobalProtect app logs on the user's endpoint for tunnel routes.. Split tunnel configuration in GlobalProtect determines which traffic is routed through the VPN tunnel and which goes directly to the internet. When a user cannot reach an internal application, it is often because the application's subnet is not included in the split tunnel access routes. The most reliable way to verify this is to inspect the GlobalProtect app logs on the endpoint, which record the routes added to the routing table. This confirms whether the subnet is correctly tunneled.

Answer

Run a traceroute from the user's endpoint to the internal application.

Answer

Check the HIP profile match for the user in Prisma Access.

Answer

Review the Prisma Access system logs for split tunnel errors.

Question 7

An administrator needs to provide access to a private web application hosted in an on-premises data center for a group of remote contractors. The contractors will use personal devices and must authenticate via SAML. The application uses HTTPS on port 443. Which Prisma Access feature should be used to securely publish this application without requiring a GlobalProtect agent?

Accepted Answer

Prisma Access Private Application with SAML authentication and clientless access. Prisma Access Private Applications provide clientless access to private web apps with SAML authentication. This is designed for unmanaged devices and contractors. Service Connections and Remote Networks are for network-level connectivity, and Mobile Users requires an agent.

Answer

Mobile Users with GlobalProtect and split tunneling enabled for the application

Answer

Service Connection with a static route to the data center and a security policy allowing the contractors

Answer

Remote Network with an IPsec tunnel from the contractors' location to Prisma Access

Question 8

An administrator is troubleshooting a Prisma Access deployment where mobile users authenticated through SAML intermittently lose access to internal resources after about an hour, though the GlobalProtect tunnel never drops. Reviewing logs shows the users still have valid tunnel sessions and assigned IP addresses. Which underlying condition is most likely causing the intermittent access loss?

Accepted Answer

The SAML identity provider group mapping or session timeout is expiring, causing user-to-group mappings to be lost.. Access that fails roughly hourly while the tunnel and address stay valid points to identity rather than network state. SAML group mappings and identity provider sessions have finite lifetimes; when they expire, group-based policy no longer matches and internal access is denied. Refreshing group mapping or extending session lifetime restores the missing identity context.

Answer

The Service Connection IPsec tunnel is rekeying every hour and briefly dropping internal routes.

Answer

The GlobalProtect gateway is load-balancing users across multiple gateways and reassigning addresses mid-session.

Answer

The decryption policy is re-evaluating certificates hourly and blocking re-established sessions.

Question 9

An administrator is deploying a new Prisma Access Remote Network location and needs to ensure that traffic from the branch is inspected by security policies before reaching the internet. Which configuration step is required to direct traffic to Prisma Access for inspection?

Accepted Answer

Configure a static route on the branch router pointing all traffic to the Prisma Access tunnel interface.. The correct answer is to configure a static route on the branch router pointing all traffic to the Prisma Access tunnel interface. This ensures that all internet-bound traffic is directed through the IPSec tunnel to Prisma Access, where security policies are applied. Without this route, traffic might bypass Prisma Access and go directly to the internet, leaving it uninspected.

Answer

Enable split tunneling on the branch router to send only corporate traffic through the tunnel.

Answer

Set up a GRE tunnel to Prisma Access for all traffic.

Answer

Configure policy-based routing to send only HTTP and HTTPS traffic to Prisma Access.

Question 10

An engineer is configuring Prisma Access for a remote network location that uses an IPSec tunnel to connect to the Prisma Access infrastructure. The engineer needs to ensure that the tunnel is highly available and can fail over to a secondary ISP if the primary ISP fails. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Configure two IPSec tunnels to the same Prisma Access location using different ISPs.. To achieve high availability for a remote network with IPSec tunnels, you must configure two tunnels using different ISPs and enable BGP on both. This allows dynamic failover if one ISP fails. BGP ensures that routes are withdrawn and traffic is rerouted over the remaining tunnel, maintaining connectivity.

Answer

Use a single ISP with a backup link that is not actively used.

Answer

Configure the remote network to use a dynamic IP address for the IPSec tunnel.

Answer

Configure a single IPSec tunnel with multiple proxy IDs for redundancy.