SSE-Engineer Practice Test 11 — 15 Questions

Question 1

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the IPsec tunnel's IKE and IPsec security associations. Verifying the IPsec tunnel's IKE and IPsec security associations ensures that the tunnel is stable and using appropriate parameters, while checking for packet fragmentation and MTU issues addresses a common cause of throughput degradation. Both actions are diagnostic and directly related to identifying why throughput is slow. They help the administrator pinpoint whether the problem is due to security association renegotiation or packet fragmentation.

Answer

Increase the tunnel's bandwidth allocation in the Prisma Access portal

Answer

Enable jumbo frames on the tunnel interface

Answer

Restart the IPsec tunnel to clear any transient errors

Question 2

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confirm that the SaaS application is recognized and that the appropriate Service Connection is selected for optimal egress.. Prisma Access uses application identification to classify SaaS traffic and then selects the optimal Service Connection based on factors like proximity and health. If the application is not recognized, it may be routed through a default Service Connection that is not optimal. Ensuring the application is recognized and that the Service Connection selection is correct is essential for optimal performance.

Answer

Ensure that the SaaS application is included in an Application Override policy.

Answer

Check that the IPsec tunnel to the remote network is using IKEv2 with AES-256 encryption.

Answer

Verify that the 'Optimize Traffic' setting is enabled in the Service Connection configuration.

Question 3

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic logs. Traffic logs are the most appropriate first source because they record every session and indicate which security policy was applied and whether the action was allow or deny. By examining the traffic logs, the administrator can see the exact rule that is blocking the user's traffic and the destination being accessed. This information is critical for determining whether the issue is due to a misconfigured security policy, a missing route, or another factor.

Answer

System logs

Answer

Authentication logs

Answer

HIP match logs

Question 4

A Prisma Access administrator is troubleshooting a remote network where users experience slow throughput over the IPsec tunnel. The administrator suspects that the issue is related to the IPsec configuration or the underlying network. Which two actions should the administrator take to identify the cause? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The remote network's static routes. The remote network's static routes are the correct element to verify because they determine how traffic from the branch is forwarded to Prisma Access and then to the Service Connection. If the static route for the SaaS application's subnet is missing or points to the wrong next hop, traffic will not reach the Service Connection. Ensuring that the remote network has a route to the Service Connection for the SaaS application's IP range is essential for connectivity.

Answer

The GlobalProtect portal's agent configuration

Answer

The mobile user's HIP profile

Answer

The Service Connection's BGP configuration

Question 5

An administrator has deployed Prisma Access with a single service connection to an on-premises data center. Branch users at a remote network report that traffic to an internal application hosted behind the data center firewall is being dropped, even though Security policy allows it. The administrator confirms the remote network tunnel is up and the service connection is green. Which configuration element should the administrator verify to allow the branch-to-data-center traffic to traverse the Prisma Access infrastructure?

Accepted Answer

The Service Connection's advertised routes and the remote network's route table to ensure the data center prefix is reachable.. Branch-to-data-center traffic in Prisma Access depends on the service connection advertising the on-premises prefixes and the remote network learning them. If the data center prefix is not present in the remote network's route table, Prisma Access has no path and drops the traffic. The correct troubleshooting step is to verify route advertisement and the remote network route table, not portal agent settings or decryption policy, which apply to different traffic types.

Answer

The decryption policy on the remote network firewall to ensure the application traffic is not being blocked by SSL inspection.

Answer

The Remote Network's static route for the data center subnet pointing to the service connection.

Answer

The GlobalProtect portal agent configuration to confirm the branch users are assigned the correct internal DNS suffix.

Question 6

An administrator has deployed Prisma Access with a single Service Connection to an on-premises data center. Branch users at a Remote Network site report intermittent access to internal applications, while internet-bound traffic works reliably. The administrator suspects the Service Connection is the cause. Which action should the administrator take to confirm whether the Service Connection is the source of the problem?

Accepted Answer

Review the Service Connection status in Prisma Access Insights and verify the IPsec tunnel state and BGP session status for the affected Service Connection.. Service Connection health is visible in Prisma Access Insights, which reports tunnel and BGP status. Intermittent internal application access with working internet traffic strongly suggests a routing or tunnel problem on the Service Connection. Checking tunnel state and BGP session status directly validates whether the Service Connection is failing.

Answer

Verify the decryption policy applied to the Remote Network to ensure internal application traffic is not being dropped due to certificate errors.

Answer

Check the GlobalProtect app logs on the branch user endpoints to identify whether authentication failures are causing the intermittent access.

Answer

Run a packet capture on the Prisma Access mobile user portal to inspect traffic between the branch and the data center.

Question 7

An administrator notices that Remote Network (branch) traffic to SaaS applications is being backhauled through the corporate data center instead of breaking out locally at the Prisma Access node. The administrator wants branch traffic destined to trusted SaaS applications to egress directly from the Prisma Access service connection. Which Prisma Access capability should be used to accomplish this?

Accepted Answer

Enable Local Breakout on the Remote Network and use an Application filter in a Security policy rule to allow trusted SaaS traffic directly to the internet.. Local Breakout on a Remote Network lets selected traffic leave the branch directly to the internet instead of traversing the Service Connection to the corporate data center. Pairing it with an Application filter in a Security policy rule ensures only trusted SaaS applications are broken out, keeping other traffic on the backhauled path. This delivers the lowest-latency path for SaaS while preserving centralized inspection for general traffic.

Answer

Configure a Service Connection with a static route to the SaaS provider.

Answer

Configure a GlobalProtect portal agent configuration to force all branch traffic through the mobile users' preferred gateway.

Answer

Create a Decryption policy that exempts SaaS traffic from inspection so it bypasses the Service Connection.

Question 8

An administrator has deployed Prisma Access for a branch office remote network that must reach a SaaS application through a service connection. After committing the configuration, users report that traffic is being dropped at the remote network firewall with the message 'no matching service connection found.' The administrator verifies that the service connection is up and the SaaS application is in the correct region. What is the most likely cause?

Accepted Answer

The service connection is not associated with the remote network in the Prisma Access configuration, so return traffic cannot be matched to the correct tunnel.. A remote network must be explicitly associated with one or more service connections in Prisma Access for traffic to be routed through them. The error message 'no matching service connection found' indicates that the cloud infrastructure could not find a service connection configured for that remote network. The administrator should verify and add the correct service connection association in the remote network settings, then commit the change.

Answer

The IPSec tunnel between the remote network and Prisma Access is using IKEv1, which does not support service connection routing.

Answer

The SaaS application's IP addresses are not included in the remote network's static routes, so Prisma Access cannot forward the traffic.

Answer

The remote network's traffic is not being routed to the service connection because the associated security policy rule does not include the correct destination zone.

Question 9

An administrator is deploying a new Prisma Access tenant for a company with branch offices in North America and Europe. The security team requires that all branch traffic egress through a Prisma Access location in the same region as the branch to minimize latency, while still allowing failover to another region during an outage. Which Prisma Access configuration should the administrator implement?

Accepted Answer

Configure a Remote Network for each branch and assign a primary and secondary Prisma Access location based on region, then enable traffic steering to prefer the primary location.. Remote Networks in Prisma Access can be assigned to specific locations, and the platform supports a primary and secondary location for redundancy. Choosing locations by region keeps branch traffic local to reduce latency, while the secondary location provides failover during an outage. This combination directly satisfies both the regional egress and resilience requirements.

Answer

Deploy Prisma Access in a single region and use GlobalProtect mobile user licenses for branch offices to connect to that region.

Answer

Configure Service Connections in each region and attach all Remote Networks to every Service Connection to allow any-to-any routing.

Answer

Create a single Remote Network for all branches and route all traffic through the Prisma Access location closest to the corporate headquarters.

Question 10

An administrator has configured a Service Connection in Prisma Access with BGP to advertise internal routes. After a configuration change, internal users can no longer reach resources in a specific subnet. The administrator verifies that the BGP session is established and that the subnet is advertised from the on-premises router. Which action should the administrator take to ensure that Prisma Access accepts and uses the advertised route?

Accepted Answer

Verify that the Service Connection's BGP configuration includes the correct import/export rules and that the subnet is not filtered out.. BGP import/export rules on the Service Connection determine which routes Prisma Access accepts. Even with an established session and advertisement from the on-premises router, a filtering rule can prevent the subnet from being installed. Verifying these rules ensures the route is accepted and used for internal traffic.

Answer

Modify the security policy to allow traffic to the specific subnet.

Answer

Restart the IPsec tunnel to force a BGP session re-establishment and route refresh.

Answer

Configure a static route on the Service Connection for the missing subnet.

Question 11

A security administrator notices that Prisma Access is not enforcing a URL Filtering profile for traffic from a specific Remote Network. The profile is applied in a security policy rule that matches the Remote Network's source zone. The administrator confirms the rule is present and enabled. What is the most likely cause?

Accepted Answer

A higher-priority security rule above the intended rule is matching the traffic and allowing it without a URL Filtering profile.. Prisma Access security rules are processed in order, and the first matching rule determines the action and profiles applied. If a preceding rule allows the traffic without URL Filtering, the later rule with the profile is never evaluated. Checking rule order and hit counts is essential when a profile appears not to be enforced.

Answer

The URL Filtering profile is not attached to the security rule, but instead only referenced in a Decryption policy.

Answer

The Remote Network's source zone is not included in the security rule, so the rule is being skipped.

Answer

URL Filtering requires a Decryption policy to inspect HTTPS traffic, and without decryption the profile cannot enforce any categories.

Question 12

An administrator is reviewing Prisma Access logs to investigate a security incident. The administrator needs to identify which user accessed a specific malicious URL. Which log type in Prisma Access provides the user identity along with the URL and action taken?

Accepted Answer

URL filtering logs. URL filtering logs in Prisma Access are specifically designed to record web requests, including the URL, the category, the action taken, and the user identity when User-ID is enabled. This makes them the ideal log type to determine which user accessed a particular malicious URL. Other log types serve different purposes, such as traffic logs for session details or threat logs for security events.

Answer

Data filtering logs

Answer

Traffic logs

Answer

Threat logs

Question 13

An administrator is configuring Prisma Access to enforce security policies for mobile users based on the user's department. The administrator wants to ensure that only members of the 'Finance' department can access a sensitive internal application. Which Prisma Access feature should the administrator use to dynamically assign users to a policy group based on their department attribute from the identity provider?

Accepted Answer

Cloud Identity Engine (CIE) with SAML attributes for user group mapping.. The Cloud Identity Engine (CIE) integrates with identity providers to synchronize user and group data, including SAML attributes. By mapping the department attribute to a policy group, the administrator can enforce policies that allow only Finance department users to access the sensitive application. CIE provides a scalable, cloud-based solution without the need for on-premises agents, making it ideal for this scenario.

Answer

Prisma Access explicit proxy with LDAP authentication for group lookup.

Answer

GlobalProtect HIP profiles with custom checks for department registry keys.

Answer

User-ID agent with group mapping from Active Directory.

Question 14

An administrator is configuring Prisma Access to provide secure internet access for mobile users. The organization requires that all traffic to known malicious domains be blocked, and that SSL decryption be performed for traffic to categories such as 'malware' and 'phishing' to inspect for threats. The administrator enables SSL decryption in the decryption policy for these categories. However, after testing, users can still access some known malicious sites without any block or decryption. What is the most likely reason?

Accepted Answer

The URL filtering profile that blocks malicious sites is not attached to the security policy rule that allows the traffic.. To block access to known malicious domains, a URL filtering profile must be applied to the security policy rule that allows the traffic. SSL decryption enables inspection of encrypted traffic, but the actual blocking is performed by the URL filtering profile. Without attaching the profile to the security rule, traffic will be decrypted but not blocked, allowing users to access malicious sites.

Answer

The decryption policy is configured to exclude traffic to malicious categories to avoid breaking sites.

Answer

The decryption policy is applied only to traffic from remote networks, not mobile users.

Answer

The mobile users are not configured to use the Prisma Access DNS proxy, so domain resolution bypasses security inspection.

Question 15

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch office users cannot reach external websites. Which TWO configuration areas or logs should the administrator check to resolve this issue? (Choose two)

Accepted Answer

Panorama > Policy > Security rules allowing trust-to-untrust traffic. Option B is correct because in a Prisma Access Remote Networks deployment, security policy is managed centrally through Panorama, and a missing or misconfigured trust-to-untrust security rule will silently drop branch user traffic destined for the internet, so verifying the rulebase is essential. Option D is correct because Remote Networks connectivity depends on the routing configuration pushed from Panorama, including static routes or BGP peering with the Prisma Access service connection; if routes are missing or the BGP session is down, branch traffic never reaches the internet. Option A is incorrect because Insight mobile user license allocation applies to Mobile Users (GlobalProtect) licensing, not Remote Networks branch traffic. Option C is incorrect because the GlobalProtect Portal client certificate store is relevant to Mobile Users authentication, not to Remote Networks site-to-site tunnels. Option E is incorrect because the WildFire analysis report queue concerns threat analysis results and has no bearing on basic internet reachability for branch users.

Answer

Prisma Access Insight mobile user license allocation

Answer

GlobalProtect Portal client certificate store

Answer

WildFire analysis report queue