SSE-Engineer Practice Test 12 — 15 Questions

Question 1

A security engineer is configuring a Prisma Access Remote Network location with redundant IPsec tunnels to ensure high availability. What configuration requirement must be met on the customer premise equipment (CPE) router to support dynamic routing over these redundant tunnels?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BGP peering must be established across both tunnels with the Prisma Access service node.. To support dynamic routing over redundant IPsec tunnels between a CPE router and Prisma Access, BGP peering must be established across both tunnels. Prisma Access uses BGP to exchange routes and detect failures, enabling automatic failover and load sharing. Without BGP, the CPE cannot dynamically learn routes or react to tunnel failures.

Answer

Static floating routes with identical metrics must be used.

Answer

OSPF area 0 must be configured on the CPE interface.

Answer

GRE encapsulation must wrap the IPsec packets.

Question 2

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Accepted Answer

Implement dynamic routing protocols (BGP) over the IPsec tunnels to facilitate automatic failover.. Option B is correct because running BGP over the IPsec tunnels lets the branch CPE and Prisma Access dynamically withdraw and re-advertise routes, so traffic automatically fails over to a surviving tunnel without manual intervention. Option C is correct because deploying dual customer edge routers at the branch removes the single point of failure on the customer side, allowing each router to terminate its own IPsec tunnel to Prisma Access and preserve connectivity if one router or its WAN link fails. Option D is correct because redundant IPsec tunnels from the CPE to diverse Prisma Access gateways ensure that the loss of one gateway or tunnel does not sever the remote network's connection, which is the core of Remote Networks high availability. Option A is not applicable because Prisma Access is a cloud-delivered service where the customer does not cluster physical firewalls inside the cloud infrastructure; HA is achieved through redundant tunnels and gateways instead. Option E is wrong because manually updating static routes on employee laptops is operationally infeasible and does not provide automatic failover, which is the goal of the design.

Answer

Cluster physical firewalls in an Active-Active HA pair inside the Prisma Access cloud infrastructure.

Answer

Manually update static routes on employee laptops whenever a remote network link fails.

Question 3

Which log category in Prisma Access records events when a user's host information profile (HIP) changes or fails a compliance check?

Accepted Answer

HIP Match log. The HIP Match log records events related to Host Information Profile (HIP) checks, including when a user's HIP data changes or when the endpoint fails a compliance check defined in a HIP-enabled security policy. It is the specific log category used to audit endpoint compliance posture and HIP-based policy enforcement. Other log types cover different event classes and do not capture HIP match results.

Answer

System log

Answer

Configuration log

Answer

User-ID log

Question 4

An administrator is configuring Prisma Access Firewall as a Service (FWaaS) to protect outbound internet traffic from remote networks. They want to ensure that known command-and-control (C2) traffic and vulnerability exploits are blocked dynamically in real time. Which security profile should be applied to the security policy rules?

Accepted Answer

Anti-Spyware and Vulnerability Protection profiles. Anti-Spyware profiles detect and block command-and-control (C2) traffic, spyware, and known malicious callbacks, while Vulnerability Protection profiles block exploits targeting software vulnerabilities. Applying both to the security policy rule provides real-time dynamic blocking of C2 and exploit traffic.

Answer

URL Filtering and Decryption profiles only

Answer

Data Filtering and File Blocking profiles only

Answer

User-ID and Device-ID mapping policies

Question 5

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

Accepted Answer

Panorama > Cloud Services > Status > Mobile Users > Gateways.. The status of GlobalProtect gateways for Prisma Access mobile users, including real-time session and gateway responsiveness, is verified under Panorama > Cloud Services > Status > Mobile Users > Gateways. This page shows gateway status, connected users, and health metrics for the Prisma Access mobile user infrastructure.

Answer

Policies > Decryption.

Answer

Device > Setup > Operations.

Answer

Objects > Addresses.

Question 6

An enterprise wants to ensure that all internet-bound traffic from mobile users is decrypted and inspected for malware and sensitive data using Prisma Access SWG. Which GlobalProtect client traffic forwarding configuration ensures that all traffic is sent to Prisma Access?

Accepted Answer

Tunnel All Traffic mode. Tunnel All Traffic mode in GlobalProtect forces all client traffic, including internet-bound traffic, through the Prisma Access tunnel, ensuring it is decrypted and inspected by SWG. This is the configuration that guarantees no traffic bypasses Prisma Access.

Answer

Explicit Proxy local bypass mode

Answer

Split Tunnel mode based on destination subnets

Answer

Client-less Portal mode

Question 7

An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?

Accepted Answer

Data Filtering profile. Data Filtering profiles in Prisma Access are specifically designed to inspect traffic for sensitive data patterns (such as credit card numbers, SSNs, or custom data patterns) and to control uploads/downloads to SaaS applications. To block proprietary data uploads to unauthorized cloud storage, the Data Filtering profile is attached to the Security Policy rule alongside the App-ID for the cloud storage app. URL Filtering and Antivirus profiles do not perform content-based data pattern matching.

Answer

Zone Protection profile

Answer

Antivirus profile

Answer

URL Filtering profile

Question 8

An administrator configures a Service Connection in Prisma Access to reach an on-premises Active Directory domain controller for authentication. Users are able to log in, but User-ID is failing to map IP addresses to usernames for users behind the Remote Network. What is the most likely reason for this User-ID failure?

Accepted Answer

User-ID agent or Panorama redistribution is not configured to poll the internal Domain Controller across the Service Connection, or security rules block User-ID traffic.. User-ID mapping requires the firewall (or a User-ID agent/Panorama) to actively query domain controllers via WMI/ WinRM or read security event logs to correlate IP addresses with usernames. When users authenticate through a Service Connection to an on-premises DC but User-ID mapping fails, the most common cause is that no User-ID agent or Panorama-based redistribution is configured to poll that internal DC across the Service Connection, or security policy is blocking the User-ID traffic (WMI/RPC/NetBIOS) between Prisma Access and the DC.

Answer

The GlobalProtect client certificate has expired.

Answer

BGP routing is disabled on the GlobalProtect gateway.

Answer

WildFire subscription is expired.

Question 9

Users in a specific region are experiencing intermittent latency and packet loss when accessing SaaS applications through Prisma Access. The administrator wants to analyze the quality of the path between the remote network location and the Prisma Access cloud node. Which Prisma Access feature should be utilized?

Accepted Answer

Prisma Access Insight path quality monitoring. Prisma Access Insight path quality monitoring provides detailed metrics on the quality of the path between remote network locations and Prisma Access cloud nodes, including latency, packet loss, and jitter. This is the correct feature to analyze the quality of the path for troubleshooting intermittent latency and packet loss.

Answer

Panorama ACC Threat Map

Answer

Traffic log bandwidth utilization graphs

Answer

GlobalProtect internal adapter diagnostics

Question 10

An administrator configures a new Service Connection in Prisma Access to allow mobile users to access resources in the corporate data center. However, traffic from mobile users cannot reach the data center. The administrator confirms that the IPsec tunnel is up. What is the most likely cause of this issue in Panorama?

Accepted Answer

The internal subnet routes associated with the Service Connection have not been added to the Mobile Users Explicit Proxy or Split Tunnel configuration.. For mobile users to reach data center resources via a Service Connection, the internal subnet routes must be included in the Mobile Users configuration—either in the split tunnel or explicit proxy settings—so that traffic is directed through the Service Connection. Without these routes, mobile user traffic will not be forwarded to the data center even if the IPsec tunnel is up.

Answer

Panorama requires a reboot to activate Service Connections.

Answer

The GlobalProtect client version is outdated on all endpoints.

Answer

The WildFire public cloud subscription has expired.

Question 11

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

Accepted Answer

It provides centralized, unified security policy management and inspection.. Prisma Access simplifies management and provides consistent security policy enforcement across all locations.

Answer

It allows local traffic to bypass security inspection entirely.

Answer

It eliminates the need for internet connectivity at the branch.

Answer

It removes the need for any internal firewalls.

Question 12

An enterprise is deploying Prisma Access and wants to ensure that user identity mapping is gathered efficiently from Microsoft Entra ID (formerly Azure AD) without deploying physical User-ID agents inside the cloud network. Which integration method should be used?

Accepted Answer

Cloud Identity Engine (CIE). Cloud Identity Engine (CIE) is Palo Alto Networks' cloud-delivered identity service that ingests user identity from Microsoft Entra ID (and other IdPs) via API, without requiring on-premises User-ID agents. It maps users to IP addresses and groups and publishes that mapping to Prisma Access, enabling policy enforcement based on user identity. This is the recommended integration for cloud-only or agentless identity mapping.

Answer

WMI probing from Prisma Access nodes

Answer

GlobalProtect client registry polling

Answer

Syslog server parsing via Service Connection

Question 13

An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)

Accepted Answer

Granular action control such as allowing read-only access while blocking file uploads to sanctioned or unsanctioned SaaS tenants. Option A is correct because Prisma Access inline CASB provides granular SaaS action control, distinguishing activities like view/read versus upload/edit, and can apply these controls to both sanctioned and unsanctioned SaaS tenants discovered via Shadow IT. Option C is correct because Prisma Access SWG natively enforces URL filtering using URL categories, including web categories and threat/risk categories, to allow or block web traffic. Option E is correct because Prisma Access Data Filtering (DLP) inspects traffic inline to detect and block exfiltration of sensitive data patterns such as credit card numbers and PII. Option B is not correct because Prisma Access does not establish direct peer-to-peer BGP sessions with external public web servers; BGP is used for service infrastructure routing, not client-to-webserver peering. Option D is not correct because BIOS firmware flashing and motherboard diagnostics are endpoint hardware management functions, not capabilities of an SWG or inline CASB security policy.

Answer

Direct peer-to-peer BGP routing exchanges with external public web servers

Answer

Local BIOS firmware flashing and motherboard diagnostics for remote client laptops

Question 14

An administrator wants to configure Prisma Access Secure Web Gateway to block access to sites categorized as 'Gambling' during working hours, but allow them during lunch breaks. Which Panorama feature enables time-based policy enforcement?

Accepted Answer

Schedule Objects applied to Security Policy rules. Time-based policy enforcement in Panorama is achieved using Schedule Objects applied to Security Policy rules. A schedule defines specific days and times, and when attached to a rule, the rule is active only during those times, allowing Gambling sites to be blocked during working hours and allowed during lunch breaks.

Answer

Prisma Access Insights time-window filters

Answer

URL Filtering custom time-out profiles

Answer

GlobalProtect Portal connection timers

Question 15

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

Accepted Answer

Monitor > Reports.. Panorama's Monitor > Reports workspace provides historical reporting, including bandwidth utilization trends over time for managed firewalls and Remote Network locations. This is where you access predefined and custom reports that aggregate data over days, weeks, or months, making it the correct place to view 30-day bandwidth trends.

Answer

Device > Setup > Management.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Policies > QoS.