SSE-Engineer Practice Test 12 — 15 Questions

Question 1

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS Security. WildFire and DNS Security provide real-time threat intelligence and automated threat prevention across Prisma Access.

Answer

Prisma Access Insights

Answer

SaaS Security API

Answer

GlobalProtect Cloud Service Agent

Question 2

An administrator is setting up Prisma Access logging and monitoring. Which THREE logs or reporting features in Panorama provide insights into SWG, ZTNA, and CASB activities? (Choose three)

Accepted Answer

Threat logs for malware, spyware, and vulnerability exploit detections.. Panorama provides specialized logs for URLs, threats, traffic, and SaaS activities to monitor SSE domains.

Answer

Hardware environmental temperature and power supply status logs.

Answer

CLI debug logs from physical core router interfaces.

Question 3

An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)

Accepted Answer

Granular action control such as allowing read-only access while blocking file uploads to sanctioned or unsanctioned SaaS tenants. Prisma Access SWG and inline CASB allow administrators to control specific application actions (e.g., block uploads), inspect traffic using URL filtering categories, and enforce data loss prevention via Data Filtering profiles.

Answer

Direct peer-to-peer BGP routing exchanges with external public web servers

Answer

Local BIOS firmware flashing and motherboard diagnostics for remote client laptops

Question 4

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Question 5

When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?

Accepted Answer

GlobalProtect Portal. The GlobalProtect Portal handles user authentication, client software updates, and assigns the optimal GlobalProtect Gateway.

Answer

Service Connection

Answer

GlobalProtect Gateway

Answer

Remote Network

Question 6

An administrator is setting up Prisma Access and needs to ensure that mobile users connecting from managed corporate laptops can access internal resources, while unmanaged contractor laptops are restricted to web-based applications only. Which Prisma Access mechanism distinguishes between managed and unmanaged endpoints during connection?

Accepted Answer

GlobalProtect HIP (Host Information Profile) checks. GlobalProtect HIP (Host Information Profile) checks evaluate the endpoint state upon connection to verify if it meets corporate security requirements.

Answer

SAML Identity Provider group claims

Answer

Active Directory Security Group membership only

Answer

Prisma Access Explicit Proxy PAC file routing

Question 7

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

Accepted Answer

Shadow IT discovery and risk scoring of unapproved cloud applications. Prisma Access CASB allows administrators to discover shadow IT, control tenant access, and inspect file activities.

Answer

IPsec crypto profile selection for branch offices

Answer

GlobalProtect client software version deployment rules

Answer

WMI-based user mapping polling intervals

Question 8

An enterprise is integrating Prisma Access with their corporate infrastructure. Which THREE components can be connected to Prisma Access to provide centralized cloud security inspection? (Choose three)

Accepted Answer

Service Connections (corporate data centers or headquarters). Prisma Access connects Mobile Users, Remote Networks (branch offices), and Service Connections (data centers/HQ).

Answer

Local standalone firewalls operating in hardware bypass mode without cloud connection

Answer

Public cloud VPCs directly via automated cloud connectors without IPsec or BGP

Question 9

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anti-Spyware and Vulnerability Protection profiles. Anti-Spyware and Vulnerability Protection profiles inspect traffic passing through Prisma Access FWaaS to detect and block C2 callbacks, malware downloads, and exploit attempts.

Answer

URL Filtering and Decryption profiles only

Answer

Data Filtering and File Blocking profiles only

Answer

User-ID and Device-ID mapping policies

Question 10

An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)

Accepted Answer

System log. System logs and Authentication logs provide visibility into mobile user login events, GlobalProtect connection handshakes, and SAML/LDAP authentication results.

Answer

WildFire submission log

Answer

HIP Match log

Answer

Data Filtering log

Question 11

An administrator is configuring authentication for Prisma Access mobile users. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

RADIUS and LDAP authentication servers. Prisma Access supports SAML 2.0 and RADIUS/LDAP authentication methods for mobile users.

Answer

Local plaintext password files stored on user endpoint hard drives

Answer

Peer-to-peer certificate exchange without an authentication authority

Answer

Hardcoded pre-shared keys without user credentials

Question 12

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

Accepted Answer

GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode. GlobalProtect app settings such as 'Connect Method' set to 'Always On' or 'Pre-Logon' along with seamless tunnel reconnection settings ensure persistent connections.

Answer

Explicit Proxy PAC file fallback mode

Answer

BGP route dampening on the Service Connection

Answer

IPsec Dead Peer Detection (DPD) timer set to zero

Question 13

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

Accepted Answer

Real-time blocking of unauthorized data uploads to sanctioned and unsanctioned cloud applications.. Inline CASB inspects traffic in real time, blocks unauthorized uploads/downloads immediately, and enforces tenant restriction headers.

Answer

Deep historical scanning of files at rest stored within cloud SaaS storage repositories.

Answer

Out-of-band remediation of externally shared links via API webhooks.

Question 14

When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)

Accepted Answer

App-ID based security policies that explicitly name specific internal applications rather than subnets. ZTNA 2.0 requires app-level segmentation instead of network-level access, meaning App-ID based security policies and Prisma Access App Connectors deployed in the private data center are mandatory.

Answer

Legacy PPTP VPN dial-in server integration

Answer

Explicit PAC files distributed to all internal users

Answer

Public IP addresses assigned to every internal workstation

Question 15

An enterprise using Prisma Access has configured a Service Connection to their primary data center. Users at remote branches report that they cannot reach internal applications hosted in the data center. Upon checking Panorama, the Service Connection status shows 'Connected', but routing is failing. What configuration step is required on Prisma Access to advertise the remote network subnets to the data center?

Accepted Answer

Configure BGP peer settings and export rules on the Service Connection in Panorama.. Service Connections require BGP peering configuration to exchange routing information between Prisma Access and the enterprise data center router.

Answer

Enable SSL Decryption on the Service Connection interface.

Answer

Create a GlobalProtect Portal authentication profile for the data center.

Answer

Configure Zone Protection profiles on the tunnel interface.