SSE-Engineer Practice Test 13 — 15 Questions

Question 1

An architect is designing a high-availability Remote Network location for Prisma Access. Which TWO methods can be used to ensure redundancy for branch office traffic connecting to Prisma Access? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy dual branch routers establishing independent IPSec tunnels to Prisma Access. Option A is correct because deploying dual branch routers that each build their own independent IPSec tunnels to Prisma Access provides device-level and path-level redundancy: if one router or its tunnel fails, the second router's tunnel keeps branch traffic flowing to the Prisma Access service. Option C is correct because terminating redundant IPSec tunnels on separate Prisma Access SPNs (Service Processing Nodes) and using BGP path selection lets the branch dynamically prefer a healthy tunnel and fail over to the alternate SPN if one tunnel or node becomes unavailable, achieving both tunnel and PoP/SPN redundancy. The unmarked options do not belong: VRRP (B) is a first-hop redundancy protocol for L2/L3 gateways and cannot be run directly against Prisma Access public cloud gateway IPs, STP (D) is a Layer 2 loop-prevention protocol that has no relevance to routed IPSec tunnel interfaces, and L2TPv3 (E) is a Layer 2 tunneling/ pseudowire technology that is not used for Prisma Access branch redundancy or link aggregation across the cloud service edge.

Answer

Enable VRRP directly across the Prisma Access cloud gateway public IP addresses

Answer

Configure Spanning Tree Protocol (STP) across the IPSec tunnel interfaces

Answer

Use L2TPv3 link aggregation across the cloud service edge

Question 2

An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)

Accepted Answer

Configure IPsec Crypto Profiles and Tunnel settings for the Remote Network connection.. Option B is correct because a Remote Network connection in Prisma Access is an IPsec tunnel terminated by the branch CPE, so Panorama requires IPsec Crypto Profiles (IKE and IPSec proposals) and tunnel settings (IKE gateway, tunnel interface, and tunnel monitor) to build that secure connection. Option C is correct because the Remote Network general settings must define the region, the bandwidth/license allocation, and the public IP address of the CPE device so the Prisma Access service can identify and size the branch tunnel endpoint. Option A is not required because SAML metadata upload to the GlobalProtect Portal applies to remote user (mobile user) authentication, not to Remote Network IPsec tunnels. Option D is not required because WMI probing credentials are used for User-ID/domain controller monitoring, which is unrelated to establishing a Remote Network tunnel. Option E is not required because Remote Networks use IPsec-capable CPE routers, not the GlobalProtect agent, which is installed on end-user endpoints for mobile users.

Answer

Upload customer SAML metadata files to the GlobalProtect Portal.

Answer

Configure WMI probing credentials for Active Directory domain controllers.

Answer

Install the GlobalProtect agent software on all CPE branch routers.

Question 3

When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?

Accepted Answer

GlobalProtect Portal. The GlobalProtect Portal is the component that authenticates remote users and assigns the appropriate GlobalProtect gateway based on geographic location. It presents the login page, performs authentication (via SAML, LDAP, RADIUS, etc.), and returns the gateway list or a specific gateway to the client based on the user's region, source IP, or other criteria. This is the standard Prisma Access remote-worker design.

Answer

Service Connection

Answer

GlobalProtect Gateway

Answer

Remote Network

Question 4

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

Accepted Answer

Monitor > ACC (Application Command Center).. The correct tool is Monitor > ACC (Application Command Center) (C). ACC provides aggregated dashboards showing bandwidth usage, top applications, top users, and other traffic analytics. It is designed for monitoring traffic patterns and volumes across the network, including Service Connections in Prisma Access.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Log Settings.

Answer

Policies > QoS.

Question 5

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?

Accepted Answer

Examine the Traffic log session details to view the detected App-ID, or use packet captures if necessary.. To troubleshoot App-ID misidentification, you inspect the Traffic log session details, which show the detected application, the App-ID that was applied, and the reason for the identification (e.g., signature, port, decryption status). If more detail is needed, packet captures can be taken to see the actual traffic. This is the standard troubleshooting workflow for App-ID issues in Prisma Access.

Answer

Verify the SSL decryption certificate chain.

Answer

Check the GlobalProtect client configuration profile.

Answer

Review the Panorama Audit log.

Question 6

An enterprise network administrator is troubleshooting an IPsec tunnel failure between a remote network and Prisma Access where Dead Peer Detection (DPD) keeps tearing down the tunnel. Which THREE potential causes should be investigated? (Choose three)

Accepted Answer

Mismatched DPD interval and retry timer settings between the customer CPE and the Prisma Access node.. Option B is correct because DPD relies on matching timers: if the customer CPE's DPD interval/retry values differ from those configured on the Prisma Access IKE gateway, one side may declare the peer dead before the other responds, tearing down the IPsec tunnel. Option C is correct because DPD probes are carried as IKEv2 informational messages over UDP 500/4500 (or ICMP-based keepalives in some designs), so any intermediate firewall, NAT device, or ISP that drops or rate-limits those packets will cause false peer-death detection and tunnel teardown. Option E is correct because DPD is timeout-based: sustained packet loss or extreme latency on the transport path can delay or lose the DPD probes/acknowledgements so the retry timer expires, triggering the tunnel to be torn down even though the peer is actually alive. Option A is not relevant because GlobalProtect client licensing on Panorama has no bearing on site-to-site IPsec DPD behavior, and Option D is not relevant because WildFire is a file-analysis subscription and does not affect IKE/DPD keepalive processing.

Answer

The GlobalProtect client software license is expired on Panorama.

Answer

WildFire cloud analysis subscription has lapsed.

Question 7

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Accepted Answer

Configure Cloud Identity Engine (CIE) settings in Panorama to sync directory services.. Cloud Identity Engine (CIE) is Palo Alto's cloud-hosted directory service that syncs user identity from on-prem AD, Microsoft Entra ID, or other directories and feeds that mapping to Prisma Access. Configuring CIE in Panorama is the supported way to provide User-ID mappings for GlobalProtect mobile users without deploying on-prem User-ID agents. CIE then distributes IP-to-user mappings to the Prisma Access compute nodes.

Answer

Configure a User-ID agent on every branch router.

Answer

Install the GlobalProtect agent with local syslog forwarding.

Answer

Enable captive portal authentication on all remote network firewalls.

Question 8

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

LDAP directory authentication. Option D (LDAP directory authentication) is correct because Prisma Access GlobalProtect natively supports LDAP as an authentication profile, allowing mobile users to be validated against on-premises or cloud directory servers such as Active Directory or OpenLDAP. Option E (SAML 2.0 identity provider integration) is correct because Prisma Access GlobalProtect supports SAML 2.0 for single sign-on, redirecting users to an IdP like Okta, Microsoft Entra ID, or PingID for authentication. Option A is incorrect because Prisma Access cloud nodes do not maintain a local user database for GlobalProtect authentication; local authentication is not a supported native method in the cloud infrastructure. Option B is incorrect because WPA3 Enterprise 802.1X is a wireless LAN authentication standard, not a GlobalProtect mobile user authentication method. Option C is incorrect because IPsec pre-shared keys are used for tunnel or peer authentication, not for authenticating individual GlobalProtect mobile users.

Answer

Local database accounts stored on the individual Prisma Access cloud nodes

Answer

WPA3 Enterprise 802.1X enterprise tunneling

Answer

IPsec Pre-Shared Key user authentication

Question 9

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

Accepted Answer

Continuous Trust Verification via periodic Host Information Profile (HIP) re-evaluation and app-connector telemetry. ZTNA 2.0 in Prisma Access enforces continuous trust verification by re-evaluating device posture (HIP checks) and user context periodically during active sessions, cutting off access if conditions change.

Answer

Pre-logon GlobalProtect connection mode

Answer

Explicit proxy PAC file auto-discovery

Answer

RADIUS single sign-on (SSO) integration with Multi-Factor Authentication

Question 10

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

Accepted Answer

Verify that the correct server certificate and private key are imported into Panorama and bound to the Inbound Decryption rule.. When inbound decryption is configured for a public-facing application behind a Prisma Access Public IP, the firewall acts as a reverse proxy and must present a server certificate that matches the application's FQDN. If the wrong certificate or private key is bound to the Inbound Decryption rule, users receive certificate warnings. The first thing to verify is that the correct server certificate and private key are imported into Panorama and bound to the rule.

Answer

Check whether the GlobalProtect client version on the user's laptop is up to date.

Answer

Ensure that WildFire analysis is disabled for inbound decrypted traffic.

Answer

Verify the OCSP responder settings under Device > Setup > Sessions.

Question 11

A remote user reports that their GlobalProtect connection connects successfully to Prisma Access, but they cannot resolve internal fully qualified domain names (FQDNs). Where should the administrator check to ensure DNS server IP addresses are correctly pushed to the GlobalProtect client?

Accepted Answer

Panorama > Prisma Access > Setup > Portal > Agent > Client Settings.. DNS server IP addresses pushed to GlobalProtect clients are configured in the Client Settings section of the GlobalProtect Portal agent configuration, which is managed under Panorama > Prisma Access > Setup > Portal > Agent > Client Settings. This is where administrators define the DNS servers, split-tunnel DNS domains, and other network settings that the portal pushes to the GlobalProtect app. If internal FQDNs cannot be resolved, the DNS server list in this configuration is the first place to verify.

Answer

Prisma Access > Cloud Services > Status.

Answer

Panorama > Managed Devices > Remote Networks.

Answer

Panorama > Policy > Security.

Question 12

An administrator is configuring Prisma Access Secure Web Gateway and wants to restrict access to high-risk web categories. Which TWO options represent configurable actions within a Prisma Access URL Filtering profile? (Choose two)

Accepted Answer

Continue. In a Prisma Access URL Filtering profile, each URL category can be assigned an action, and the two configurable actions listed here are Continue (B) and Block (D). Continue (B) allows the request to proceed to the site, which is the standard action for categories deemed acceptable or low risk. Block (D) denies the request and typically serves a block response page, which is exactly what an administrator would use to restrict access to high-risk web categories. Decrypt (A) is not a URL Filtering profile action; decryption is handled by a Decryption policy/profile. Sandbox (C) is not a URL Filtering action either; it is configured through a WildFire Analysis profile or file-blocking settings. Quarantine (E) is not a URL Filtering action; quarantine is associated with threat prevention or file quarantine, not URL category enforcement.

Answer

Decrypt

Answer

Sandbox

Answer

Quarantine

Question 13

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

Accepted Answer

Check for asymmetrical routing where traffic enters through one Prisma Access node/tunnel but exits through another.. Option C is correct because Prisma Access App-ID requires that both directions of a flow traverse the same node/tunnel; asymmetrical routing causes the firewall to see only half the session, so the application cannot be identified and shows as incomplete or unknown-tcp. Option D is correct because App-ID needs to observe the full TCP three-way handshake and subsequent application data; if packet captures show the session is reset or terminated before the handshake completes, the firewall never gets enough context to classify the application. Option E is correct because overly restrictive security rules or service objects that drop traffic before App-ID has inspected sufficient packets will prevent identification, leaving the session logged as incomplete or unknown-tcp. Option A is not relevant because the GlobalProtect gateway SSL certificate expiration affects user connectivity and authentication, not application identification in Traffic logs. Option B is not relevant because WildFire license status governs file submission and verdicts, not the App-ID classification of TCP sessions.

Answer

Verify the expiration date of the GlobalProtect gateway SSL certificate.

Answer

Check the WildFire subscription license key status.

Question 14

An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)

Accepted Answer

Cloud-scale redundant gateway architecture across multiple geographic locations. Option B is correct because Prisma Access is built on a cloud-scale, multi-tenant infrastructure with redundant gateways distributed across many geographic locations, so mobile users can always reach a healthy service node even if one region or gateway fails. Option E is correct because GlobalProtect clients use automatic gateway selection, where the client is directed to the best-performing regional service node based on latency and availability, providing resilient and optimized connectivity without manual intervention. Option A is incorrect because static routing tables and OS registry settings are not how Prisma Access delivers high availability; routing is handled dynamically in the cloud. Option C is incorrect because failover is automatic within Prisma Access, not driven by manual IPsec failover scripts on each endpoint. Option D is incorrect because Prisma Access is a cloud-delivered service and does not rely on on-premise physical hardware load balancers in front of mobile user tunnels.

Answer

Static routing tables configured locally on Windows and macOS registry settings

Answer

Manual IPsec tunnel failover scripting executed on each endpoint device

Answer

On-premise physical hardware load balancers deployed in front of mobile user tunnels

Question 15

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

Accepted Answer

Monitor > Logs > Traffic to check for session timeouts, TCP resets, or security policy drops.. Option A is correct because Monitor > Logs > Traffic in Panorama records session details such as session end reasons, TCP resets, and security policy drops, which can reveal whether the mobile user's connection is being torn down by a timeout, reset, or deny rule. Option C is correct because Monitor > Logs > GlobalProtect captures GlobalProtect client connection events, gateway reconnects, and error messages, which directly show why a mobile user's tunnel keeps dropping after a short period. Option B is not appropriate here because Monitor > Logs > Threat shows security threat detections, not the connection-drop events described. Option D is not appropriate because Panorama > Cloud Services > Audit Log records cloud service and configuration audit activity, not user tunnel connectivity. Option E is not appropriate because Monitor > Logs > Data Filtering pertains to data filtering profile matches, not GlobalProtect connection stability.

Answer

Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Data Filtering.