SSE-Engineer Practice Test 13 — 15 Questions

Question 1

While troubleshooting a Prisma Access Remote Network deployment, an engineer notices that routes advertised via BGP from the customer's data center are not appearing in the Prisma Access routing table. Where can the engineer view BGP peer status and learned routes in Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Access > Service Setup > Routing > BGP Status, or by viewing runtime stats via the Prisma Access monitoring dashboard in Panorama.. BGP routing status can be monitored via Runtime Stats in the Prisma Access monitoring tools or CLI.

Answer

Panorama > Cloud Services > Status > BGP Peers.

Answer

Monitor > Dynamic Updates > BGP.

Answer

Policies > NAT.

Question 2

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

Accepted Answer

Run operational CLI commands such as 'show routing protocol bgp peer' or check the routing status in the Prisma Access monitoring dashboard.. BGP peer state and routing tables can be checked via operational CLI commands on Prisma Access nodes or monitoring dashboards.

Answer

Review the System log for BGP daemon errors.

Answer

Examine the Traffic log for BGP port 179 sessions.

Answer

Check the GlobalProtect gateway log.

Question 3

An organization is migrating their branch offices to Prisma Access Firewall as a Service (FWaaS). What is the primary method used to connect a physical branch office location to the Prisma Access cloud infrastructure securely?

Accepted Answer

IPsec VPN tunnels from the branch office router or firewall to Prisma Access Remote Networks. Remote Networks (RN) in Prisma Access connect physical branch offices and headquarters to the cloud service using standard IPsec VPN tunnels terminated on Prisma Access service nodes.

Answer

Direct peering via AWS Direct Connect without any encapsulation

Answer

GlobalProtect client software installed on every desktop in the branch

Answer

Explicit HTTP proxy configuration pushed via browser group policy

Question 4

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

Accepted Answer

Monitor > Logs > System (filtering for IKE or IPsec events) or viewing tunnel status.. System logs and IKE/IPsec operational debugging logs record Phase 1 and Phase 2 negotiation mismatches.

Answer

Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.

Question 5

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

Accepted Answer

Monitor > Logs > HIP Match.. HIP match logs record whether endpoints meet the defined security criteria (OS version, patch level, anti-malware status).

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > System.

Answer

Panorama > Cloud Services > Audit Log.

Question 6

An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)

Accepted Answer

Configure IPsec Crypto Profiles and Tunnel settings for the Remote Network connection.. Configuring Remote Networks requires defining the remote network location with public IP/bandwidth and creating IPsec tunnel parameters to establish the secure connection.

Answer

Upload customer SAML metadata files to the GlobalProtect Portal.

Answer

Configure WMI probing credentials for Active Directory domain controllers.

Answer

Install the GlobalProtect agent software on all CPE branch routers.

Question 7

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

Accepted Answer

Panorama > Cloud Services > Status.. Panorama > Cloud Services > Status provides a comprehensive dashboard for Prisma Access infrastructure health.

Answer

Objects > Certificates.

Answer

Policies > QoS.

Answer

Monitor > Managed Devices.

Question 8

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

Accepted Answer

Enable TCP MSS clamping on the IPsec tunnel settings or ensure the local CPE device correctly handles ICMP Destination Unreachable messages.. Path MTU Discovery and MSS clamping configurations on the IPsec tunnel help prevent packet fragmentation issues across Prisma Access tunnels.

Answer

Change the mobile user authentication type from SAML to RADIUS.

Answer

Configure a WildFire analysis profile to bypass large files.

Answer

Increase the GlobalProtect client idle timeout value to 3600 seconds.

Question 9

When troubleshooting SSL Decryption issues in a Prisma Access environment where users report certificate warnings, which THREE areas should an administrator inspect? (Choose three)

Accepted Answer

Check the Decryption Policy rules to ensure the correct traffic zones, URLs, and actions (Decrypt/No Decrypt) are configured.. Decryption troubleshooting requires verifying certificate trust chains, forwarding/inbound profile settings, and explicit proxy/decryption policy bindings.

Answer

Verify the BGP routing table for Service Connection prefixes.

Answer

Check the GlobalProtect client version installed on mobile workstations.

Question 10

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Accepted Answer

Inspect the GlobalProtect Client Settings in Panorama to ensure gateways and agent configurations are correctly assigned.. GlobalProtect connection failures for mobile users typically involve portal/gateway certificates, authentication profiles, and client configuration profiles.

Answer

Check the WildFire file size upload limit for malicious attachments.

Answer

Verify the BGP AS number configured on the customer data center router.

Question 11

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

Accepted Answer

Check ACC and Traffic/Threat logs to identify traffic spikes, unusual session volumes, or potential security attacks.. High CPU troubleshooting involves analyzing threat/traffic log volumes, checking for traffic storms or DoS attacks, and reviewing system diagnostic files.

Answer

Modify the GlobalProtect client portal authentication profile.

Answer

Update the Antivirus dynamic signature version.

Answer

Restart the customer CPE device at the branch location.

Question 12

Which TWO methods can an administrator use to monitor the health and operational status of Prisma Access Service Connections in Panorama? (Choose two)

Accepted Answer

Panorama > Cloud Services > Status > Service Connections dashboard.. Service connection health can be monitored via Cloud Services Status dashboards and operational CLI commands or system monitoring tools.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Policies > NAT configuration view.

Answer

Device > Log Settings forwarding profiles.

Question 13

A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)

Accepted Answer

Vulnerability Protection Security Profile. Comprehensive threat prevention in PAN-OS / Prisma Access relies on Antivirus, Vulnerability Protection, and WildFire Analysis profiles.

Answer

GlobalProtect Portal Configuration Profile

Answer

Cloud Services Dynamic Template

Question 14

A deployment of Prisma Access requires ZTNA 2.0 posture check enforcement for remote users. The administrator must ensure that mobile devices attempting to connect to internal corporate apps are evaluated for disk encryption and active endpoint protection agents prior to tunnel establishment. Which component performs this real-time device posture assessment?

Accepted Answer

GlobalProtect app using Host Information Profile (HIP) reporting. Prisma Access integrates with Cortex XDR and Prisma Access Browser/GlobalProtect app to perform device posture checks via Host Information Profile (HIP) matching. HIP checks evaluate the security posture of the endpoint and feed directly into Security Policy rules enforcing ZTNA.

Answer

Remote Networks (RN) node

Answer

Cloud Secure Web Gateway (SWG) explicit proxy listener

Answer

Cloud Managed Services (CMS) collector

Question 15

An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)

Accepted Answer

Configure redundant IPsec tunnels from separate CPE devices or diverse ISP connections to Prisma Access.. Best practices for Remote Networks include configuring redundant tunnels, enabling BGP for dynamic routing, and selecting appropriate MTU/MSS settings.

Answer

Disable Dead Peer Detection (DPD) to keep tunnels permanently active.

Answer

Use OSPF area 0 across all IPsec tunnels to establish fast convergence.