SSE-Engineer Practice Test 14 — 15 Questions

Question 1

A Prisma Access engineer is troubleshooting an issue where users in a specific Remote Network location cannot authenticate against an on-premises LDAP server because the Service Connection is dropping packets. What is the recommended Panorama CLI command to test connectivity to the LDAP server through the Service Connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Execute 'ping source host ' from the specific Prisma Access node or use operational commands via Panorama.. The test command 'test aaa-server login' or ping utilities executed from the appropriate Prisma Access node CLI help diagnose connectivity and authentication issues.

Answer

Run 'show system resources' to check CPU utilization of the Panorama VM.

Answer

SSH to the Prisma Access node or use the Panorama CLI to run 'test security-policy-match' for the LDAP traffic.

Answer

Use the CLI command 'ping source

' from the Panorama management plane.

Question 2

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

Accepted Answer

Use the Panorama CLI command 'test security-policy-match source destination application '. The 'test security-policy-match' CLI command tests policy evaluation for given parameters (source, destination, user, app).

Answer

Review the Audit log for policy changes.

Answer

Check the ACC top threats widget.

Answer

Run 'show system state'.

Question 3

An enterprise deployment of Prisma Access uses explicit proxy. Users report that specific SaaS applications are failing because the proxy is stripping required HTTP headers. Where should the administrator check and modify proxy header insertion rules in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Service Setup > Proxy Settings / Decryption Profiles.. HTTP header insertion and modification rules are configured in decryption or proxy profiles within Prisma Access.

Answer

Objects > Custom Objects > URL Filtering.

Answer

Network > GlobalProtect > Gateways > Agent > Client Settings.

Answer

Policies > NAT.

Question 4

An administrator needs to monitor the volume of traffic passing through a specific Prisma Access Service Connection. Which monitoring tool in Panorama displays aggregated data on bandwidth usage, top applications, and top users?

Accepted Answer

Monitor > ACC (Application Command Center).. The Application Command Center (ACC) in Panorama provides visual summaries of traffic trends, bandwidth usage, top applications, and users.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Log Settings.

Answer

Policies > QoS.

Question 5

An administrator troubleshooting a Prisma Access environment notices that specific traffic is bypassing security inspection. Upon checking the Security Policy, the administrator sees that a security rule has the profile setting set to 'None'. What does this configuration mean for traffic matching that rule?

Accepted Answer

Traffic allowed by the rule will not be inspected by Antivirus, Anti-Spyware, Vulnerability Protection, or WildFire security profiles.. Setting security profiles to 'None' means that while App-ID and basic layer-4 security rules apply (allow/deny), advanced threat prevention, antivirus, and anti-spyware inspection are not performed on those sessions.

Answer

Traffic matching the rule is dropped automatically.

Answer

SSL decryption is automatically enabled.

Answer

Traffic is forced through the explicit proxy.

Question 6

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

Accepted Answer

Improperly formatted domain suffixes or exceeding the maximum number of supported split-DNS search domains for the client operating system.. Client operating systems handle DNS suffix search lists differently, and some OS clients have limitations on the number of suffixes or fail when wildcard domains are improperly formatted in GlobalProtect client settings.

Answer

The GlobalProtect portal SSL certificate is expired.

Answer

WildFire cloud connectivity is down.

Answer

BGP route reflection is misconfigured on the Service Connection.

Question 7

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

Accepted Answer

Monitor > Logs > Threat.. Threat logs contain detailed information on anti-spyware, antivirus, and vulnerability alerts, often including packet captures.

Answer

Monitor > Logs > HIP Match.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.

Question 8

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

Accepted Answer

Panorama > Cloud Services > Setup > Licenses or Panorama > License.. License information in Panorama is managed under Panorama > Device Deployment > Licenses or Cloud Services deployment status.

Answer

Monitor > Logs > System.

Answer

Objects > Applications.

Answer

Policies > NAT.

Question 9

A security team reports that threat prevention signatures are not updating on Prisma Access nodes. Where in Panorama should the administrator verify the scheduling and status of dynamic updates for Prisma Access?

Accepted Answer

Panorama > Device Deployment > Dynamic Updates.. Dynamic updates for Prisma Access are managed via Panorama under Panorama > Device Deployment > Dynamic Updates or Cloud Services dynamic update schedules.

Answer

Panorama > Cloud Services > Setup > Dynamic Updates.

Answer

Prisma Access > Service Setup > Threat Prevention.

Answer

Monitor > Dynamic Updates > Status.

Question 10

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

Accepted Answer

Monitor > Logs > Threat.. Threat logs in Prisma Access are viewed centrally in Panorama under Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Setup > Management.

Answer

Prisma Access > Service Setup > Locations.

Answer

Policies > Security.

Question 11

An administrator troubleshooting a Prisma Access mobile user connectivity issue wants to verify whether the GlobalProtect gateway is actively responding to client connection requests. Where can this real-time session and gateway status be verified?

Accepted Answer

Panorama > Cloud Services > Status > Mobile Users > Gateways.. Gateway status and active sessions can be checked in Panorama under Cloud Services > Status or via operational CLI commands.

Answer

Policies > Decryption.

Answer

Device > Setup > Operations.

Answer

Objects > Addresses.

Question 12

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

Accepted Answer

Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.. SAML assertion validation failures often occur due to clock skew between the IdP and the Prisma Access authentication profile settings.

Answer

The GlobalProtect client software license has expired on Panorama.

Answer

The User-ID agent service on the Panorama management server is stopped.

Answer

WildFire cloud subscription has lapsed.

Question 13

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

Accepted Answer

Configure TCP MSS adjustment on the GlobalProtect tunnel settings or reduce the tunnel interface MTU.. Adjusting the MTU or enabling TCP MSS clamping on the GlobalProtect gateway configuration resolves fragmentation issues for mobile users.

Answer

Change the mobile user IP pool subnet mask from /24 to /16.

Answer

Disable WildFire file forwarding for large files.

Answer

Increase the decryption profile timeout value.

Question 14

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

Accepted Answer

Use the URL Filtering lookup tool in Panorama or test via 'test url <website>' in the CLI.. The Policy Optimizer or URL Lookup tool helps test and verify URL categories and matching rules.

Answer

Review the ACC top applications widget.

Answer

Check the GlobalProtect gateway connection status.

Answer

Examine the System log for category update errors.

Question 15

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

Accepted Answer

Verify that the QoS profile is applied to the correct security policy rules and that the guaranteed bandwidth settings align with the provisioned Prisma Access node bandwidth limits.. Prisma Access QoS relies on correct classification of traffic via security policies and proper bandwidth allocation profiles matching the provisioned bandwidth of the egress node.

Answer

Verify the BGP AS number on the customer CPE.

Answer

Check the expiration date of the GlobalProtect gateway SSL certificate.

Answer

Ensure that GlobalProtect pre-logon mode is disabled.