SSE-Engineer Practice Test 14 — 15 Questions

Question 1

An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure redundant IPsec tunnels from separate CPE devices or diverse ISP connections to Prisma Access.. Option B is correct because Prisma Access remote network best practices call for redundant IPsec tunnels terminating from separate CPE devices or diverse ISP links, so a single device or circuit failure does not take down the branch. Option C is correct because IPsec encapsulation adds overhead, and configuring TCP MSS clamping on the CPE routers prevents large packets from being fragmented or dropped across the tunnel. Option E is correct because running BGP over the IPsec tunnels enables dynamic route exchange and automated failover between primary and secondary tunnels without manual intervention. Option A is incorrect because DPD should be enabled, not disabled, so that failed peers are detected and tunnels can fail over quickly. Option D is incorrect because forcing OSPF area 0 across all tunnels is not a Prisma Access best practice and does not provide the automated failover that BGP does.

Answer

Disable Dead Peer Detection (DPD) to keep tunnels permanently active.

Answer

Use OSPF area 0 across all IPsec tunnels to establish fast convergence.

Question 2

An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)

Accepted Answer

System log. The System log (B) is correct because it records system-level events on Prisma Access components, including GlobalProtect/ZTNA tunnel establishment, gateway selection, and connection failures, which are essential for diagnosing tunnel setup problems. The Authentication log (E) is correct because it captures user authentication events such as portal/gateway logins, SSO/SAML exchanges, and MFA results, directly addressing user authentication issues. WildFire submission log (A) only shows files/URLs sent for WildFire analysis and is unrelated to ZTNA connectivity. HIP Match log (C) shows host information profile matches for policy enforcement, not authentication or tunnel establishment. Data Filtering log (D) records data pattern matches for DLP-style policies, which is irrelevant to ZTNA tunnel and auth troubleshooting.

Answer

WildFire submission log

Answer

HIP Match log

Answer

Data Filtering log

Question 3

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

Accepted Answer

Verify that GlobalProtect is configured to report user mappings and check authentication log status.. Option A is correct because User-ID mapping for mobile users in Prisma Access depends on GlobalProtect reporting user mappings to the User-ID service; the administrator must confirm GlobalProtect is configured to send those mappings and review authentication logs to see whether authentication succeeded or failed. Option E is correct because the CLI command 'show user ip-user-mapping all' displays the current user-to-IP mappings on the firewall, allowing the administrator to verify whether active mappings are actually populated. Options B, C, and D are not relevant: restarting branch firewall hardware, changing WildFire signature update schedules, and modifying QoS bandwidth profiles do not address User-ID mapping or authentication reporting for mobile users.

Answer

Restart the physical firewall hardware in the branch office.

Answer

Change the WildFire signature update schedule.

Answer

Modify the QoS bandwidth allocation profile.

Question 4

Which TWO configuration steps are required to allow internet access for Remote Network users?

Accepted Answer

Enable Internet Access in the Remote Network configuration.. Option A is correct because enabling Internet Access in the Remote Network configuration is the explicit setting that turns on internet-bound traffic handling for that remote network, allowing the firewall to route and NAT remote users' traffic to the internet. Option E is correct because, once internet access is enabled, a Security Policy permitting traffic from the Remote Network zone to the Internet zone is required to actually allow the sessions through the firewall's policy engine. Options B, C, and D are not required: a local proxy server is not needed for basic internet access, static IP addresses on mobile devices are unnecessary since DHCP or dynamic addressing works, and an IPSec tunnel to a third-party ISP is unrelated to enabling internet access for remote network users.

Answer

Install a local proxy server.

Answer

Assign a static IP address to every mobile device.

Answer

Configure an IPSec tunnel to a third-party ISP.

Question 5

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

Accepted Answer

Traffic and Threat logs. Options A and E are correct because Panorama provides dedicated log types for Prisma Access, including Traffic, Threat, and HIP Match logs, which are used to troubleshoot security events and traffic flows. Traffic logs record session details such as source/destination, application, and action, while Threat logs capture security policy matches like antivirus, anti-spyware, and vulnerability signatures. HIP Match logs are also available in Panorama and show which GlobalProtect Host Information Profile (HIP) policy matched a user or endpoint, which is essential for troubleshooting security posture enforcement. Active Directory replication event logs, local hypervisor resource utilization logs, and switch spanning-tree topology tables are not Panorama log types for Prisma Access; they belong to Windows AD, virtualization platforms, and Layer 2 switching, respectively.

Answer

Active Directory replication event logs

Answer

Local hypervisor resource utilization logs

Answer

Switch spanning-tree topology tables

Question 6

When configuring a Remote Network (RN) connection to an on-premises data center, which parameter is required to ensure proper routing of internal traffic via the IPSec tunnel?

Accepted Answer

The BGP peer IP address or static routes defining the internal subnets.. The BGP peer configuration or static routes within the Remote Network settings ensure the Prisma Access cloud knows which subnets to route through the tunnel.

Answer

Primary and Secondary IKE gateways.

Answer

The User-ID agent IP address.

Answer

The GlobalProtect Gateway IP.

Question 7

An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?

Accepted Answer

On the Remote Network configuration in Panorama under Bandwidth Allocation and QoS. QoS profiles in Prisma Access for remote networks are applied on the Remote Network configuration settings in Panorama under Cloud Services.

Answer

Inside the GlobalProtect Gateway agent configuration profile

Answer

Globally inside the Palo Alto Networks WildFire configuration

Answer

Directly on the customer branch router CLI via MQC

Question 8

A network engineer is troubleshooting an IPsec site-to-site tunnel failure between a customer CPE and a Prisma Access Remote Network. The IKE phase 1 negotiations fail. Which log should the engineer examine to determine the exact reason for the IKE negotiation failure?

Accepted Answer

Monitor > Logs > System (filtering for IKE or IPsec events) or viewing tunnel status.. System logs and IKE/IPsec operational debugging logs record Phase 1 and Phase 2 negotiation mismatches.

Answer

Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.

Question 9

A deployment of Prisma Access requires ZTNA 2.0 posture check enforcement for remote users. The administrator must ensure that mobile devices attempting to connect to internal corporate apps are evaluated for disk encryption and active endpoint protection agents prior to tunnel establishment. Which component performs this real-time device posture assessment?

Accepted Answer

GlobalProtect app using Host Information Profile (HIP) reporting. The GlobalProtect app collects endpoint posture data via Host Information Profile (HIP) and sends it to the Prisma Access gateway before tunnel establishment. This real-time assessment checks disk encryption and endpoint protection agents, enabling ZTNA 2.0 policy enforcement. The HIP data is evaluated against HIP profiles to determine access, ensuring only compliant devices connect.

Answer

Remote Networks (RN) node

Answer

Cloud Secure Web Gateway (SWG) explicit proxy listener

Answer

Cloud Managed Services (CMS) collector

Question 10

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

Accepted Answer

Use standardized test payloads or URLs (such as the EICAR string for antivirus or PANW test URLs) and check the Threat log.. Using standardized test payloads like the EICAR string for antivirus or PANW-provided test URLs is the safe, standard method to verify that threat prevention signatures are actively blocking malicious traffic. These tests generate benign traffic that matches known signatures, and the results appear in the Threat log, confirming enforcement without causing harm.

Answer

Perform a Denial of Service attack against the Prisma Access public IP.

Answer

Disable SSL decryption across all security rules.

Answer

Restart the Panorama management server.

Question 11

A network engineer is troubleshooting why a specific security policy rule configured in Panorama is not matching traffic in a Prisma Access environment. Which Panorama testing tool simulates traffic against security rules to verify rule evaluation?

Accepted Answer

Use the Panorama CLI command 'test security-policy-match source destination application '. The correct tool is the Panorama CLI command 'test security-policy-match source destination application ' (D). This command simulates traffic against the security policy rulebase and shows which rule would match, including the rule name, action, and other details. It is the standard method for verifying rule evaluation in Prisma Access and Panorama-managed environments.

Answer

Review the Audit log for policy changes.

Answer

Check the ACC top threats widget.

Answer

Run 'show system state'.

Question 12

An engineer is planning the initial deployment of Prisma Access for an organization that wants to avoid routing internal traffic through the corporate data center for internet-bound traffic. Which deployment component must be configured to allow mobile users to connect directly to Prisma Access and access the internet without backhauling through headquarters?

Accepted Answer

Mobile Users. The correct answer is Mobile Users because it is the Prisma Access component specifically designed to provide secure, direct connectivity for remote and mobile users. By deploying Mobile Users, organizations can ensure that user traffic to the internet and internal resources is secured and optimized without backhauling through a central data center. This aligns with the goal of avoiding data center routing for internet-bound traffic.

Answer

Remote Networks

Answer

Explicit Proxy

Answer

Service Connections

Question 13

A security engineer manages a Prisma Access deployment with 5,000 mobile users. The organization wants to enforce different security policies for users in the Finance department versus the Engineering department, without deploying separate GlobalProtect portals or gateways. The identity provider is SAML-based and already integrated. What is the most operationally efficient way to achieve this?

Accepted Answer

Use SAML attributes from the identity provider to create dynamic user groups, then reference those groups in security policies.. Using SAML attributes to create dynamic user groups allows Prisma Access to enforce policies based on user identity without additional infrastructure. This method leverages existing IdP integration, scales easily, and avoids the complexity of separate portals or static IP management. It aligns with zero-trust principles by tying policy to authenticated identity rather than network location.

Answer

Create separate Prisma Access tenants for each department and assign users accordingly.

Answer

Configure separate GlobalProtect portals for each department, each with its own security policy.

Answer

Assign static IP addresses to each department's users and create policies based on IP ranges.

Question 14

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Accepted Answer

Configure a Directory Service connector to sync users and groups from Active Directory.. Option A is correct because CIE requires a Directory Service connector (e.g., a Cloud Identity Engine Directory Sync/Connector) to pull users and groups from Active Directory or another LDAP source so identity data is available for policy. Option B is correct because after syncing directories, the administrator must configure authentication settings and map user attributes (such as UPN, email, or group attributes) in CIE so Prisma Access can resolve users to the right identity and group context. Option D is correct because the CIE tenant must be linked/associated with the Prisma Access or Panorama instance so that user mapping and authentication data can be consumed by Prisma Access for policy enforcement. Option C is not required because CIE is a cloud service and does not need physical Domain Controllers installed inside each Prisma Access cloud node; directory data is synced from existing on-premises or cloud directories. Option E is not required because BGP peering to enterprise DNS servers is unrelated to CIE user mapping and authentication; CIE does not use BGP for identity synchronization.

Answer

Install physical Domain Controllers inside each Prisma Access cloud node.

Answer

Configure BGP peering between CIE and the enterprise DNS servers.

Question 15

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

Accepted Answer

Enable HIP data collection on the GlobalProtect agent settings.. Option A is correct because HIP enforcement begins with the GlobalProtect agent collecting host information; enabling HIP data collection in the agent settings (Config > GlobalProtect > Agent > HIP Data Collection) allows the endpoint to gather and submit HIP data to the gateway. Option C is correct because collecting HIP data alone does nothing unless a Security policy rule references a HIP Object or HIP Profile in its Source HIP field, which is what actually enforces the posture requirement before granting access to corporate applications. Option B is incorrect because static ARP entries are a Layer 2 addressing mechanism unrelated to host posture assessment. Option D is incorrect because WildFire is a cloud-based malware analysis service, not a requirement for HIP checking. Option E is incorrect because HIP checking uses the GlobalProtect agent's built-in data collection, not a locally installed proxy server.

Answer

Configure static ARP entries on the GlobalProtect gateway.

Answer

Deploy WildFire appliance hardware at every branch location.

Answer

Install a local proxy server on every mobile device.