SSE-Engineer Practice Test 15 — 15 Questions

Question 1

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor > Logs > System or Authentication logs in Panorama.. System logs and Authentication logs record RADIUS server communication errors and timeouts.

Answer

Policies > NAT.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Threat.

Question 2

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Accepted Answer

Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.. Panorama operational commands or the User-ID status monitoring tool show active user-to-IP mappings.

Answer

Check the GlobalProtect Gateway tunnel status.

Answer

Run 'show system software status'.

Answer

Verify the SSL Decryption certificate expiration date.

Question 3

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the SSL/TLS certificate assigned to the GlobalProtect Portal configuration is valid, not expired, and trusted by the client devices.. The GlobalProtect Portal SSL/TLS certificate configuration is tied to the portal configuration profile.

Answer

Check the IPsec crypto profile under Network > Network Profiles > IPsec Crypto.

Answer

Check the User-ID agent connection timeout settings.

Answer

Verify the BGP AS number on the Remote Network node.

Question 4

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

Accepted Answer

Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.. In Prisma Access, DNS server assignments for mobile users are pushed via the GlobalProtect Agent configuration under Network > GlobalProtect > Client Settings.

Answer

Panorama > Prisma Access > Monitoring > ACC.

Answer

Panorama > Cloud Services > Status > Traffic Log.

Answer

Panorama > Firewall > Network Profiles > Interface.

Question 5

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

Accepted Answer

Missing or incorrect static routes / BGP route advertisements for the internal subnets in the Service Connection routing configuration.. Incorrect static or dynamic routing advertisements (such as missing or overlapping static routes / BGP prefixes) cause traffic to take the default internet route instead of the Service Connection.

Answer

WildFire inspection is enabled on the security policy rule.

Answer

The Security Predefined Policy rule order is incorrect.

Answer

The GlobalProtect Portal client timeout is set too low.

Question 6

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

Accepted Answer

Missing proxy bypass entries for authentication provider login pages or incorrect cookie persistence settings in the explicit proxy profile.. Authentication loops in explicit proxy often stem from misconfigured authentication profiles, persistent cookie settings, or incorrect proxy bypass rules for authentication endpoints.

Answer

The BGP hold timer is set too low on the Service Connection.

Answer

SSL Forward Proxy decryption is disabled on the untrust zone.

Answer

The GlobalProtect agent version is incompatible with explicit proxy.

Question 7

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the GlobalProtect Agent configuration regarding 'Access Route' or local network access permissions.. Accessing local network resources while on VPN involves split-tunneling configurations, access route pushes, and client settings.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the WildFire file analysis submission timeout settings.

Question 8

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

Accepted Answer

Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.. App-ID inspects traffic dynamically, but if custom ports are used, Custom App-IDs or Service objects must be correctly configured in security policies.

Answer

Configure a static NAT rule for the non-standard ports on the service connection.

Answer

Disable GlobalProtect pre-logon mode.

Answer

Enable SSL Forward Proxy on the destination zones.

Question 9

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

Accepted Answer

The IdP signing certificate imported into the Prisma Access authentication profile does not match the active certificate currently used by the IdP.. Signature validation failure indicates a mismatch or expiration of the IdP signing certificate configured in the Prisma Access SAML Identity Provider profile.

Answer

The decryption policy is blocking HTTPS traffic to the IdP.

Answer

The User-ID agent service on Panorama has crashed.

Answer

The GlobalProtect client version is outdated and does not support SAML.

Question 10

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

Accepted Answer

Panorama > Cloud Services > Status > Remote Networks.. Panorama > Cloud Services > Status provides overview metrics for IPsec tunnels associated with Remote Networks.

Answer

Policies > Security.

Answer

Device > High Availability.

Answer

Monitor > Traffic.

Question 11

Which TWO logs should an administrator check in Panorama when troubleshooting a mobile user who reports that their connection keeps dropping after a short period of time? (Choose two)

Accepted Answer

Monitor > Logs > Traffic to check for session timeouts, TCP resets, or security policy drops.. GlobalProtect connection drops are investigated using GlobalProtect connection/system logs and Traffic logs showing session timeouts or resets.

Answer

Monitor > Logs > Threat.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Data Filtering.

Question 12

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Accepted Answer

Check GlobalProtect client settings in Panorama to ensure HIP report generation and submission intervals are correctly configured.. HIP check troubleshooting involves reviewing HIP match logs and checking GlobalProtect agent settings for HIP report submission intervals.

Answer

Modify the NAT policy rules.

Answer

Restart the physical branch firewall.

Answer

Update the URL Filtering database.

Question 13

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inspect Proxy Authentication and Decryption profiles to ensure authentication challenges are correctly processed.. Explicit proxy troubleshooting involves verifying proxy profile configurations, security rules allowing proxy traffic, PAC file distribution, and decryption settings.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the GlobalProtect client pre-logon timeout value.

Question 14

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

Accepted Answer

Lack of direct network line-of-sight or routing from the mobile user's remote location to the internal Active Directory Domain Controllers via a Service Connection.. Kerberos relies heavily on direct line-of-sight and UDP/TCP connectivity to Active Directory KDCs (Domain Controllers) along with valid service principal names (SPNs) and time synchronization.

Answer

WildFire cloud subscription has expired.

Answer

The decryption policy is missing an inbound rule.

Answer

The GlobalProtect client software license is invalid.

Question 15

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

Accepted Answer

Verify that 'Local Internet Breakout' is enabled in the Remote Network configuration and examine Traffic logs to confirm internet-bound sessions egress through the Remote Network's assigned public IP.. Local internet breakout is configured in the Remote Network settings and verified through traffic logs showing local egress IP addresses.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Ensure SSL Forward Proxy is disabled on the Security Policy.

Answer

Check the GlobalProtect Portal client configuration settings.