SSE-Engineer Practice Test 15 — 15 Questions

Question 1

An enterprise deployment of Prisma Access uses explicit proxy. Users report that authentication prompts appear repeatedly when browsing internal web applications. What is the most likely cause of this authentication looping in an explicit proxy setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Missing proxy bypass entries for authentication provider login pages or incorrect cookie persistence settings in the explicit proxy profile.. In an explicit proxy deployment, authentication looping typically occurs when the proxy intercepts the identity provider's login pages or when cookie persistence is misconfigured, causing the proxy to challenge the user repeatedly instead of honoring the authentication cookie. Adding proxy bypass entries for authentication provider URLs and correcting cookie persistence settings in the explicit proxy profile resolves the loop.

Answer

The BGP hold timer is set too low on the Service Connection.

Answer

SSL Forward Proxy decryption is disabled on the untrust zone.

Answer

The GlobalProtect agent version is incompatible with explicit proxy.

Question 2

A security engineer is deploying Prisma Access for mobile users and needs to ensure that all traffic from the GlobalProtect app is inspected by the security processing nodes, including traffic destined for the internet. Which setting must be configured in the Prisma Access mobile user configuration?

Accepted Answer

The tunnel must be configured to include all traffic (0.0.0.0/0) and split tunneling disabled.. To inspect all traffic from mobile users, including internet-bound traffic, the GlobalProtect tunnel must be configured to include all traffic (0.0.0.0/0) and split tunneling must be disabled. This ensures that no traffic bypasses the security processing nodes. The other options do not achieve full traffic inspection; they either allow bypass or address different aspects of the configuration.

Answer

Split tunneling must be enabled to allow direct internet access.

Answer

The 'No Direct Access to Local Network' option must be enabled.

Answer

The 'Enforce GlobalProtect for Network Access' option must be enabled.

Question 3

A network architect is designing a Prisma Access deployment for a company with multiple remote networks. The company requires that traffic from remote networks to the internet be inspected by Prisma Access, but they also want to minimize latency for cloud applications. Which feature should be enabled to optimize routing for cloud applications?

Accepted Answer

Cloud On-Ramp. Cloud On-Ramp is the feature that optimizes routing for cloud applications by directing traffic to the nearest Prisma Access location and then to the cloud application, reducing latency. Other features like Traffic Steering, QoS, or Service Connections serve different purposes and do not provide the specific optimization needed for cloud applications.

Answer

Traffic Steering

Answer

QoS

Answer

Service Connection

Question 4

An administrator is configuring Prisma Access to provide secure web gateway services for mobile users. The requirement is to decrypt outbound SSL traffic for inspection, but only for categories that are not in a predefined exemption list. Where should the administrator configure the SSL decryption policy in Prisma Access?

Accepted Answer

In the Prisma Access Cloud Management under Security Services > Decryption.. In Prisma Access Cloud Management, decryption policies are configured under Security Services > Decryption. This is where administrators define rules to decrypt SSL traffic based on URL categories, users, and other criteria, and where they can exempt specific categories. The other locations are for logging, GlobalProtect settings, and service connections, which do not handle decryption policy.

Answer

In the Prisma Access Cloud Management under Strata Logging Service settings.

Answer

In the Prisma Access Cloud Management under Service Connections > Advanced settings.

Answer

In the Prisma Access Cloud Management under Mobile Users > GlobalProtect settings.

Question 5

An administrator is troubleshooting a Prisma Access issue where mobile users are unable to access a newly deployed internal web application. The application is hosted in the data center and is reachable from the service connection. Security policy allows the traffic. Which log source should the administrator check first to determine whether the traffic is reaching the service connection?

Accepted Answer

Traffic logs in the Prisma Access monitoring interface filtered by the application and service connection.. To determine whether mobile user traffic reached the service connection, the administrator should examine traffic logs in the Prisma Access monitoring interface. These logs show session details, including whether traffic was allowed or denied and the path it took. Filtering by application and service connection narrows the focus to the relevant flow, providing the necessary insight to troubleshoot the access issue.

Answer

System logs on the Prisma Access portal.

Answer

GlobalProtect app logs on the mobile user endpoint.

Answer

IKE gateway logs on the remote network firewall.

Question 6

A help desk technician reports that a Prisma Access mobile user cannot reach any resources, and the GlobalProtect client displays 'Portal unreachable' before the user even authenticates. The administrator confirms the user's internet connectivity is fine and other users at the same site are connected successfully. Which troubleshooting step should the administrator perform first?

Accepted Answer

Verify the portal FQDN resolves correctly from the client and that the required portal ports are reachable.. The error appears before authentication, so the failing stage is the client's initial HTTPS connection to the portal. Since peers at the same site succeed, the fault is local to this client, most likely DNS resolution of the portal FQDN or a blocked port. Verifying resolution and port reachability targets that first connection stage.

Answer

Check the user's HIP profile match against the HIP-enabled security policy.

Answer

Examine the user's decryption policy to see whether the portal certificate is being intercepted.

Answer

Restart the Service Connection to refresh the data center IPsec tunnel.

Question 7

An administrator is troubleshooting a Prisma Access deployment experiencing intermittent packet drops and high latency across remote branches. Which THREE diagnostic steps or tools should be used? (Choose three)

Accepted Answer

Check IPsec tunnel monitoring statistics and DPD settings for packet loss and tunnel flapping.. Option B is correct because intermittent drops and high latency across remote branches in a Prisma Access deployment are frequently caused by IPsec tunnel instability, so examining tunnel monitoring statistics and Dead Peer Detection (DPD) settings helps identify packet loss, rekey failures, and tunnel flapping. Option D is correct because MTU and TCP MSS clamping mismatches on IPsec tunnels cause fragmentation or dropped oversized packets, which directly produces intermittent packet loss and latency symptoms that must be verified and corrected. Option E is correct because QoS bandwidth allocation and utilization review reveals whether congestion is dropping or delaying critical traffic, a common cause of high latency and drops on branch links. Option A does not belong because modifying Panorama administrator accounts is an administrative access change unrelated to packet forwarding, latency, or tunnel performance. Option C does not belong because GlobalProtect portal certificate expiration would cause authentication or connection failures for remote users, not the intermittent packet drops and latency described in the scenario.

Answer

Modify the administrative administrator accounts in Panorama.

Answer

Check the GlobalProtect portal certificate expiration date.

Question 8

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Accepted Answer

An identity provider (IdP) integration, such as Azure AD or Okta.. Option C is correct because Cloud Identity Engine (CIE) requires an external identity provider integration — such as Microsoft Entra ID, Okta, or another SAML/SCIM-capable IdP — to synchronize user and group directory data into CIE for policy enforcement in Prisma Access. Option E is correct because the CIE service itself must be enabled/activated within the Prisma Access tenant (via the hub or the CIE portal) before directory sync and identity-based policies can be configured. Option A is incorrect because CIE is a cloud service that ingests directory data from a supported IdP or on-premises directory sync agent; it does not require an Active Directory Domain Controller to be installed on Prisma Access infrastructure. Option B is incorrect because DNS configuration on a local workstation is a general client-side requirement, not a prerequisite for provisioning CIE with Prisma Access. Option D is incorrect because CIE is a cloud-delivered identity service and does not require deploying a hardware firewall at every branch.

Answer

Active Directory Domain Controller installation on Prisma Access.

Answer

Configuring DNS on the local workstation.

Answer

Deploying a hardware firewall at every branch.

Question 9

An administrator is reviewing the Prisma Access deployment and notices that a Remote Network site has been offline for several hours. The administrator wants to quickly identify whether the issue is related to the IPsec tunnel or to the underlying ISP connectivity. Which Prisma Access dashboard should the administrator use to view the tunnel status and related alerts?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the dashboard that aggregates Remote Network health, including IPsec tunnel status and alerts. It allows administrators to quickly determine whether a site outage is due to tunnel failure or ISP problems. The other options relate to different functions and would not provide the needed information.

Answer

GlobalProtect app logs

Answer

Decryption logs

Answer

Threat logs in the Prisma Access portal

Question 10

Which administrative role or tool is primarily used to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the administrative tool specifically designed to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions. It provides dashboards, alerts, and analytics for mobile users, remote networks, and service connections. It is the primary monitoring and visibility platform for Prisma Access.

Answer

Prisma Cloud Compute Console

Answer

WildFire portal

Answer

Cortex XDR incident management console

Question 11

Which TWO actions should an administrator take when troubleshooting high CPU utilization on Prisma Access cloud infrastructure nodes? (Choose two)

Accepted Answer

Check ACC and Traffic/Threat logs to identify traffic spikes, unusual session volumes, or potential security attacks.. Option A is correct because Prisma Access high CPU on cloud infrastructure nodes is frequently caused by traffic surges, session exhaustion, or attack traffic, and the ACC plus Traffic/Threat logs in Panorama provide the visibility needed to correlate CPU spikes with specific applications, users, session counts, or threat signatures. Option C is correct because generating a Tech Support File for Prisma Access from Panorama captures the cloud node's system resource data, running processes, and daemon status, which is the standard evidence-gathering step for diagnosing which process (for example, the dataplane or management daemon) is consuming CPU. Option B is not relevant because changing the GlobalProtect portal authentication profile affects user login behavior, not cloud node CPU consumption. Option D is not relevant because updating the Antivirus dynamic signature version is a content update action and does not address the root cause of high CPU on infrastructure nodes. Option E is not relevant because restarting a branch customer CPE device affects the remote site's connectivity and would not resolve CPU load on Prisma Access cloud infrastructure nodes.

Answer

Modify the GlobalProtect client portal authentication profile.

Answer

Update the Antivirus dynamic signature version.

Answer

Restart the customer CPE device at the branch location.

Question 12

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

Accepted Answer

URL Filtering with real-time category lookups. Prisma Access provides comprehensive cloud-delivered security services including Threat Prevention, URL Filtering, and WildFire malware analysis natively on SPNs.

Answer

Local enterprise data center physical power failover management

Answer

Physical rack-and-stack server hardware maintenance by the customer

Question 13

A Prisma Access administrator needs to publish an internal web application to Mobile Users through a Private Application. The application uses a hostname that is not resolvable by public DNS. The administrator wants Mobile Users' browsers to reach the app using its internal FQDN without exposing the app to the internet. What must be configured to achieve this?

Accepted Answer

Add the internal FQDN to the Private Application definition and configure the DNS server used by Mobile Users to resolve it, typically through the GlobalProtect app's DNS settings or a split-DNS configuration.. Private Applications rely on the client being able to resolve the internal FQDN so it can direct the connection into the Prisma Access tunnel. Since public DNS cannot resolve internal names, the administrator must define the Private Application with that FQDN and ensure Mobile Users use a DNS resolver that can resolve it, commonly via the GlobalProtect app's DNS settings or split-DNS. This keeps the application private while allowing normal browser access by name.

Answer

Publish the application through a Service Connection with a NAT rule translating the internal FQDN to the public IP.

Answer

Create a DNS Security policy that rewrites the internal FQDN to the Private Application's tunnel IP address.

Answer

Enable Local Breakout for the Mobile User tunnel so the internal FQDN resolves through the local ISP DNS.

Question 14

An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?

Accepted Answer

Monitor -> Logs -> Authentication. SAML 2.0 authentication events, including IdP connectivity failures and assertion errors, are logged in the Authentication log, accessible via Monitor > Logs > Authentication in Panorama. This log captures the full SAML exchange, including IdP response status, assertion validation errors, and timeout reasons, making it the correct place to diagnose intermittent authentication timeouts.

Answer

Monitor -> Traffic -> Session End

Answer

Objects -> Authentication -> SAML Test

Answer

Panorama -> Cloud Services -> Health -> Infrastructure

Question 15

An administrator needs to verify whether a Prisma Access Remote Network is successfully exchanging routes with the customer CPE router over BGP. Where can the real-time BGP peer state be checked?

Accepted Answer

Run operational CLI commands such as 'show routing protocol bgp peer' or check the routing status in the Prisma Access monitoring dashboard.. Prisma Access Remote Networks use BGP to exchange routes between the customer CPE and the Prisma Access service connection. The authoritative way to verify real-time BGP peer state is through operational commands like 'show routing protocol bgp peer' on the relevant node or via the Prisma Access monitoring dashboard's routing status view. These tools display the current BGP session state (e.g., Established, Idle, Active), prefixes received/advertised, and uptime. Logs and traffic logs do not provide live peer state.

Answer

Review the System log for BGP daemon errors.

Answer

Examine the Traffic log for BGP port 179 sessions.

Answer

Check the GlobalProtect gateway log.