SSE-Engineer Practice Test 16 — 15 Questions

Question 1

An organization notices that certain cloud-based SaaS applications are experiencing performance bottlenecks when accessed through Prisma Access mobile users. The administrator wants to configure explicit SaaS application traffic steering or bypass. Where is this configured in Panorama for Prisma Access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Panorama > Cloud Services > Prisma Access > Mobile Users > Traffic Steering / QoS or GlobalProtect Client Settings.. SaaS Security and traffic steering / explicit proxy / Prisma Access application steering configurations are managed under Cloud Services or GlobalProtect client settings.

Answer

Device > Setup > Content ID.

Answer

Policies > Decryption.

Answer

Objects > Custom Objects > URL Filtering.

Question 2

Which TWO commands or tools are recommended for troubleshooting routing issues on Prisma Access infrastructure? (Choose two)

Accepted Answer

CLI operational commands such as 'show routing route' or 'show routing protocol bgp' to inspect active routing tables.. Routing troubleshooting utilizes dynamic routing operational CLI commands (such as show routing route) and Panorama traffic/routing monitoring tools.

Answer

Monitor > Logs > Threat.

Answer

Device > High Availability state monitor.

Answer

Objects > Custom Objects > URL Filtering.

Question 3

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

Accepted Answer

Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users.. Panorama > Cloud Services > Status provides regional deployment metrics and node health.

Answer

Policies > QoS > Bandwidth Management.

Answer

Device > High Availability.

Answer

Monitor > Traffic > GlobalProtect Analytics.

Question 4

Which TWO actions should an administrator perform when troubleshooting User-ID mapping failures for mobile users in Prisma Access? (Choose two)

Accepted Answer

Verify that GlobalProtect is configured to report user mappings and check authentication log status.. Troubleshooting User-ID involves verifying GlobalProtect authentication mapping, User-ID agent/Panorama polling status, and IP-user mapping operational tables.

Answer

Restart the physical firewall hardware in the branch office.

Answer

Change the WildFire signature update schedule.

Answer

Modify the QoS bandwidth allocation profile.

Question 5

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

Accepted Answer

Check the Service Connection routing configuration to ensure DNS traffic destined for internal DNS servers is correctly routed across the Service Connection tunnel.. Troubleshooting branch office DNS resolution involves checking DNS server IP configuration in remote network settings, Service Connection routing for DNS traffic, and security rules allowing DNS.

Answer

Verify the GlobalProtect client portal certificate.

Answer

Check the WildFire threat prevention subscription license key.

Question 6

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

Accepted Answer

Monitor > ACC (Application Command Center) to analyze application traffic behavior and usage trends.. Troubleshooting application reachability requires examining Traffic logs for drops and ACC/Threat logs for security blocks.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Setup > Management.

Answer

Objects > Addresses.

Question 7

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

Accepted Answer

Verify that the SAML Identity Provider (IdP) signing certificate imported into Panorama matches the active IdP certificate.. Troubleshooting SAML authentication involves verifying clock skew, IdP metadata/certificates, and authentication profile configuration.

Answer

Modify the NAT policy rules.

Answer

Check the URL Filtering category for the IdP login domain.

Answer

Restart the physical firewall in the branch office.

Question 8

An administrator configures a new Service Connection in Prisma Access to allow mobile users to access resources in the corporate data center. However, traffic from mobile users cannot reach the data center. The administrator confirms that the IPsec tunnel is up. What is the most likely cause of this issue in Panorama?

Accepted Answer

The internal subnet routes associated with the Service Connection have not been added to the Mobile Users Explicit Proxy or Split Tunnel configuration.. When setting up Service Connections, administrators must update the Mobile Users explicit proxy or explicit routing settings (specifically pushing internal routes via the GlobalProtect agent config) so that clients know to send data center traffic through the Prisma Access tunnel.

Answer

Panorama requires a reboot to activate Service Connections.

Answer

The GlobalProtect client version is outdated on all endpoints.

Answer

The WildFire public cloud subscription has expired.

Question 9

An administrator configures a Service Connection in Prisma Access to reach an on-premises Active Directory domain controller for authentication. Users are able to log in, but User-ID is failing to map IP addresses to usernames for users behind the Remote Network. What is the most likely reason for this User-ID failure?

Accepted Answer

User-ID agent or Panorama redistribution is not configured to poll the internal Domain Controller across the Service Connection, or security rules block User-ID traffic.. User-ID collection from internal sources requires either User-ID agents, syslog listening, or Panorama polling configured correctly to reach the AD server across the Service Connection.

Answer

The GlobalProtect client certificate has expired.

Answer

BGP routing is disabled on the GlobalProtect gateway.

Answer

WildFire subscription is expired.

Question 10

An administrator wants to view historical bandwidth utilization trends for a specific Remote Network location over the past 30 days. Which Panorama monitoring workspace provides this historical reporting?

Accepted Answer

Monitor > Reports.. Panorama > Monitor > Reports or ACC provides historical reporting capabilities.

Answer

Device > Setup > Management.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Policies > QoS.

Question 11

An administrator is troubleshooting a policy where applications are being identified incorrectly in Prisma Access. Which tool should be used to inspect how Prisma Access performs App-ID identification on a live stream of packets?

Accepted Answer

Examine the Traffic log session details to view the detected App-ID, or use packet captures if necessary.. Packet capture (pcap) or policy evaluation tools are used to inspect traffic; flow basic diagnostics are done via traffic logs and session info.

Answer

Verify the SSL decryption certificate chain.

Answer

Check the GlobalProtect client configuration profile.

Answer

Review the Panorama Audit log.

Question 12

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

Accepted Answer

Traffic Logs with a filter for the source user and destination IP, checking the 'Drop Reason' field.. ACC (App-Command Center) and Traffic Logs are used to inspect sessions, but the ACC does not provide real-time session debugging for specific policy rule matches. The Panorama Traffic log with the correct filter or the CLI command 'test security-policy-match' is used to troubleshoot policy matches, but for real-time monitoring of dropped packets on Prisma Access nodes, Traffic Logs filtered by drop cause or using the Real-Time Log Viewer is the most appropriate native UI troubleshooting mechanism.

Answer

GlobalProtect app diagnostics tab on the endpoint.

Answer

Prisma Access Insight path quality monitoring.

Answer

Panorama Dynamic Updates status page.

Question 13

An administrator is troubleshooting a Prisma Access deployment where specific applications are identified as 'incomplete' or 'unknown-tcp' in the Traffic logs. Which THREE factors or troubleshooting steps should be evaluated? (Choose three)

Accepted Answer

Check for asymmetrical routing where traffic enters through one Prisma Access node/tunnel but exits through another.. 'Incomplete' and 'unknown-tcp' sessions typically occur due to insufficient data packets for App-ID identification, asymmetrical routing, or session timeouts before handshakes complete.

Answer

Verify the expiration date of the GlobalProtect gateway SSL certificate.

Answer

Check the WildFire subscription license key status.

Question 14

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

Accepted Answer

Panorama > Cloud Services > Setup > Infrastructure / Status.. Panorama > Cloud Services > Status or Setup displays the Prisma Access software and plugin version.

Answer

Policies > Security.

Answer

Device > Certificates.

Answer

Monitor > Dynamic Updates.

Question 15

An administrator wants to verify that threat prevention signatures are actively blocking simulated malicious traffic in a Prisma Access environment. Which testing tool or procedure is standard for verifying threat signatures safely?

Accepted Answer

Use standardized test payloads or URLs (such as the EICAR string for antivirus or PANW test URLs) and check the Threat log.. The standard testing method for Palo Alto Networks threat signatures is using standardized test files (e.g., EICAR for antivirus) or benign test URLs (e.g., panacea.threat.com).

Answer

Perform a Denial of Service attack against the Prisma Access public IP.

Answer

Disable SSL decryption across all security rules.

Answer

Restart the Panorama management server.