SSE-Engineer Practice Test 16 — 15 Questions

Question 1

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Local breakout. Local breakout is designed to optimize mobile user internet access by egressing traffic at the nearest Prisma Access location. If it is not enabled, traffic may be backhauled to a service connection, adding latency. Verifying local breakout settings ensures that SaaS traffic takes the optimal path. Other features like HIP, decryption, and QoS do not control traffic routing and are not relevant to the backhauling concern.

Answer

HIP-based policy

Answer

SSL decryption

Answer

Quality of Service (QoS)

Question 2

An administrator is deploying Prisma Access with a service connection so that branch users can reach internal applications hosted in a data center. The branch traffic is tunneled to a Prisma Access mobile user location, and the administrator wants to confirm which component forwards traffic from the Prisma Access infrastructure to the data center. Which component provides this forwarding?

Accepted Answer

The service connection forwards traffic from the Prisma Access infrastructure to the data center over an IPsec tunnel.. The service connection is the Prisma Access construct that connects the Prisma Access infrastructure to private networks such as a data center or headquarters. When branch users tunnel to a mobile user location and need to reach internal applications, the service connection provides the IPsec tunnel and routing into that private network. A remote network connection is for the opposite direction, an endpoint tunnel is not involved, and the explicit proxy only handles web traffic.

Answer

The remote network service connection terminates the IPsec tunnel from the branch and routes traffic to the data center.

Answer

The Prisma Access explicit proxy forwards the traffic to the data center through the SWG egress path.

Answer

The GlobalProtect app on the branch endpoint establishes a second tunnel directly to the data center.

Question 3

An administrator wants to check the status of active IPsec tunnels for a Prisma Access Remote Network location. Which Panorama menu path provides the most direct overview of IPsec tunnel health?

Accepted Answer

Panorama > Cloud Services > Status > Remote Networks.. Panorama > Cloud Services > Status > Remote Networks provides a consolidated view of each Remote Network node's health, including IPsec tunnel status, BGP peering state, and bandwidth utilization. This is the most direct path to check whether the IPsec tunnels for a specific remote network location are up or down.

Answer

Policies > Security.

Answer

Device > High Availability.

Answer

Monitor > Traffic.

Question 4

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the SSL Decryption logs in the Prisma Access dashboard for errors related to the SaaS applications.. SSL Decryption logs are the primary source for troubleshooting decryption issues. They record why decryption succeeded or failed, including certificate errors, unsupported protocols, or policy mismatches. When users cannot access SaaS applications and the tunnel is up, checking these logs can quickly reveal if decryption is failing and why. This allows the administrator to pinpoint whether the issue is due to decryption configuration, certificates, or other factors.

Answer

Ensure that the decryption policy includes the SaaS applications in the decryption profile.

Answer

Verify that the forward trust certificate is installed on the mobile users' devices.

Answer

Confirm that the SaaS applications are not excluded from decryption in the decryption policy.

Question 5

An SSE engineer is investigating why a Prisma Access mobile user's traffic to a SaaS application is being inspected by a decryption policy that should be bypassed. The decryption policy has a source user group that should exclude this user, and the user is a member of a different group. The engineer confirms the user's group membership in the identity provider is correct. Which factor is most likely causing the decryption policy to match unexpectedly?

Accepted Answer

The user's group membership has not yet been synchronized to Prisma Access, so the policy evaluates an outdated or empty group mapping.. Unexpected decryption matches on group-based policies usually stem from identity information being out of date in Prisma Access. If the user's group mapping has not synchronized, the policy evaluates against stale or missing data and can match a rule that should have been excluded, applying decryption where a bypass was intended.

Answer

The decryption policy is evaluated before user identification, so group-based conditions are ignored during the first session.

Answer

The decryption profile assigned to the policy is misconfigured, causing the policy to apply to all users regardless of group conditions.

Answer

SSL decryption bypass rules take precedence only when the destination is in a predefined category, not when a source user group is used.

Question 6

An enterprise network team is troubleshooting a Prisma Access Remote Network deployment where DNS queries from branch offices are failing to resolve internal resources. Which THREE components should be inspected? (Choose three)

Accepted Answer

Check the Service Connection routing configuration to ensure DNS traffic destined for internal DNS servers is correctly routed across the Service Connection tunnel.. Option A is correct because in a Prisma Access Remote Network deployment, DNS queries to internal servers must traverse the Service Connection tunnel, so the Service Connection routing configuration must include the internal DNS server subnets; otherwise queries are dropped or sent elsewhere. Option B is correct because Security Policy rules must explicitly permit DNS (UDP/TCP port 53) from the branch/Remote Network zone to the Service Connection or internal zones, and a missing or misordered rule will silently block resolution. Option E is correct because the Remote Network configuration in Panorama defines the DNS server IP addresses handed to branch clients; if the primary and secondary DNS server IPs are wrong or missing, clients cannot resolve internal resources. Option C is not relevant because the GlobalProtect client portal certificate affects user/endpoint connectivity and authentication, not branch Remote Network DNS forwarding. Option D is not relevant because WildFire is a threat prevention subscription for file analysis and does not influence DNS resolution for internal resources.

Answer

Verify the GlobalProtect client portal certificate.

Answer

Check the WildFire threat prevention subscription license key.

Question 7

Which TWO tools or logs in Panorama should an administrator use when troubleshooting a security policy rule that is unexpectedly dropping legitimate user traffic in Prisma Access? (Choose two)

Accepted Answer

Monitor > Logs > Traffic to identify sessions marked with a 'deny' action and note the matching rule name.. Option A is correct because Monitor > Logs > Traffic in Panorama shows the traffic log entries for Prisma Access sessions, including the Action field (allow/deny/drop) and the Rule Name that matched, which directly identifies which security policy rule is unexpectedly denying legitimate user traffic. Option C is correct because the CLI command 'test security-policy-match' (run on the firewall or Prisma Access node) simulates a flow with specified source, destination, user, application, and service, then reports which security rule would match and the resulting action, letting the administrator verify rule evaluation order and confirm why the traffic is being dropped. Option B is incorrect because Device > High Availability status only reports HA peer state and synchronization, not security policy rule matching. Option D is incorrect because Monitor > Dynamic Updates > Status shows content, antivirus, and app/threat signature update versions, not policy rule decisions. Option E is incorrect because Panorama > Cloud Services > Audit Log records administrative and configuration change activity, not live traffic policy enforcement decisions.

Answer

Device > High Availability status.

Answer

Monitor > Dynamic Updates > Status.

Answer

Panorama > Cloud Services > Audit Log.

Question 8

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

Accepted Answer

A valid public IP address and a pre-shared key matching the IKE gateway configuration defined in Panorama.. To establish an IPsec tunnel with Prisma Access, the branch office router must have a valid public IP address and a pre-shared key that matches the IKE gateway configuration in Panorama. This is fundamental for IKEv2 authentication and tunnel establishment. Without these, the tunnel cannot be initiated.

Answer

The GlobalProtect app configured in manual gateway connection mode.

Answer

An active Prisma Access Insights API token for dynamic routing updates.

Answer

The Cloud Identity Engine agent installed locally on the branch router's operating system.

Question 9

When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?

Accepted Answer

Panorama Administrator role with Cloud Services plugin permissions. Pushing configuration from Panorama to Prisma Access requires the Panorama Administrator role combined with Cloud Services plugin permissions, because the Cloud Services plugin is what brokers communication between Panorama and the Prisma Access cloud infrastructure. Without those plugin-level permissions, the admin can edit Panorama objects but cannot commit or push them to the cloud tenant. This role pairing is what authorizes the 'Push to Devices' / 'Commit to Prisma Access' workflow.

Answer

Network Administrator without Cloud Services access

Answer

Prisma Cloud Administrator

Answer

GlobalProtect Read-Only Operator

Question 10

Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?

Accepted Answer

Firewall as a Service (FWaaS). Firewall as a Service (FWaaS) in Prisma Access provides Layer 3/4 and Layer 7 inspection for traffic traversing between virtual networks, cloud environments, and remote sites connected to the Prisma Access cloud. It applies the same security policy stack (App-ID, Threat Prevention, WildFire) to east-west and north-south traffic in the cloud.

Answer

CASB API scanning

Answer

Prisma Access Insights

Answer

GlobalProtect Portal

Question 11

An organization is migrating their branch offices to Prisma Access Firewall as a Service (FWaaS). What is the primary method used to connect a physical branch office location to the Prisma Access cloud infrastructure securely?

Accepted Answer

IPsec VPN tunnels from the branch office router or firewall to Prisma Access Remote Networks. Prisma Access Remote Networks are designed to connect physical branch offices to the Prisma Access cloud infrastructure using IPsec VPN tunnels terminated on the branch's CPE router or firewall. The CPE establishes an IKE/IPsec tunnel to Prisma Access service IP addresses, which are provided during Remote Network onboarding in Panorama. This is the standard, supported method for branch connectivity and does not require client software on individual endpoints.

Answer

Direct peering via AWS Direct Connect without any encapsulation

Answer

GlobalProtect client software installed on every desktop in the branch

Answer

Explicit HTTP proxy configuration pushed via browser group policy

Question 12

An administrator is deploying a new Prisma Access tenant with a single service connection to an on-premises data center. The security team requires that all traffic from remote network branch offices to the data center be inspected by Prisma Access security policy before reaching internal applications. The administrator configures the remote network and service connection, but branch users report they can reach internal applications directly without any security inspection. What is the most likely cause?

Accepted Answer

The service connection is not associated with the remote network in the Prisma Access configuration, so branch traffic is not routed through the service connection.. Remote networks in Prisma Access require explicit association with a service connection to route traffic to on-premises resources through the Prisma Access security stack. Without this association, branch traffic destined for the data center will not traverse the service connection and therefore will not be inspected by Prisma Access security policy. The association is configured in the Prisma Access service connection settings and must reference the remote network.

Answer

The security policy rule that allows branch-to-data-center traffic was placed after a rule that allows all traffic, so the inspection rule is never evaluated.

Answer

The remote network was configured with a static route that points directly to the data center subnet instead of the service connection.

Answer

The remote network was configured with a default route that points to the internet, causing all traffic to bypass the service connection.

Question 13

A Prisma Access administrator needs to verify that the GlobalProtect portal is presenting the correct certificate to mobile users during authentication. Which tool should the administrator use to inspect the certificate presented by the portal?

Accepted Answer

Use the 'openssl s_client' command from a client machine to connect to the portal and view the certificate.. The 'openssl s_client' command connects to the portal's HTTPS port and displays the certificate chain, allowing the administrator to verify the exact certificate presented. This is a direct and reliable method to inspect the certificate, ensuring it matches the expected configuration. Other methods may show cached or different certificates, leading to confusion.

Answer

Check the GlobalProtect app logs on a client to see the certificate details.

Answer

Use a browser to navigate to the portal and click on the padlock icon to view the certificate.

Answer

Run 'show global-protect-portal certificate' from the Prisma Access CLI.

Question 14

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The affected users are connecting through a different Prisma Access region that does not have a route to the remote network.. Prisma Access mobile users are assigned to a region, and each region has its own service connections to remote networks. If a user's region lacks a service connection to the target remote network, they cannot reach resources there. Other users in a region with the appropriate service connection can access the application. This regional routing difference is the most likely cause.

Answer

The affected users are assigned to a different security policy that blocks the application.

Answer

The service connection for the remote network is down or misconfigured, affecting only some users.

Answer

The application's firewall is blocking the IP addresses of the affected users.

Question 15

An administrator is troubleshooting a Prisma Access deployment where mobile users report slow performance when accessing SaaS applications. The administrator suspects that traffic is being backhauled through a service connection instead of going directly to the internet. Which Prisma Access feature should the administrator verify to ensure that traffic is taking the optimal path?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IPsec tunnel is hitting bandwidth or packet-per-second limits tied to the selected compute location or license, causing drops above the threshold.. When an IPsec tunnel stays up but traffic drops above a certain throughput, the most likely cause is a capacity limit on the Prisma Access side, such as the compute location's bandwidth or the licensed throughput for remote networks. Verifying the location capacity and license tier is the correct first step before blaming the ISP or encryption settings.

Answer

The tunnel MTU is too low, causing fragmentation that only manifests when throughput increases.

Answer

The IPsec proposal is using a cipher that cannot sustain more than a fixed number of packets per second on the branch device.

Answer

The branch ISP is applying traffic shaping that only affects IPsec-encapsulated packets above 500 Mbps.