SSE-Engineer Practice Test 17 — 15 Questions

Question 1

An administrator needs to verify that a newly configured remote network in Prisma Access is operational and passing traffic. Which status indicator in the Prisma Access dashboard should the administrator check first to confirm the IPSec tunnel is established?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Remote Networks' status under the Health section, which shows tunnel status and connectivity.. The Prisma Access Health dashboard provides a consolidated view of remote network status, including whether the IPSec tunnel is established and passing traffic. Checking the Remote Networks status there gives the administrator immediate confirmation of tunnel health. Other sections like Service Connections or Mobile Users relate to different connection types and would not show remote network tunnel status.

Answer

The 'Logs' section under Monitor, which shows traffic and system logs for all components.

Answer

The 'Service Connections' status under the Health section, which shows connectivity to data centers.

Answer

The 'Mobile Users' status under the Health section, which shows GlobalProtect connections.

Question 2

An administrator has just finished configuring a new Prisma Access tenant and wants to verify that Mobile Users can connect and that security policy is being applied. The administrator needs a high-level view of connected Mobile Users, their locations, and the applications in use. Which Prisma Access monitoring area should the administrator use?

Accepted Answer

The Prisma Access Insights application, which provides dashboards for Mobile Users, Remote Networks, and health metrics.. Prisma Access Insights aggregates telemetry across the service and provides dashboards specifically for Mobile Users, including connection status, location, and application usage. It is the intended tool for obtaining a high-level operational view after onboarding, allowing the administrator to confirm that users are connecting and that policy is being enforced without inspecting individual logs.

Answer

The firewall's System logs in the Strata Cloud Manager, which show configuration changes and commit history.

Answer

The Threat logs in the Strata Cloud Manager, which list security events and blocked sessions.

Answer

The CLI on each Prisma Access compute node, using show commands to display active sessions.

Question 3

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

Accepted Answer

Automatic IP address allocation managed by Prisma Access. Prisma Access automatically manages and allocates dynamic IP pools for mobile users via Panorama.

Answer

Static IP assignment per user via Active Directory attributes

Answer

Static IP assignment via local DHCP server in each branch office

Answer

Manual entry by users upon connection

Question 4

An architect is designing a Prisma Access deployment for a company with offices in North America and Europe. The company wants to minimize latency for users accessing SaaS applications. Which Prisma Access feature should be leveraged to achieve this?

Accepted Answer

Deploy Remote Networks in each region and enable local internet breakout with security inspection.. To minimize latency for SaaS applications, Remote Networks should be deployed in each region. Remote Networks connect branch offices to the nearest Prisma Access security processing node, where traffic is inspected and then broken out to the internet locally. This avoids backhauling and reduces latency. Service Connections are for data center connectivity, and Mobile Users are for individual users, not offices.

Answer

Enable Prisma Access Mobile Users with GlobalProtect and use the closest security processing node.

Answer

Use Service Connections in each region to route SaaS traffic through the data center.

Answer

Configure Remote Networks in each region and use Service Connections to backhaul traffic to a central data center.

Question 5

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Accepted Answer

Local ISP latency and bandwidth.. Compute locations are chosen based on proximity to users, licensing availability, and the specific traffic type.

Answer

The number of users in the local branch.

Answer

The color of the hardware appliance.

Question 6

A Prisma Access administrator notices that a mobile user's traffic to a sanctioned SaaS application is being routed through a Service Connection in a different region than expected, causing high latency. The administrator wants to verify which Service Connection the user's session is currently using for that application. Which action should the administrator take?

Accepted Answer

Check the Traffic logs in the Prisma Access Insights or the Strata Logging Service for the session details.. Traffic logs in Prisma Access Insights or Strata Logging Service include detailed session information, including the Service Connection used for egress. By filtering logs for the specific user and application, the administrator can see exactly which Service Connection is handling the traffic. This directly answers the question and enables troubleshooting latency issues related to regional egress selection.

Answer

Use the Prisma Access CLI command 'show service-connection status' to display active connections.

Answer

Review the GlobalProtect app logs on the user's endpoint for the selected gateway and service connection.

Answer

Run a traceroute from the user's endpoint to the SaaS application to see the path.

Question 7

An administrator is planning to deploy Prisma Access for a company with a single data center and multiple branch offices. The administrator needs to ensure that branch office traffic to the internet is secured by Prisma Access, while traffic to the data center is routed directly. Which Prisma Access component must be deployed to connect the branch offices to Prisma Access?

Accepted Answer

Remote Network. Remote Network is the Prisma Access component designed to connect branch offices via IPSec tunnels, ensuring their internet-bound traffic is secured. Service Connection connects to data centers, Mobile User is for individual users, and Explicit Proxy is for proxy-based redirection. Therefore, Remote Network is the correct choice for branch office connectivity.

Answer

Explicit Proxy

Answer

Service Connection

Answer

Mobile User

Question 8

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Accepted Answer

Check the IPsec tunnel status under Panorama > Cloud Services > Status > Remote Networks.. Option B is correct because Panorama's Cloud Services status page (Panorama > Cloud Services > Status > Remote Networks) is the authoritative place to view the IPsec tunnel state for a remote network, showing whether the tunnel is up/down and its IKE/IPsec status. Option E is correct because an IPsec VPN tunnel only establishes when both peers agree on matching IKE phase 1 and phase 2 parameters, including encryption and authentication algorithms, DH group, and lifetime, so verifying these cryptographic and phase settings on both the Prisma Access side and the customer edge router is essential for tunnel health. Option A is not relevant because GlobalProtect client runtime logs pertain to mobile user connectivity, not a site-to-site IPsec remote network tunnel. Option C is not relevant because DNS resolver settings affect name resolution, not IPsec tunnel establishment or status. Option D is not applicable because a physical cable test from a Prisma Access cloud node to a carrier router is not a supported or practical troubleshooting step in the Prisma Access cloud environment.

Answer

Inspect the GlobalProtect client runtime logs on the mobile user's laptop.

Answer

Check the DNS resolver settings in the local device setup tab.

Answer

Run a physical cable test from the Prisma Access cloud node to the carrier router.

Question 9

Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?

Accepted Answer

GlobalProtect Client-less VPN. GlobalProtect Client-less VPN provides browser-based access to internal web applications without requiring an endpoint client.

Answer

Prisma Access Remote Network IPsec

Answer

Prisma Access Browser

Answer

Explicit Proxy Forwarding

Question 10

An administrator is troubleshooting a Prisma Access mobile user who reports that corporate applications are unreachable, yet public websites load normally. In the Prisma Access status dashboard, the user's GlobalProtect connection shows Connected and the tunnel is assigned a 10.201.x.x address, but the Service Connection to the corporate data center shows a status of Down. Which action should the administrator take to resolve the user's issue?

Accepted Answer

Verify the Service Connection IPsec tunnel to the data center and bring the connection back up, since internal traffic depends on it.. Internal corporate reachability for mobile users depends on the Service Connection between Prisma Access and the data center. A healthy GlobalProtect tunnel with working internet access but failed internal access points to that backend path. Confirming and restoring the Service Connection IPsec tunnel re-establishes routing to internal subnets, which is the correct remediation for this symptom.

Answer

Reassign the user to a different GlobalProtect gateway with lower latency to restore internal access.

Answer

Renew the GlobalProtect user certificate on the portal and have the user reconnect.

Answer

Add the internal application subnets to the GlobalProtect split-tunnel include list so they route through the tunnel.

Question 11

A Prisma Access administrator is troubleshooting a Remote Network deployment where branch users cannot reach internal applications hosted in a data center connected via an IPsec tunnel. The administrator confirms that the Remote Network IPsec tunnel is up and that the branch firewall routes the internal subnets toward Prisma Access. Which action should the administrator take next to verify that Prisma Access is correctly routing traffic to the data center?

Accepted Answer

Review the Prisma Access Service Connection status and verify the associated static routes for the data center subnets are present and active.. The Service Connection is the component that links Prisma Access to the data center. If the Service Connection is down or lacks the necessary static routes, Remote Network users cannot reach internal applications even though their IPsec tunnel is up. Verifying the Service Connection status and its routes is the logical next step to isolate the routing failure.

Answer

Verify that the branch firewall's IPsec tunnel interface is configured with the correct tunnel monitoring IP address.

Answer

Inspect the SSL Decryption profile applied to the Remote Network to ensure it is not blocking the internal application traffic.

Answer

Check the GlobalProtect app logs on the branch users' endpoints to confirm they are receiving the correct internal DNS servers.

Question 12

An administrator has deployed Prisma Access Remote Networks, but traffic from a branch office is failing to pass through the IPsec tunnel to Prisma Access. The IKE phase 1 negotiation is failing. Which Prisma Access operational command should the administrator run via the CLI to check the IPsec tunnel status and IKE SA parameters?

Accepted Answer

show vpn ike-sa gateway . On Palo Alto Networks firewalls and Prisma Access, the operational command 'show vpn ike-sa gateway ' displays IKE phase 1 security associations, including negotiation state, peer identity, and any failure reason. This is the correct CLI command to diagnose IKE phase 1 failures for a remote network IPsec tunnel.

Answer

show globalprotect-gateway current-users

Answer

show system info

Answer

show running resource-monitor

Question 13

An administrator notices that Prisma Access mobile users in the EMEA region are being assigned IP addresses from the 10.20.0.0/16 pool, which overlaps with an internal subnet at 10.20.10.0/24 that users must reach. What should the administrator do in the Prisma Access mobile user configuration to avoid the conflict?

Accepted Answer

Change the mobile user IP pool to a non-overlapping range and commit the Prisma Access configuration.. Mobile user IP pools in Prisma Access must be unique and must not overlap with internal subnets that clients must reach. The reliable fix is to reassign the mobile user pool to a non-overlapping range so the client address space and the internal address space remain distinct, then commit the change to the Prisma Access tenant.

Answer

Add a static route on the internal network pointing 10.20.0.0/16 to the Prisma Access service connection.

Answer

Configure a NAT policy on Prisma Access to translate the mobile user pool to a different range.

Answer

Enable split tunneling so that 10.20.10.0/24 is excluded from the GlobalProtect tunnel.

Question 14

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

Accepted Answer

In the Panorama Security Policy rule matching the traffic.. Security profiles for mobile user internet traffic are applied in the Panorama Security Policy rule that matches the traffic (D). In Prisma Access, security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire, etc.) are attached to security policy rules, which are managed in Panorama and pushed to Prisma Access. The other options are not where security profiles are applied to traffic.

Answer

In the GlobalProtect Gateway settings.

Answer

In the Service Connection configuration.

Answer

In the Cloud Identity Engine configuration.

Question 15

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

Accepted Answer

Cloud Identity Engine Agent. The Cloud Identity Engine Agent runs on-premises and establishes an outbound secure connection to CIE, synchronizing directory data without requiring inbound firewall changes.

Answer

Prisma Access User-ID Syslog Listener

Answer

GlobalProtect Gateway Proxy

Answer

Panorama Log Collector