SSE-Engineer Practice Test 18 — 15 Questions

Question 1

An administrator has configured Prisma Access to forward logs to an external SIEM using a HTTPS log forwarding profile. After a week, the SIEM shows no Prisma Access logs, but the Prisma Access dashboard shows traffic and threats. Which item should the administrator verify first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

That the log forwarding profile is attached to the correct security policy rules. For logs to reach an external SIEM, the log forwarding profile must be attached to the security policy rules that generate those logs. If it is not attached, logs are stored in the data lake and appear in dashboards but are never forwarded. Verifying the profile attachment is the first and most likely check when dashboards show activity but the SIEM is empty.

Answer

That the SIEM's certificate is installed on the Prisma Access management plane

Answer

That the SIEM's IP address is included in the Prisma Access allowed list for outbound connections

Answer

That the Prisma Access data lake retention period is longer than seven days

Question 2

An administrator is configuring authentication for Prisma Access mobile users. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

RADIUS and LDAP authentication servers. Option B is correct because Prisma Access GlobalProtect natively supports RADIUS and LDAP authentication servers, allowing the mobile user gateway/portal to forward credentials to an external RADIUS or LDAP directory for validation. Option E is correct because Prisma Access also natively integrates with SAML 2.0 Identity Providers such as Okta, Microsoft Entra ID, and Ping Identity, enabling browser-based single sign-on for GlobalProtect mobile users. Options A, C, and D are not valid native authentication methods: local plaintext password files on endpoints are insecure and not a supported Prisma Access authentication mechanism, peer-to-peer certificate exchange without a trusted certificate authority does not provide proper identity validation, and hardcoded pre-shared keys without user credentials do not authenticate individual mobile users.

Answer

Local plaintext password files stored on user endpoint hard drives

Answer

Peer-to-peer certificate exchange without an authentication authority

Answer

Hardcoded pre-shared keys without user credentials

Question 3

Which TWO actions should an administrator take to troubleshoot an authentication failure when mobile users attempt to log into Prisma Access using SAML? (Choose two)

Accepted Answer

Verify that the SAML Identity Provider (IdP) signing certificate imported into Panorama matches the active IdP certificate.. Option D is correct because SAML assertions are validated against the IdP signing certificate imported into Panorama; if that certificate does not match the certificate the IdP is actively using to sign assertions, signature validation fails and authentication is rejected. Option E is correct because SAML assertions contain NotBefore and NotOnOrAfter conditions, so significant clock skew between the IdP and the Prisma Access service nodes causes valid assertions to be treated as expired or not yet valid, breaking login. Option A is wrong because NAT policy rules affect address translation and routing, not SAML assertion validation. Option B is wrong because URL Filtering categories govern web access policy, not the SAML authentication exchange with the IdP. Option C is wrong because restarting a branch firewall does not address SAML trust, certificate, or time-synchronization problems on the Prisma Access side.

Answer

Modify the NAT policy rules.

Answer

Check the URL Filtering category for the IdP login domain.

Answer

Restart the physical firewall in the branch office.

Question 4

A Prisma Access deployment has multiple Remote Networks and Mobile Users. An administrator implements Quality of Service (QoS) to prioritize VoIP traffic over bulk file transfers. After applying the QoS profile, VoIP performance does not improve. What should the administrator verify first in the Prisma Access QoS configuration?

Accepted Answer

Verify that the QoS profile is applied to the correct security policy rules and that the guaranteed bandwidth settings align with the provisioned Prisma Access node bandwidth limits.. QoS in Prisma Access only takes effect if the QoS profile is attached to the correct security policy rules and the guaranteed bandwidth settings are within the provisioned node bandwidth. If the profile isn't applied to the VoIP-matching rules or the bandwidth guarantees exceed node capacity, prioritization won't occur. Verifying this alignment is the first logical troubleshooting step.

Answer

Verify the BGP AS number on the customer CPE.

Answer

Check the expiration date of the GlobalProtect gateway SSL certificate.

Answer

Ensure that GlobalProtect pre-logon mode is disabled.

Question 5

A security administrator needs to quickly identify which users are consuming the most bandwidth through Prisma Access mobile user connections over the past 24 hours. Which Prisma Access monitoring dashboard or report should the administrator use?

Accepted Answer

The User Activity report in the Prisma Access Insights application.. The User Activity report within Prisma Access Insights is designed to show detailed user session information, including bandwidth usage. It can be filtered by time range and sorted to highlight the highest consumers, directly answering the administrator's need to identify top bandwidth users over the past 24 hours.

Answer

The GlobalProtect app logs on the Prisma Access portal.

Answer

The System logs in the Prisma Access Command Center.

Answer

The App Scope dashboard in the Prisma Access Insights application.

Question 6

An administrator is configuring Prisma Access to provide secure access to private applications for mobile users using ZTNA 2.0. The administrator must ensure that the solution enforces least-privilege access and continuous trust verification. Which TWO configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Enable User-ID and group mapping to enforce access policies based on user identity and group membership.. ZTNA 2.0 requires continuous verification of both user identity and device posture. User-ID and group mapping provide identity context, while HIP profiles assess endpoint security. Together, they enable least-privilege access by ensuring that only authorized users on compliant devices can reach private applications. Other options, such as decryption, application override, or QoS, do not directly enforce the required security controls.

Answer

Configure a QoS policy to prioritize traffic to private applications over other traffic.

Answer

Define an application override rule to ensure traffic to private applications is identified by port and protocol.

Answer

Create a decryption policy to inspect all traffic to private applications for threats and data patterns.

Question 7

A security engineer is troubleshooting why a Prisma Access mobile user's traffic to a specific external website is being allowed despite a security policy rule that should block it. The rule is configured with a source user of 'domain\jdoe' and a destination of 'any', and the action is deny. The user is authenticated via GlobalProtect with User-ID enabled. What is the most likely reason the rule is not matching?

Accepted Answer

The security policy rule is placed after a more general allow rule that matches the traffic first.. Security policy rules in Prisma Access are evaluated in order, and the first matching rule determines the action. If a broad allow rule appears above the specific deny rule, the traffic will be allowed and the deny rule will not be evaluated. The engineer should reorder the rules so that the more specific deny rule is above any general allow rules that could match the same traffic.

Answer

The destination 'any' in the security policy rule does not include external websites because Prisma Access treats external zones separately.

Answer

User-ID mapping for the user is not available because the GlobalProtect agent is not sending the domain username in the correct format.

Answer

The deny action is not supported for rules with a source user criterion in Prisma Access.

Question 8

When troubleshooting a Prisma Access deployment using SAML authentication, an administrator notices that users are successfully authenticated by the IdP, but the GlobalProtect client displays an error stating 'Invalid SAML Response: Signature Validation Failed'. What is the most likely root cause?

Accepted Answer

The IdP signing certificate imported into the Prisma Access authentication profile does not match the active certificate currently used by the IdP.. The error 'Invalid SAML Response: Signature Validation Failed' means the GlobalProtect/Prisma Access SAML authentication profile could not verify the digital signature on the SAML assertion returned by the IdP. This almost always occurs when the signing certificate configured in the authentication profile does not match the certificate the IdP is currently using to sign assertions—typically because the IdP rotated its certificate and the old one is still imported.

Answer

The decryption policy is blocking HTTPS traffic to the IdP.

Answer

The User-ID agent service on Panorama has crashed.

Answer

The GlobalProtect client version is outdated and does not support SAML.

Question 9

An administrator is reviewing the Prisma Access license and notices that the organization has purchased the Prisma Access for Networks license but not the Prisma Access for Users license. Which functionality is available with this license?

Accepted Answer

Remote network connectivity for branch offices.. The Prisma Access for Networks license specifically enables remote network connectivity for branch offices. It does not include mobile user entitlements, which require the Prisma Access for Users license. Organizations needing both must purchase both licenses. Understanding license entitlements is essential for planning and troubleshooting Prisma Access deployments.

Answer

Mobile user connectivity via GlobalProtect.

Answer

Cloud Identity Engine integration for user authentication.

Answer

Both mobile user and remote network connectivity.

Question 10

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

Accepted Answer

Verify that the peer public IP address configured in Panorama matches the public IP of the branch office router.. Option C is correct because an IPsec tunnel can only negotiate if the peer address configured for the Remote Network in Panorama matches the actual public IP of the branch office router; a mismatch in the peer IP or NAT-translated address prevents IKE Phase 1 from completing. Option D is correct because IKE Phase 1 and Phase 2 require matching cryptographic parameters — encryption algorithm, authentication/hash, DH group, and lifetime — and any mismatch in the proposals causes the tunnel to fail negotiation. Option E is correct because Prisma Access Insights provides tunnel status, IKE/IPsec error logs, and event details that directly identify why a Remote Network tunnel is down, making it the appropriate diagnostic tool in this scenario. Option A is not relevant because GlobalProtect client DNS settings affect end-user remote access, not site-to-site IPsec tunnel establishment for Remote Networks. Option B is not relevant because the Cloud Identity Engine container handles identity and authentication services, and rebooting it does not clear routing cache or resolve IPsec tunnel negotiation failures.

Answer

Modify the GlobalProtect client configuration to force internal DNS resolution.

Answer

Reboot the Cloud Identity Engine container to clear stale routing cache entries.

Question 11

An administrator is onboarding a new remote network in Prisma Access and wants to verify that the tunnel is healthy after configuration. Which two status indicators should the administrator check in the Prisma Access status view to confirm the remote network tunnel is up? (Choose two.)

Accepted Answer

The IPSec tunnel status showing connected for the specific remote network site.. To confirm a remote network tunnel is healthy, the administrator should verify that the IPSec tunnel state is connected and, when dynamic routing is configured, that the BGP peering session is established. Together these confirm the data plane is up and internal routes are being exchanged between the branch and Prisma Access.

Answer

The Cortex Data Lake license consumption for the tenant.

Answer

The number of decryption policy hits on the service connection.

Answer

The GlobalProtect agent version reported by mobile users in the region.

Question 12

An administrator is setting up Prisma Access and needs to ensure that mobile users connecting from managed corporate laptops can access internal resources, while unmanaged contractor laptops are restricted to web-based applications only. Which Prisma Access mechanism distinguishes between managed and unmanaged endpoints during connection?

Accepted Answer

GlobalProtect HIP (Host Information Profile) checks. GlobalProtect HIP (Host Information Profile) checks collect endpoint posture data — such as whether the device is domain-joined, has the corporate certificate, or runs required security software — and Prisma Access uses HIP profiles in security policy to distinguish managed corporate laptops from unmanaged contractor devices. This allows different access levels per endpoint type.

Answer

SAML Identity Provider group claims

Answer

Active Directory Security Group membership only

Answer

Prisma Access Explicit Proxy PAC file routing

Question 13

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

Accepted Answer

Vulnerability Protection profile. Option A (Vulnerability Protection profile) is correct because it inspects traffic for known exploits and vulnerabilities (e.g., buffer overflows, code execution attempts) using signatures and anomaly detection, which is essential for protecting outbound and internet-bound traffic against threats. Option B (WildFire Analysis profile) is correct because it forwards suspicious files and links to the WildFire cloud sandbox for dynamic analysis, providing protection against unknown, zero-day malware that signature-based tools cannot detect. Together, these two profiles deliver the comprehensive unknown-threat and malware coverage the administrator needs. Option C is incorrect because Decryption profiles are not assigned directly to the threat engine; they are applied via decryption policy rules to enable inspection of encrypted traffic. Option D is incorrect because Zone Protection profiles defend against volumetric and reconnaissance attacks (e.g., floods, port scans) at the ingress zone level, not against malware in outbound sessions. Option E is incorrect because QoS profiles only manage bandwidth allocation and traffic shaping, providing no threat or malware protection.

Answer

Decryption profile assigned directly to the threat engine

Answer

Zone Protection profile

Answer

QoS profile for traffic shaping

Question 14

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

Accepted Answer

Source and destination security zones. In Prisma Access Security policy rules, traffic is matched using the same rich criteria as PAN-OS, including source and destination security zones (Option A), which represent the trust/zone context of the source and destination of the flow (e.g., trust, untrust, and Prisma Access-specific zones like remote networks or mobile users) and are fundamental match conditions for policy enforcement. Option C is correct because App-ID identifies applications regardless of port/protocol, allowing rules to permit or deny traffic based on the actual application (e.g., salesforce, ssl, web-browsing), which is a core Prisma Access policy criterion. Option E is correct because User-ID and Cloud Identity Engine (CIE) provide user and group identity mapping, enabling identity-based rules (e.g., matching specific AD groups or users) for mobile users and remote networks. The unmarked options do not belong: local physical switch port numbers on the cloud node (Option B) are not exposed as policy match criteria in Prisma Access, and hardware motherboard serial numbers of client machines (Option D) are not used by Security policy rules to control traffic.

Answer

Local physical switch port numbers on the cloud node

Answer

Hardware motherboard serial numbers of client machines

Question 15

An administrator needs to give the security team a single dashboard that shows which Prisma Access security policy rules are being triggered most frequently across all mobile users and Remote Networks over the last 30 days. Which Prisma Access reporting capability should the administrator use?

Accepted Answer

The predefined Security policy rule usage report in the Prisma Access reporting interface. Prisma Access provides predefined reports that aggregate security policy rule usage over time, including which rules are triggered most often. This gives the security team a consolidated dashboard covering mobile users and Remote Networks for the requested 30-day window, which is exactly what the scenario requires.

Answer

The Threat log filtered by policy name

Answer

The Policy Optimizer in the Prisma Access monitoring interface

Answer

The System log filtered by configuration commits