SSE-Engineer Practice Test 19 — 15 Questions

Question 1

An administrator is configuring Prisma Access to secure outbound internet traffic for mobile users. The requirement is to inspect all traffic for threats and sensitive data, but the organization wants to avoid decrypting traffic to financial and healthcare websites due to privacy regulations. Which Prisma Access feature should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL Decryption policy with a no-decrypt rule for specific URL categories. The SSL Decryption policy in Prisma Access can include no-decrypt rules based on URL categories. This allows the organization to skip decryption for financial and healthcare sites while still inspecting other traffic. Data filtering, URL filtering, and decryption profiles do not provide the selective bypass required.

Answer

Decryption profile with strict settings applied to all traffic

Answer

URL Filtering profile with block action for financial and healthcare categories

Answer

Data Filtering profile with custom patterns for financial and healthcare data

Question 2

A Prisma Access mobile user experiences a scenario where specific internal domains fail to resolve when connected via GlobalProtect, while other internal domains resolve successfully. The split-DNS configuration in Panorama lists multiple domains. What is the most likely reason for this partial DNS failure?

Accepted Answer

Improperly formatted domain suffixes or exceeding the maximum number of supported split-DNS search domains for the client operating system.. Split-DNS in GlobalProtect allows administrators to specify which DNS suffixes should be resolved by internal DNS servers versus public DNS. Partial resolution failures typically occur when the configured domain suffixes are improperly formatted (e.g., missing leading dot, wrong syntax) or when the total number of split-DNS search domains exceeds the maximum supported by the client OS — Windows and macOS have limits on search domain list length. Domains beyond that limit are silently ignored, causing only some internal domains to resolve.

Answer

The GlobalProtect portal SSL certificate is expired.

Answer

WildFire cloud connectivity is down.

Answer

BGP route reflection is misconfigured on the Service Connection.

Question 3

A security engineer is planning a Prisma Access deployment for a company with offices in North America and Europe. The company wants to ensure that users in each region connect to the nearest Prisma Access location to minimize latency. Which Prisma Access component should the engineer configure to achieve this?

Accepted Answer

Mobile Users locations. Mobile Users locations are the regional gateways for remote user traffic. When multiple locations are configured, GlobalProtect clients can automatically connect to the closest one, reducing latency. This is the intended design for global user distribution. Remote Network locations, Service Connections, and Explicit Proxy serve different purposes and do not provide automatic geographic redirection for mobile users.

Answer

Explicit Proxy

Answer

Remote Network locations

Answer

Service Connections

Question 4

A Prisma Access administrator is investigating why a specific mobile user is unable to access a web application that is allowed by a security policy. The administrator suspects that the user is being blocked by a URL Filtering profile. Which log type should the administrator check first to confirm the block?

Accepted Answer

URL Filtering logs. URL Filtering logs are the correct logs to check because they contain the URL category, the action taken, and the profile that matched. This directly confirms whether a URL Filtering profile blocked the user's access. Other log types do not provide this specific information.

Answer

Data Filtering logs

Answer

Threat logs

Answer

Traffic logs

Question 5

An administrator is configuring Prisma Access to secure outbound internet traffic for mobile users. The requirement is to inspect all traffic for threats and sensitive data, but the organization wants to avoid decrypting traffic to financial and healthcare websites due to privacy regulations. Which Prisma Access feature should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure User-ID and authentication profiles so that Mobile Users are mapped to corporate identities.. To enforce security policy for Mobile Users with threat inspection and corporate user identification, a GlobalProtect portal and gateway are required to authenticate users and apply policy. User-ID and authentication profiles are also required to map users to corporate identities. Together, these components enable user-based policy and threat inspection.

Answer

Configure a decryption policy to inspect all Mobile User traffic for threats.

Answer

Configure a Remote Network to route Mobile User traffic through the corporate data center.

Answer

Configure a Service Connection to provide access to internal resources for Mobile Users.

Question 6

A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)

Accepted Answer

Vulnerability Protection Security Profile. Option B (Vulnerability Protection Security Profile) is correct because it inspects traffic for exploits targeting known CVEs and blocks them, which is essential for threat prevention across all Prisma Access zones. Option C (Antivirus Security Profile) is correct because it scans for and blocks malware, viruses, and spyware in allowed traffic, providing the core content-based threat prevention needed in every zone. Option E (WildFire Analysis Security Profile) is correct because it forwards suspicious files and links to WildFire for cloud-based sandbox analysis and inline ML verdicts, delivering zero-day protection that complements antivirus and vulnerability profiles. Option A (GlobalProtect Portal Configuration Profile) is not a security profile attached to Security Policy rules; it configures the GlobalProtect portal for endpoint connectivity, not threat inspection. Option D (Cloud Services Dynamic Template) is not a security profile either; it is a Prisma Access configuration construct used to push settings to cloud-managed firewalls, not a rule-attached threat prevention profile.

Answer

GlobalProtect Portal Configuration Profile

Answer

Cloud Services Dynamic Template

Question 7

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

Accepted Answer

Prisma Access ADEM (Autonomous Digital Experience Management). Prisma Access ADEM (Autonomous Digital Experience Management) is the dedicated module that provides end-to-end visibility into Prisma Access performance, including user experience metrics, hop-by-hop path analysis, and digital experience monitoring. It correlates network, endpoint, and application telemetry to surface real-time and historical experience scores for users, apps, and locations. This is precisely the DEM capability described in the question.

Answer

WildFire Portal reporting

Answer

Panorama Packet Capture utility

Answer

GlobalProtect Syslog Analyzer

Question 8

An administrator is troubleshooting a Prisma Access issue where mobile users in a specific region experience intermittent connectivity drops. The administrator observes that the GlobalProtect agent logs show repeated gateway selection changes. Which action should the administrator take to stabilize the connection?

Accepted Answer

Configure the GlobalProtect portal to only advertise gateways in the user's region and set a primary gateway with appropriate priority.. GlobalProtect agents select gateways based on priority and responsiveness. When many gateways are advertised across regions, the agent may switch frequently, causing intermittent drops. Limiting advertised gateways to the user's region and setting a clear primary gateway priority stabilizes selection and improves connection reliability.

Answer

Increase the GlobalProtect gateway timeout value in the mobile user configuration.

Answer

Enable split tunneling so that only corporate traffic goes through Prisma Access, reducing load on the gateway.

Answer

Disable the GlobalProtect agent's automatic gateway selection and require users to manually choose a gateway.

Question 9

A security engineer is deploying Prisma Access and needs to ensure that explicit proxy traffic from remote users is inspected. Which component must be configured in the Prisma Access infrastructure to handle explicit proxy traffic?

Accepted Answer

Explicit Proxy Service. Explicit proxy traffic requires the Explicit Proxy Service to be configured in Prisma Access. This service listens for proxy requests and applies security policies, ensuring that users who manually set a proxy in their browser still receive inspection. Other components like the GlobalProtect portal or Service Connections serve different purposes and cannot handle explicit proxy traffic.

Answer

Remote Network

Answer

GlobalProtect portal

Answer

Service Connection

Question 10

A security administrator is troubleshooting a Prisma Access mobile user who cannot access an internal application hosted in a branch office. The user is connected via GlobalProtect and can reach the internet. The administrator has verified that the user's security policy allows the traffic. Which step should the administrator take next to diagnose the issue?

Accepted Answer

Review the Service Connection status and routing to ensure that the branch office network is reachable from Prisma Access.. Mobile users accessing internal applications require Prisma Access to route traffic to the branch office network. This is achieved through Service Connections or remote network tunnels. If the Service Connection is down or the branch office network is not advertised, traffic will fail. Verifying Service Connection status and routing ensures that Prisma Access can forward traffic to the correct destination, which is essential before investigating client-side issues.

Answer

Verify that the internal application's IP address is included in the mobile user's split tunnel configuration.

Answer

Check the GlobalProtect app logs on the user's device for tunnel errors.

Answer

Confirm that the user's device has the correct DNS servers configured to resolve the internal application's hostname.

Question 11

A network architect is planning a Prisma Access deployment for a company with a large remote workforce. The company wants to ensure that remote users can access both internet and internal applications securely. The architect decides to use Prisma Access for both internet and private application access. Which component must be configured to allow remote users to access internal applications hosted in the corporate data center?

Accepted Answer

Configure a Service Connection to the corporate data center and enable the appropriate routes for internal subnets.. To allow remote users to securely access internal applications hosted in a data center, Prisma Access must be connected to that data center via a Service Connection. The Service Connection enables routing between Prisma Access and the data center, and internal subnets are advertised so that remote user traffic can reach them. This ensures that traffic is inspected by Prisma Access security policies before reaching the internal applications.

Answer

Set up a Remote Network connection at the data center to tunnel internal traffic to Prisma Access.

Answer

Enable GlobalProtect split tunneling to route internal traffic directly to the data center.

Answer

Configure a site-to-site IPSec tunnel between the remote users' local networks and the data center.

Question 12

A network engineer is configuring a new Remote Network in Prisma Access and needs to ensure that traffic from the branch office to the internet is breakout locally rather than backhauled to headquarters. How is local internet breakout verified in Prisma Access?

Accepted Answer

Verify that 'Local Internet Breakout' is enabled in the Remote Network configuration and examine Traffic logs to confirm internet-bound sessions egress through the Remote Network's assigned public IP.. Local internet breakout in Prisma Access is verified by confirming the 'Local Internet Breakout' setting is enabled in the Remote Network configuration and then examining Traffic logs to ensure internet-bound sessions egress through the Remote Network's assigned public IP rather than being backhauled to headquarters. This directly validates both the configuration intent and the actual traffic path. The Traffic logs show source and destination NAT details, egress interface, and the public IP used, providing definitive proof of local breakout.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Ensure SSL Forward Proxy is disabled on the Security Policy.

Answer

Check the GlobalProtect Portal client configuration settings.

Question 13

A Prisma Access deployment utilizes Service Connections to connect to a corporate data center. An administrator notices that traffic destined for internal data center subnets is being sent out to the internet instead of the Service Connection. What is the most likely cause of this routing misconfiguration?

Accepted Answer

Missing or incorrect static routes / BGP route advertisements for the internal subnets in the Service Connection routing configuration.. Service Connections in Prisma Access require explicit routing configuration — either static routes or BGP advertisements — to direct traffic for internal data center subnets over the Service Connection tunnel. If those routes are missing or incorrect, Prisma Access has no path for the internal subnets and falls back to the default route, sending the traffic out to the internet.

Answer

WildFire inspection is enabled on the security policy rule.

Answer

The Security Predefined Policy rule order is incorrect.

Answer

The GlobalProtect Portal client timeout is set too low.

Question 14

A Prisma Access administrator is troubleshooting a Service Connection that repeatedly flaps, causing intermittent loss of access to internal applications for both mobile users and remote networks. The IPsec tunnel to the data center establishes but drops within minutes. Which TWO items should the administrator verify to isolate the cause? (Choose two.)

Accepted Answer

Confirm that the IKE and IPsec proposals on both peers match exactly, including encryption, hash, and DH group settings.. A tunnel that establishes then drops within minutes typically points to phase 2 negotiation or timing issues. Mismatched IKE or IPsec proposals fail at rekey, and incompatible dead peer detection or lifetime timers cause premature teardown. Verifying both parameter sets on each peer isolates the cause and stabilizes the Service Connection for all dependent users.

Answer

Verify that the GlobalProtect portal certificate chain is valid and not expired.

Answer

Confirm that URL Filtering profiles are attached to the remote network security policy.

Answer

Review the number of HIP profiles assigned to mobile users to reduce tunnel load.

Question 15

An administrator needs to configure Prisma Access ZTNA to verify endpoint hygiene before granting access to internal applications. Which TWO posture checks can be evaluated using GlobalProtect Host Information Profiles (HIP)? (Choose two)

Accepted Answer

Antivirus presence and definition update status. Option C is correct because GlobalProtect Host Information Profiles (HIP) include the Anti-Malware object, which collects whether antivirus/anti-malware software is installed, running, real-time protection is enabled, and whether definitions are current (via the 'Anti-Malware' check with definition date/version thresholds). Option E is correct because HIP includes the Disk Backup and Disk Encryption objects, which report whether full-disk encryption such as BitLocker (Windows) or FileVault (macOS) is enabled on the endpoint. Option A is not a HIP posture check; AD group membership is evaluated through User-ID/group mapping in policy, not endpoint HIP data. Option B is irrelevant to endpoint posture, as BGP route metrics are a routing protocol attribute handled by the virtual router, not by GlobalProtect HIP. Option D is also not a HIP check; SAML IdP MFA token validity is an authentication/SSO concern handled by the identity provider and authentication profile, not by endpoint host information.

Answer

Active Directory group membership hierarchy

Answer

BGP route advertisement metrics

Answer

SAML Identity Provider multi-factor authentication token validity