SSE-Engineer Practice Test 2 — 10 Questions

Question 1

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 2

An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?

Accepted Answer

The Security Policy rule allowing traffic from mobile users to the Service Connection zone is missing or misconfigured.. The most likely cause is a missing or misconfigured Security Policy rule allowing traffic from mobile users to the Service Connection zone. Even if the Service Connection is up and routing is correct, without an explicit allow rule, traffic is blocked by default. Split tunnel, route advertisement, and DNS are less likely given the described symptoms.

Answer

The Service Connection's tunnel interface is not advertising the application's subnet to Prisma Access.

Answer

The mobile user's DNS is not resolving the application's FQDN to the correct IP address.

Answer

The mobile user's GlobalProtect app is not configured to include the application's subnet in the split tunnel.

Question 3

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. Option A is correct because BGP peering requires the AS numbers to be properly configured: for eBGP the local and remote AS must differ and match each side's configured peer AS, while for iBGP both peers must use the same AS, so a mismatch prevents the session from establishing and routes from being learned. Option B is correct because even with an established session, Prisma Access will not learn any prefixes unless the CPE actually advertises them via BGP network or redistribute statements, so confirming the advertised prefixes is essential. Option D is correct because the BGP peer IP configured on Prisma Access must exactly match the CPE's BGP source/peer address (and vice versa) for the TCP session on port 179 to form; a mismatch means no peering and no route exchange. Option C is not relevant because WildFire cloud analysis is a threat-detection subscription and has no bearing on BGP route learning. Option E is not relevant because GlobalProtect portal SSL certificate expiration affects remote-user VPN authentication, not Remote Network BGP peering.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 4

An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?

Accepted Answer

Traffic logs. Traffic logs are the most comprehensive source for troubleshooting access issues in Prisma Access. They record session details including the matching security policy rule, the action, and the reason for denial. This allows administrators to quickly identify if a security policy is blocking access to a private application. Other log types focus on specific security events and do not provide the same level of detail for policy enforcement.

Answer

URL filtering logs

Answer

Data filtering logs

Answer

Threat logs

Question 5

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Question 6

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

Accepted Answer

The GlobalProtect app logs on the user's endpoint, looking for tunnel disconnect and reconnect events.. Intermittent loss of all applications for a few seconds suggests the GlobalProtect tunnel is flapping. The GlobalProtect app logs on the endpoint record tunnel state changes, including disconnects and reconnects. These logs provide the necessary detail to confirm flapping and identify patterns, such as timeouts or network changes. Other tools lack the per-user tunnel state history.

Answer

The Prisma Access system logs, filtering for GlobalProtect gateway events.

Answer

The Prisma Access dashboard's GlobalProtect status page, checking the number of connected users.

Answer

The traffic logs, filtering for denied sessions from the mobile user's IP address.

Question 7

When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)

Accepted Answer

App-ID based security policies that explicitly name specific internal applications rather than subnets. Option D is correct because ZTNA 2.0 in Prisma Access enforces least-privileged access through App-ID based security policies that identify specific internal applications (e.g., 'web-app-finance' or 'ssh-server-01') instead of broad subnet ranges, so only the intended application is reachable. Option E is correct because App Connectors are the mandatory component deployed inside the internal network that host the private applications; they establish outbound-initiated tunnels to Prisma Access and publish those apps to the service, enabling per-app access without exposing the network. The other options are not required: PPTP is a deprecated, insecure legacy VPN protocol and is not part of ZTNA 2.0 (A); PAC files are a proxy auto-configuration mechanism for web traffic, not a ZTNA private-app access requirement (B); and assigning public IP addresses to every internal workstation is unnecessary and contrary to ZTNA principles, since App Connectors and the Prisma Access infrastructure handle connectivity without exposing endpoints (C).

Answer

Legacy PPTP VPN dial-in server integration

Answer

Explicit PAC files distributed to all internal users

Answer

Public IP addresses assigned to every internal workstation

Question 8

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

Accepted Answer

Traffic Logs with a filter for the source user and destination IP, checking the 'Drop Reason' field.. Traffic Logs in Panorama are the authoritative source for confirming whether a session was allowed or denied by security policy, and the 'Drop Reason' field explicitly identifies policy-based drops (e.g., 'policy-deny', 'rule match'). Filtering by source user and destination IP isolates the specific flow in question and shows the matching rule in real time. This directly answers whether the security policy is the cause of the drop.

Answer

GlobalProtect app diagnostics tab on the endpoint.

Answer

Prisma Access Insight path quality monitoring.

Answer

Panorama Dynamic Updates status page.

Question 9

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 10

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

Accepted Answer

Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users.. Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users provides regional status and cloud infrastructure metrics for Prisma Access. This feature shows the health, performance, and status of Prisma Access nodes across different regions, allowing administrators to identify latency or disconnection issues tied to a specific location. It is the centralized monitoring point for regional infrastructure health.

Answer

Policies > QoS > Bandwidth Management.

Answer

Device > High Availability.

Answer

Monitor > Traffic > GlobalProtect Analytics.