SSE-Engineer Practice Test 2 — 10 Questions

Question 1

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability Protection profile. WildFire and Vulnerability Protection profiles defend against zero-day exploits and known vulnerabilities.

Answer

Decryption profile assigned directly to the threat engine

Answer

Zone Protection profile

Answer

QoS profile for traffic shaping

Question 2

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Accepted Answer

Configure a Directory Service connector to sync users and groups from Active Directory.. CIE requires directory service integration, cloud tenant setup, and agent or sync configuration.

Answer

Install physical Domain Controllers inside each Prisma Access cloud node.

Answer

Configure BGP peering between CIE and the enterprise DNS servers.

Question 3

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

Accepted Answer

Traffic and Threat logs. Panorama provides traffic, threat, and HIP match logs alongside ACC dashboards for visibility.

Answer

Active Directory replication event logs

Answer

Local hypervisor resource utilization logs

Answer

Switch spanning-tree topology tables

Question 4

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 5

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Accepted Answer

Local ISP latency and bandwidth.. Compute locations are chosen based on proximity to users, licensing availability, and the specific traffic type.

Answer

The number of users in the local branch.

Answer

The color of the hardware appliance.

Question 6

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Accepted Answer

Implement dynamic routing protocols (BGP) over the IPsec tunnels to facilitate automatic failover.. Remote network redundancy relies on redundant IPsec tunnels, BGP multipath/failover, and dual edge routers.

Answer

Cluster physical firewalls in an Active-Active HA pair inside the Prisma Access cloud infrastructure.

Answer

Manually update static routes on employee laptops whenever a remote network link fails.

Question 7

When deploying Prisma Access, which component acts as the central management plane to push security policies, configurations, and software updates to all cloud-managed SPNs?

Accepted Answer

Panorama. Panorama acts as the central management plane for Prisma Access.

Answer

GlobalProtect Portal

Answer

AWS Transit Gateway Manager

Answer

Prisma Access Cloud Controller

Question 8

Which cloud infrastructure providers host the backend Security Processing Nodes (SPNs) used by Prisma Access?

Accepted Answer

AWS and Google Cloud Platform (GCP). Prisma Access is built on leading hyper-scaler cloud infrastructure, specifically AWS and Google Cloud Platform (GCP).

Answer

Oracle Cloud Infrastructure (OCI) and IBM Cloud

Answer

Microsoft Azure only

Answer

On-premises enterprise datacenters exclusively

Question 9

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

Accepted Answer

BGP. Prisma Access supports BGP (Border Gateway Protocol) over IPsec for dynamic routing on Service Connections and Remote Networks.

Answer

EIGRP

Answer

RIPv2

Answer

OSPF

Question 10

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

Accepted Answer

Cloud Identity Engine Agent. The Cloud Identity Engine Agent runs on-premises and establishes an outbound secure connection to CIE, synchronizing directory data without requiring inbound firewall changes.

Answer

Prisma Access User-ID Syslog Listener

Answer

GlobalProtect Gateway Proxy

Answer

Panorama Log Collector