SSE-Engineer Practice Test 20 — 15 Questions

Question 1

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor > Logs > Config.. The Config log (Monitor > Logs > Config) records all configuration changes made in Panorama, including who made the change, when, and what was modified. This is the correct log to review to determine who altered a security policy over the past week.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > Data Filtering.

Answer

Monitor > Logs > Traffic.

Question 2

An engineer is deploying Prisma Access for the first time and needs to onboard the infrastructure using the Prisma Access Cloud Management portal. The organization requires that all configuration changes be validated before being pushed to production. Which built-in workflow should the engineer use to meet this requirement?

Accepted Answer

Commit validation. In Prisma Access Cloud Management, commit validation is the feature that checks configuration changes for errors before they are applied. It ensures that the intended changes are syntactically correct and do not conflict with existing settings, thereby reducing the risk of misconfiguration. The other options are either for auditing, optimization, or a different management method, and do not provide pre-commit validation.

Answer

Panorama commit

Answer

Configuration audit log

Answer

Policy Optimizer

Question 3

Which TWO logs or monitoring views in Panorama are essential when troubleshooting a remote network user's inability to reach a specific cloud application via Prisma Access? (Choose two)

Accepted Answer

Monitor > ACC (Application Command Center) to analyze application traffic behavior and usage trends.. Option C is correct because Monitor > ACC (Application Command Center) in Panorama aggregates Prisma Access traffic and provides application-level visibility, letting you analyze whether the specific cloud application's traffic is being seen, how it is being categorized, and usage/behavior trends that reveal policy or App-ID mismatches. Option E is correct because Monitor > Logs > Traffic shows the actual session detail for Prisma Access traffic, including whether the flow was allowed, denied, or timed out, along with the matching security policy, source/destination, and application, which is essential to pinpoint where the remote user's connection fails. Option A is not appropriate because the Cloud Services Audit Log records administrative and configuration change events in the Prisma Access cloud service, not end-user application traffic. Option B is not appropriate because Device > Setup > Management is a configuration area for Panorama management settings, not a log or monitoring view. Option D is not appropriate because Objects > Addresses is an address object configuration page, not a troubleshooting log or monitoring view.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Device > Setup > Management.

Answer

Objects > Addresses.

Question 4

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

Accepted Answer

Service Connection. A Service Connection is used to connect enterprise headquarters or data centers to Prisma Access.

Answer

Prisma SD-WAN Hub Integration

Answer

GlobalProtect Gateway Connection

Answer

Remote Network Connection

Question 5

An administrator needs to provide access to a set of internal web applications for mobile users connected through Prisma Access. The applications are hosted in an on-premises data center and must be reachable only by authenticated users, with traffic inspected for threats. Which Prisma Access component should the administrator configure to enable this access?

Accepted Answer

Service Connection. Service Connections provide the network path between Prisma Access and the customer's internal network, enabling mobile users to reach on-premises applications. When combined with security policies that require authentication and apply threat inspection, this satisfies the requirement for secure, authenticated access to internal web applications.

Answer

GlobalProtect Portal

Answer

Prisma Access Explicit Proxy

Answer

Remote Network

Question 6

A Prisma Access administrator needs to verify that a specific mobile user's traffic is being inspected by the correct security policy rule. The administrator wants to see the rule name that allowed or denied a recent session. Which log type should the administrator consult?

Accepted Answer

Traffic logs. Traffic logs are the only log type that records the security policy rule name and action for each session. By filtering traffic logs for the specific user and session, the administrator can identify the exact rule that allowed or denied the traffic. Other log types serve different purposes and do not contain policy rule information.

Answer

URL Filtering logs

Answer

Threat logs

Answer

System logs

Question 7

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Accepted Answer

Check Panorama > Job Status to review specific error codes and failed configuration push tasks.. Option A is correct because Panorama > Job Status is the primary place to inspect configuration push jobs, their task IDs, and specific error codes when commits or pushes to Prisma Access fail, directly revealing why the push did not complete. Option B is correct because Panorama must maintain active cloud services communication and valid management certificates to authenticate to and reach the Prisma Access cloud infrastructure; broken connectivity or expired/invalid certificates will block pushes. Option C is not relevant because restarting a branch CPE device does not address Panorama-to-Prisma-Access push failures. Option D is incorrect because manually updating the URL Filtering database is unrelated to configuration or update push failures from Panorama. Option E is incorrect because modifying NAT policy on a remote firewall does not resolve Panorama's inability to push updates or configurations to Prisma Access nodes.

Answer

Restart the CPE device at the branch office.

Answer

Update the URL Filtering database manually.

Answer

Modify the NAT policy rules on the remote firewall.

Question 8

An architect is planning a Prisma Access deployment with a Service Connection to a data center. The data center advertises a default route (0.0.0.0/0) to Prisma Access over BGP. The architect wants to ensure that internet-bound traffic from Remote Networks is inspected by Prisma Access and not sent back to the data center. Which configuration should be applied to prevent the default route from being used for internet traffic?

Accepted Answer

Apply an inbound filter on the Service Connection to reject the default route.. To prevent internet-bound traffic from being sent to the data center, the default route learned via BGP from the data center must be filtered out. Applying an inbound filter on the Service Connection to reject the 0.0.0.0/0 route ensures that Prisma Access does not install this route. Consequently, internet-bound traffic from Remote Networks will be routed to the internet through Prisma Access, where it can be inspected by security policies.

Answer

Disable BGP on the Service Connection and use static routes instead.

Answer

Set the default route's administrative distance higher than other routes.

Answer

Configure a more specific route for internet-bound traffic on the Remote Network.

Question 9

An architect is planning a Prisma Access deployment for a large enterprise with multiple Remote Network locations. The architect must ensure that the deployment meets the requirements for high availability and scalability. Which TWO factors should the architect consider when designing the Remote Network locations? (Choose two.)

Accepted Answer

The bandwidth of each ISP connection and the total aggregate bandwidth required for the Remote Network.. High availability and scalability for Remote Networks depend on the number and distribution of IPSec tunnels and the available bandwidth. Distributing tunnels across multiple Prisma Access locations provides redundancy, while sufficient bandwidth ensures performance as traffic grows. Mobile users and SPN types are not relevant to Remote Network design, and routing protocol is secondary to tunnel count and bandwidth.

Answer

The routing protocol used between the Remote Network and Prisma Access.

Answer

The number of mobile users assigned to each Remote Network location.

Answer

The type of security processing node (SPN) used for each Remote Network location.

Question 10

An engineer is deploying a new Prisma Access tenant for a multinational company. The security team requires that all remote user traffic be inspected by a dedicated set of Security Processing Nodes located in the same region as the users, to minimize latency. The company has offices in North America, Europe, and Asia. Which deployment model should the engineer choose to meet this requirement?

Accepted Answer

Configure multiple mobile user locations in Prisma Access, one for each region, and assign users to the appropriate location based on their geographic location.. The requirement is to have dedicated Security Processing Nodes in the same region as users to minimize latency. Prisma Access supports multiple mobile user locations, each with its own SPNs. By deploying a location per region and directing users to the nearest one, traffic is inspected locally. Other options either centralize inspection or use features not intended for mobile users.

Answer

Set up a Remote Network connection in each region and route all remote user traffic through the corporate data center for inspection.

Answer

Use Prisma Access with a single service connection and enable ECMP to distribute traffic across multiple SPNs globally.

Answer

Deploy a single Prisma Access tenant with a global mobile user location and enable GlobalProtect with automatic region selection.

Question 11

A Prisma Access engineer is troubleshooting a Service Connection that is not establishing. The engineer suspects that the issue is related to the Service Connection configuration or network reachability. Which two actions should the engineer perform to validate the Service Connection status and connectivity? (Choose two.)

Accepted Answer

Verify that the Service Connection is enabled and that the correct IPsec tunnel settings are configured in the Prisma Access portal.. To validate a Service Connection that is not establishing, the engineer should first verify that it is enabled and correctly configured in the Prisma Access portal. This ensures that the necessary parameters are in place. Second, checking the Service Connection status in the dashboard provides immediate feedback on whether the connection is up or down, and often includes error details. These two actions are the quickest way to confirm the state and identify misconfigurations.

Answer

Run a packet capture on the branch firewall to analyze IPsec traffic.

Answer

Check the IKE and IPsec logs on the branch firewall for any negotiation failures.

Answer

Verify that the branch firewall has a route to the Prisma Access Service IP addresses.

Question 12

During the initial deployment of Prisma Access for remote networks, an administrator needs to define the bandwidth allocation for a specific compute location. Which tool is used to manage and push this bandwidth allocation?

Accepted Answer

Panorama. Bandwidth allocation for a specific compute location in Prisma Access is managed through Panorama, where the Prisma Access plugin exposes the Service Setup and compute location configuration, including the bandwidth (Mbps) assigned to each compute location. Panorama then pushes this allocation to the Prisma Access cloud service, making it the correct management tool.

Answer

Prisma SD-WAN Cloud Controller

Answer

Prisma Access Plugin for AWS Console

Answer

GlobalProtect Portal standalone web GUI

Question 13

A security administrator needs to check real-time threat logs for a specific Prisma Access mobile user who reports being blocked from accessing a malicious file. Which Panorama menu path provides the most direct access to these logs?

Accepted Answer

Monitor > Logs > Threat.. Real-time threat logs in Panorama are accessed via Monitor > Logs > Threat, which aggregates threat logs from all managed firewalls, including Prisma Access mobile user traffic. This is the most direct path to view detailed threat events such as blocked malicious file downloads for a specific user.

Answer

Panorama > Cloud Services > Setup > Management.

Answer

Prisma Access > Service Setup > Locations.

Answer

Policies > Security.

Question 14

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

Accepted Answer

DNS Security. DNS Security is the Palo Alto Networks cloud-delivered service that provides real-time threat intelligence for DNS queries, using predictive analytics and machine learning to block newly registered malicious domains (NRDs) and DNS tunneling without waiting for manual signature updates. It integrates natively with Prisma Access Secure Web Gateway to inspect DNS traffic inline and enforce sinkhole or block actions. This real-time, dynamic feed is exactly what the question describes.

Answer

Prisma Access Insights

Answer

SaaS Security API

Answer

GlobalProtect Cloud Service Agent

Question 15

An administrator is planning a Prisma Access deployment for a new branch office. The branch has a single ISP connection and requires high availability for Remote Network connectivity. Which Prisma Access feature should the administrator use to provide redundancy?

Accepted Answer

Configure two IPSec tunnels to different Prisma Access locations.. To provide high availability for a Remote Network with a single ISP, the administrator should configure two IPSec tunnels to different Prisma Access locations. This allows failover if one location becomes unavailable. Other options either do not provide redundancy or are insufficient for high availability. BGP and DPD are useful but require multiple tunnels to be effective.

Answer

Enable BGP with a single tunnel to the nearest Prisma Access location.

Answer

Configure a single tunnel with two different pre-shared keys.

Answer

Use a single IPSec tunnel with IKEv2 and enable Dead Peer Detection.