SSE-Engineer Practice Exam 2 — 20 Questions

Question 1

An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect Split Tunneling based on Access Routes and Domains. Prisma Access allows Split Tunneling based on domains or destinations so that specific traffic (like video streaming or trusted SaaS) bypasses the VPN tunnel.

Answer

Explicit Proxy PAC file routing

Answer

SD-WAN Traffic Steering Policies

Answer

SSL Decryption Exclusion Objects

Question 2

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

Accepted Answer

Service health and status of cloud infrastructure and tunnels. Prisma Access Insights provides visibility into service health, license utilization, active user counts, and bandwidth consumption across locations.

Answer

Individual endpoint user Windows registry configurations

Answer

Local branch switch port VLAN configurations

Question 3

When using Cloud Identity Engine (CIE) for authentication, which method allows for the most seamless user experience for mobile users?

Accepted Answer

SAML integration with a cloud identity provider.. SAML with a Cloud Identity Provider is the standard for modern identity integration in Prisma Access.

Answer

RADIUS authentication.

Answer

LDAP without SSL.

Answer

Local database on the firewall.

Question 4

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 5

An engineer is troubleshooting a routing issue where a remote network branch connected to Prisma Access cannot reach another remote network branch (branch-to-branch routing). Which THREE configuration items must be verified to ensure successful branch-to-branch traffic flow? (Choose three)

Accepted Answer

Verify that Security Policy rules permit traffic between the respective branch zones. Branch-to-branch routing in Prisma Access requires explicit configuration, including enabling branch-to-branch traffic in Panorama, ensuring proper security policies permit the traffic, and correct route advertisement.

Answer

Verify that local branch DHCP lease times are set to 8 hours

Answer

Check that all mobile user clients have disabled split tunneling

Question 6

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

Accepted Answer

Source and destination security zones. Prisma Access security policies support standard PAN-OS match criteria including applications, users, zones, and regions.

Answer

Local physical switch port numbers on the cloud node

Answer

Hardware motherboard serial numbers of client machines

Question 7

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

Accepted Answer

The Security Policy rule source zone or user-group mapping does not match the incoming traffic flow.. When the user is authenticated but traffic is dropped by policy, it usually indicates that the source user or group mapping is not being correctly identified in the Security Policy, or the specific traffic rule is missing.

Answer

The GlobalProtect portal is down.

Answer

The CIE directory sync is failing.

Answer

The Prisma Access license has expired.

Question 8

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

Accepted Answer

It provides centralized, unified security policy management and inspection.. Prisma Access simplifies management and provides consistent security policy enforcement across all locations.

Answer

It allows local traffic to bypass security inspection entirely.

Answer

It eliminates the need for internet connectivity at the branch.

Answer

It removes the need for any internal firewalls.

Question 9

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

Accepted Answer

Verify that the peer public IP address configured in Panorama matches the public IP of the branch office router.. Troubleshooting IPsec tunnels in Prisma Access involves verifying pre-shared keys or certificates, checking public IP settings, confirming correct Phase 1/Phase 2 proposal settings, and examining system logs via Prisma Access Insights.

Answer

Modify the GlobalProtect client configuration to force internal DNS resolution.

Answer

Reboot the Cloud Identity Engine container to clear stale routing cache entries.

Question 10

Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?

Accepted Answer

GlobalProtect Client-less VPN. GlobalProtect Client-less VPN provides browser-based access to internal web applications without requiring an endpoint client.

Answer

Prisma Access Remote Network IPsec

Answer

Prisma Access Browser

Answer

Explicit Proxy Forwarding

Question 11

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 12

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Accepted Answer

Using source/destination address objects or tags.. Security policies require zones and address objects (or user groups) to identify traffic uniquely.

Answer

Enabling SSL inspection on all traffic.

Answer

Defining the physical port number.

Answer

Configuring the GlobalProtect client version.

Question 13

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Accepted Answer

In the GlobalProtect Portal configuration under Authentication. SAML authentication for mobile users is configured and referenced within the GlobalProtect Portal external authentication settings.

Answer

In the Panorama Log Forwarding profile

Answer

In the Prisma Access Remote Network BGP peer settings

Answer

In the Service Connection QoS profile

Question 14

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Accepted Answer

Create a HIP Object, add it to a HIP Profile, and apply it to a Security Policy rule source criteria.. Host Information Profile (HIP) objects must be defined, added to a HIP Object Profile, and then referenced in a Security Policy rule.

Answer

Configure an App-ID override rule and assign the device certificate to the User-ID agent.

Answer

Enable SSL Forward Proxy and add the device serial number to the GlobalProtect portal whitelist.

Answer

Assign a dynamic address group to the user and create a custom URL filtering category for the SaaS app.

Question 15

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

Accepted Answer

Hosting the GlobalProtect agent software and gateway lists.. The Portal provides authentication and the configuration/software updates to the GlobalProtect agent.

Answer

Terminating the IPSec tunnel from branch sites.

Answer

Managing Cloud Identity Engine sync.

Answer

Performing deep packet inspection.

Question 16

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. HIP requires the agent to be enabled, the objects to be defined, and the security policy to reference them.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 17

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Accepted Answer

An identity provider (IdP) integration, such as Azure AD or Okta.. CIE requires an identity source integration and the enablement of the CIE service on the tenant.

Answer

Active Directory Domain Controller installation on Prisma Access.

Answer

Configuring DNS on the local workstation.

Answer

Deploying a hardware firewall at every branch.

Question 18

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

Accepted Answer

Service Connection. A Service Connection is used to connect enterprise headquarters or data centers to Prisma Access.

Answer

Prisma SD-WAN Hub Integration

Answer

GlobalProtect Gateway Connection

Answer

Remote Network Connection

Question 19

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Accepted Answer

Address objects or Address Groups.. Address objects or Address Groups allow for efficient grouping and reuse in security policies.

Answer

URL filtering category.

Answer

Service objects based on port numbers only.

Answer

Interface-based rules.

Question 20

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

Accepted Answer

Automatic IP address allocation managed by Prisma Access. Prisma Access automatically manages and allocates dynamic IP pools for mobile users via Panorama.

Answer

Static IP assignment per user via Active Directory attributes

Answer

Static IP assignment via local DHCP server in each branch office

Answer

Manual entry by users upon connection