SSE-Engineer Practice Exam 3 — 20 Questions

Question 1

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

URL Filtering with real-time category lookups. Prisma Access provides comprehensive cloud-delivered security services including Threat Prevention, URL Filtering, and WildFire malware analysis natively on SPNs.

Answer

Local enterprise data center physical power failover management

Answer

Physical rack-and-stack server hardware maintenance by the customer

Question 2

An enterprise wants to implement Firewall as a Service (FWaaS) using Prisma Access to protect inter-branch traffic and internet traffic. Which Panorama template type is primarily used to push network and device configurations to Prisma Access nodes?

Accepted Answer

Cloud Services templates. Panorama uses Cloud Services templates to manage network, interface, and routing settings for Prisma Access locations.

Answer

Stack templates

Answer

Prisma Access Global templates

Answer

Mobile User dynamic templates

Question 3

An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?

Accepted Answer

On the Remote Network configuration in Panorama under Bandwidth Allocation and QoS. QoS profiles in Prisma Access for remote networks are applied on the Remote Network configuration settings in Panorama under Cloud Services.

Answer

Inside the GlobalProtect Gateway agent configuration profile

Answer

Globally inside the Palo Alto Networks WildFire configuration

Answer

Directly on the customer branch router CLI via MQC

Question 4

A company requires that Prisma Access FWaaS inspects all inter-zone traffic between two different remote branch offices connected via Prisma Access. By default, how does Prisma Access handle traffic between two Remote Networks attached to the same service region?

Accepted Answer

Traffic between Remote Networks is dropped by default unless explicitly allowed by security policy and inter-branch routing is enabled.. Prisma Access supports inter-branch routing, allowing traffic between remote networks to be inspected by security policies when inter-branch traffic is enabled.

Answer

Traffic must be backhauled to the corporate data center via a Service Connection before reaching another branch.

Answer

Remote Networks cannot communicate with each other under any circumstance.

Answer

Traffic is automatically bypassed and sent directly over public internet.

Question 5

An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?

Accepted Answer

By establishing multiple tunnels terminating on separate SPNs and using BGP multi-path or local preference for failover. Prisma Access supports redundant IPSec tunnels from branch routers, utilizing BGP to manage path selection and failover between the tunnels.

Answer

By utilizing VRRP across the cloud public IP addresses

Answer

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Answer

By configuring LACP bonding directly across the cloud IPSec endpoints

Question 6

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 7

An administrator is configuring Source NAT (SNAT) for Prisma Access Remote Networks. Which TWO reasons explain why SNAT is necessary in certain network designs? (Choose two)

Accepted Answer

To resolve overlapping IP address spaces between multiple branch offices. SNAT is used to prevent IP address overlapping between branch sites and to hide internal network structures when accessing external destinations.

Answer

To authenticate GlobalProtect users against Active Directory

Answer

To replace the requirement for BGP routing over Service Connections

Answer

To assign dynamic IPv6 addresses to individual remote worker laptops

Question 8

When configuring GlobalProtect mobile users in Prisma Access, which THREE settings are typically defined within the GlobalProtect Client Settings configuration? (Choose three)

Accepted Answer

Connect method (e.g., On-Demand, Always-On). GlobalProtect Client Settings define client behavior such as internal DNS servers, gateway preferences, and connection modes.

Answer

Prisma Access Remote Network BGP ASN

Answer

Service Connection public gateway IP address

Question 9

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

Accepted Answer

WildFire. WildFire is Palo Alto Networks cloud-based malware analysis and sandbox engine.

Answer

Data Filtering

Answer

URL Filtering

Answer

Antivirus Profile

Question 10

An organization requires that Prisma Access Secure Web Gateway inspects all inbound and outbound TLS traffic for employees browsing external websites. However, HR and healthcare applications must be bypassed due to privacy regulations. Where in Panorama must the administrator configure the exception for these categories?

Accepted Answer

Policies -> Decryption. Decryption policy rules in Panorama allow administrators to bypass decryption based on URL categories such as healthcare and financial services.

Answer

Panorama -> Cloud Services -> User Access

Answer

Network Services -> Prisma Access -> Decryption Bypass

Answer

Objects -> Custom URL Category

Question 11

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 12

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

Accepted Answer

Continuous Trust Verification via periodic Host Information Profile (HIP) re-evaluation and app-connector telemetry. ZTNA 2.0 in Prisma Access enforces continuous trust verification by re-evaluating device posture (HIP checks) and user context periodically during active sessions, cutting off access if conditions change.

Answer

Pre-logon GlobalProtect connection mode

Answer

Explicit proxy PAC file auto-discovery

Answer

RADIUS single sign-on (SSO) integration with Multi-Factor Authentication

Question 13

A remote network user in a Prisma Access deployment is experiencing intermittent packet loss and slow application performance over the IPsec tunnel to the Remote Network (RN) node. Upon checking the system logs, the network engineer notices repetitive IKE rekey negotiations. Which troubleshooting step should be taken first to identify the root cause?

Accepted Answer

Verify that Dead Peer Detection (DPD) intervals match between the CPE device and Prisma Access node, and check tunnel monitoring statistics.. Checking the IPsec and IKE tunnel status via the Prisma Access CLI or Panorama status monitor helps identify cryptographic mismatch or dead peer detection (DPD) timeouts causing flapping.

Answer

Disable SSL decryption on the Security Predefined Policy.

Answer

Change the mobile user portal authentication profile.

Answer

Restart the GlobalProtect service on the remote user's endpoint.

Question 14

An enterprise requires their mobile users to use a Secure Web Gateway (SWG) service that intercepts all web traffic without requiring explicit browser proxy configurations on each client machine. Which Prisma Access deployment method meets this requirement transparently?

Accepted Answer

GlobalProtect client in transparent tunnel mode forwarding traffic to Prisma Access SWG. Prisma Access transparently intercepts web traffic from mobile users via the GlobalProtect app operating in layer-3 tunnel mode, eliminating the need for PAC files or manual proxy settings.

Answer

GRE tunnel forwarding from local ISP routers

Answer

Static NAT configuration on the branch office gateway

Answer

GlobalProtect client in explicit proxy mode

Question 15

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. BGP troubleshooting requires verifying peer IP addresses, AS numbers, authentication keys, and network prefix advertisements.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 16

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Accepted Answer

Check Panorama > Job Status to review specific error codes and failed configuration push tasks.. Troubleshooting Panorama-to-Prisma Access communication involves checking management plane connectivity, service setup status, and job status error messages.

Answer

Restart the CPE device at the branch office.

Answer

Update the URL Filtering database manually.

Answer

Modify the NAT policy rules on the remote firewall.

Question 17

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Accepted Answer

Device > Server Profiles > SAML Identity Provider. SAML identity provider server profiles are configured in Panorama under Device or Server Profiles before being assigned to GlobalProtect authentication profiles.

Answer

Network > GlobalProtect > Portal > Authentication

Answer

Panorama > Cloud Services > Authentication > SAML

Answer

Objects > Cloud Identity Engine > SAML

Question 18

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

LDAP directory authentication. Prisma Access supports multiple authentication mechanisms including SAML 2.0 and LDAP/RADIUS via authentication profiles.

Answer

Local database accounts stored on the individual Prisma Access cloud nodes

Answer

WPA3 Enterprise 802.1X enterprise tunneling

Answer

IPsec Pre-Shared Key user authentication

Question 19

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

Accepted Answer

In the Panorama Security Policy rule matching the traffic.. Security Profiles must be attached to the Security Policy rules that govern the specific traffic flow.

Answer

In the GlobalProtect Gateway settings.

Answer

In the Service Connection configuration.

Answer

In the Cloud Identity Engine configuration.

Question 20

An enterprise is planning a Prisma Access Remote Networks deployment with overlapping RFC 1918 IP address spaces across several acquired branch offices. Which Prisma Access feature must the architect implement to successfully route traffic without changing the local branch IP schemes?

Accepted Answer

Source NAT (SNAT) configured for Remote Networks traffic. Source NAT (SNAT) or Network Address Translation mechanisms must be used to handle overlapping IP spaces when connecting multiple remote networks to Prisma Access.

Answer

Destination NAT rules on the Service Connections

Answer

GRE tunneling with static default routes

Answer

BGP AS-Path Prepending across all branch tunnels