SSE-Engineer Practice Exam 3 — 20 Questions

Question 1

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

Accepted Answer

Decryption policy configuration ensuring traffic is not bypassing inspection. Option A is correct because if a Decryption policy (SSL Forward Proxy) is not configured or the traffic is excluded from decryption, encrypted sessions bypass content inspection and Threat Prevention profiles cannot evaluate the payload, so the decryption policy must be verified to ensure traffic is not bypassing inspection. Option D is correct because Threat Prevention inspection only occurs when the matching Security Policy rule has the appropriate Threat Prevention profiles attached — Antivirus, Vulnerability Protection, and Anti-Spyware — so the rule must be checked to confirm these profiles are applied to the user traffic. Option B is not relevant because CASB API connector tokens relate to SaaS application visibility and data loss prevention via API-based out-of-band scanning, not inline Threat Prevention inspection of remote user traffic. Option C is not relevant because the username-to-IP mapping agent affects user identification and policy matching, not the Threat Prevention inspection pipeline itself. Option E is not relevant because Service Connection BGP keepalive intervals affect routing adjacency stability between Prisma Access and on-premises/service connections, not Threat Prevention inspection of remote user traffic.

Answer

Cloud Access Security Broker (CASB) API connector tokens

Answer

GlobalProtect user username-to-IP mapping agent status

Answer

Service Connection BGP peer keepalive intervals

Question 2

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Accepted Answer

Check GlobalProtect client settings in Panorama to ensure HIP report generation and submission intervals are correctly configured.. Option C is correct because HIP checks on Prisma Access mobile users depend on the GlobalProtect client generating and submitting HIP reports, and those behaviors are governed by the HIP report generation and submission interval settings configured in the GlobalProtect agent settings in Panorama; verifying these settings confirms the client is actually sending HIP data for evaluation. Option D is correct because the Monitor > Logs > HIP Match log records the results of HIP-based compliance evaluations, showing which HIP profiles matched or failed for each user/device, which is the direct way to verify that HIP checks are operating correctly. Option A is incorrect because NAT policy rules only affect address translation and have no bearing on HIP report generation or evaluation. Option B is incorrect because restarting a physical branch firewall is irrelevant to Prisma Access mobile user HIP checks, which are enforced in the Prisma Access cloud infrastructure. Option E is incorrect because updating the URL Filtering database affects web content inspection, not HIP check functionality.

Answer

Modify the NAT policy rules.

Answer

Restart the physical branch firewall.

Answer

Update the URL Filtering database.

Question 3

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

Accepted Answer

Prisma Access plugin. The Prisma Access plugin must be installed on Panorama to enable the Prisma Access configuration workflows, including onboarding, tenant management, and pushing security policy to the Prisma Access cloud infrastructure. Without this plugin, Panorama cannot manage Prisma Access nodes or service connections. It is the required integration component for Panorama-managed Prisma Access deployments.

Answer

SD-WAN plugin

Answer

VM-Series plugin

Answer

Cortex Data Lake plugin

Question 4

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

Accepted Answer

Inspect Proxy Authentication and Decryption profiles to ensure authentication challenges are correctly processed.. Option A is correct because in a Prisma Access explicit proxy deployment, Proxy Authentication and Decryption profiles determine how the firewall handles authentication challenges and SSL decryption; if these are misconfigured, the proxy may silently drop or fail to respond to the client's CONNECT/GET requests, producing connection timeouts. Option C is correct because Security Policy rules must explicitly permit traffic to the explicit proxy listener ports (for example, TCP 8080) on the Prisma Access proxy; if the policy denies or does not match that traffic, sessions time out before reaching the proxy service. Option D is correct because the explicit proxy port and proxy profile configured on Prisma Access must match the port and PAC file/browser settings on the client; a mismatch means the browser sends requests to a port the proxy is not listening on, resulting in connection timeouts. Option B is not relevant because BGP AS numbers apply to Service Connection routing and do not affect explicit proxy listener behavior or client proxy sessions. Option E is not relevant because GlobalProtect pre-logon timeout pertains to GlobalProtect remote access tunnels, not to explicit proxy web traffic.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the GlobalProtect client pre-logon timeout value.

Question 5

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

Accepted Answer

A SaaS security policy rule that identifies the application and applies the allow or block action.. SaaS security policies are the Prisma Access mechanism for identifying SaaS applications and enforcing sanctioned versus unsanctioned behavior. They allow the administrator to permit and inspect approved SaaS applications for data patterns while blocking unsanctioned ones, which matches the team's requirement precisely.

Answer

A decryption policy that decrypts all SSL traffic to SaaS applications.

Answer

A URL filtering profile that categorizes SaaS domains and applies block or allow actions.

Answer

A security policy rule using application filters for all web-browsing traffic.

Question 6

An administrator is configuring Prisma Access for mobile users and wants to ensure that all traffic to and from the internet is inspected by the Secure Web Gateway (SWG) service. The administrator has enabled the SWG license and configured a security policy rule to allow web traffic. However, users report that they can access malicious websites that should be blocked. What is the most likely missing configuration?

Accepted Answer

The security policy rule does not have a URL Filtering profile attached to it.. To block malicious websites, a URL Filtering profile must be attached to the security policy rule that allows web traffic. The SWG license enables the service, but enforcement requires the profile. Without it, the rule allows all web traffic without inspection, letting users access malicious sites. Attaching a URL Filtering profile with appropriate categories blocked resolves the issue.

Answer

The mobile users are not assigned to the correct security zone in the Prisma Access configuration.

Answer

The GlobalProtect portal configuration does not include the SWG gateway address.

Answer

The SWG license is not activated on the Prisma Access tenant.

Question 7

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

Accepted Answer

Lack of direct network line-of-sight or routing from the mobile user's remote location to the internal Active Directory Domain Controllers via a Service Connection.. Kerberos requires the client to reach a Key Distribution Center (KDC) — typically an internal Active Directory Domain Controller — to obtain a Ticket Granting Ticket. A mobile user on an external network has no direct line-of-sight to internal DCs unless Prisma Access provides a Service Connection with routing to those DCs. Without that path, the Kerberos exchange cannot complete, causing authentication prompt failures.

Answer

WildFire cloud subscription has expired.

Answer

The decryption policy is missing an inbound rule.

Answer

The GlobalProtect client software license is invalid.

Question 8

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

Accepted Answer

Verify that the SSL/TLS certificate assigned to the GlobalProtect Portal configuration is valid, not expired, and trusted by the client devices.. The GlobalProtect Portal presents an SSL/TLS certificate to connecting clients during the portal handshake. If that certificate is expired, self-signed without a trusted chain, or has a mismatched CN/SAN, clients will reject the connection with an invalid certificate error before any tunnel or authentication occurs. The correct remediation is to verify the certificate assigned under Panorama > Cloud Services > Prisma Access > GlobalProtect Portal configuration is valid and trusted by the endpoints.

Answer

Check the IPsec crypto profile under Network > Network Profiles > IPsec Crypto.

Answer

Check the User-ID agent connection timeout settings.

Answer

Verify the BGP AS number on the Remote Network node.

Question 9

A Prisma Access administrator is troubleshooting a remote network deployment where users experience intermittent connectivity failures. The administrator notices that the IPsec tunnel frequently flaps. Which component should the administrator check to determine if the tunnel is being renegotiated due to mismatched proposal settings?

Accepted Answer

The IKE and IPsec crypto profiles on both the branch CPE and the Prisma Access service connection.. Intermittent IPsec tunnel flaps are typically caused by mismatched crypto profiles or proposal settings. The IKE and IPsec crypto profiles must align on both the branch CPE and the Prisma Access service connection. Verifying these profiles ensures that the tunnel parameters match, preventing renegotiation failures. GlobalProtect portal, security policies, and DNS proxy settings do not impact tunnel negotiation and are not relevant to this issue.

Answer

The security policy rules applied to the remote network traffic.

Answer

The DNS proxy settings on the service connection.

Answer

The GlobalProtect portal configuration for mobile users.

Question 10

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

Accepted Answer

Verify that IKE Phase 1 and Phase 2 proposal parameters (encryption, authentication, Diffie-Hellman groups) match between the CPE and Prisma Access node.. Option C is correct because an IPsec site-to-site tunnel requires the IKE Phase 1 (ISAKMP) and Phase 2 (IPsec) proposals to be identical on both peers, including encryption algorithms (e.g., AES-256), authentication/hash (e.g., SHA-256), Diffie-Hellman groups (e.g., group 14), and lifetimes; any mismatch in these parameters causes the IKE negotiation to fail before the tunnel establishes. Option E is correct because Panorama collects the Prisma Access Remote Network node's System logs and operational IKE/IPsec logs, which record the exact negotiation failure reason (e.g., NO_PROPOSAL_CHOSEN, INVALID_KE_PAYLOAD, or phase-1/phase-2 mismatch), allowing the administrator to pinpoint the fault. Option A is not relevant because the mobile user SAML authentication profile applies to GlobalProtect user authentication, not to the IKE pre-shared-key or certificate authentication used by a site-to-site tunnel. Option B is not appropriate because disabling security policy rules does not affect IKE/IPsec tunnel establishment and would unnecessarily remove enforcement across all remote locations. Option D is not relevant because the GlobalProtect agent runs on remote user endpoints and has no role in a CPE-to-Prisma Access Remote Network IPsec tunnel.

Answer

Reconfigure the mobile user SAML authentication profile.

Answer

Disable all security policy rules across all remote locations.

Answer

Restart the GlobalProtect agent on all remote user endpoints.

Question 11

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

Accepted Answer

The Security Policy rule source zone or user-group mapping does not match the incoming traffic flow.. When the user is authenticated but traffic is dropped by policy, it usually indicates that the source user or group mapping is not being correctly identified in the Security Policy, or the specific traffic rule is missing.

Answer

The GlobalProtect portal is down.

Answer

The CIE directory sync is failing.

Answer

The Prisma Access license has expired.

Question 12

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

Accepted Answer

Panorama > Job Status or Monitor > Logs > Config / System.. Panorama surfaces configuration push results and errors in two places: the Job Status view (Panorama > Job Status) shows the outcome of each commit/push job including success, failure, and warnings, while Monitor > Logs > Config and Monitor > Logs > System capture the detailed config and system-level error messages generated during the push. Together these are the authoritative locations for diagnosing why a push to Prisma Access nodes failed.

Answer

Cloud Services > Status > Remote Networks.

Answer

Device > High Availability.

Answer

Policies > Security > Audit.

Question 13

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

Accepted Answer

WildFire. WildFire is Palo Alto Networks cloud-based malware analysis and sandbox engine.

Answer

Data Filtering

Answer

URL Filtering

Answer

Antivirus Profile

Question 14

An administrator is configuring Prisma Access for a new remote network site. The site has a single ISP link and requires high availability for the IPSec tunnel to Prisma Access. The administrator wants to ensure that if the primary Prisma Access gateway becomes unavailable, the tunnel automatically fails over to a secondary gateway. Which feature should the administrator configure on the remote network device?

Accepted Answer

Configure the remote network with multiple IPSec tunnels to different Prisma Access gateways and enable tunnel monitoring with failover.. To achieve high availability for a remote network with a single ISP link, the administrator should configure multiple IPSec tunnels to different Prisma Access gateways and enable tunnel monitoring with failover. This allows the remote network device to detect a failure on the primary tunnel and automatically switch to the secondary tunnel, ensuring continuous connectivity.

Answer

Configure the remote network with multiple IPSec tunnels to different Prisma Access gateways and enable ECMP.

Answer

Configure the remote network to use IKEv2 with multiple proposals to negotiate with any available Prisma Access gateway.

Answer

Configure the remote network with a single IPSec tunnel and enable Dead Peer Detection (DPD) with a short interval.

Question 15

An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?

Accepted Answer

SSL Decryption is disabled for the traffic flow.. CASB inline policies in Prisma Access rely on the firewall's content inspection engine to identify files and apply actions. If SSL Decryption is not enabled for the traffic flow, the firewall cannot see inside the TLS session, so it cannot identify the file upload or match the inline CASB policy. The rule may show the correct application, but without decryption the file-level action cannot trigger.

Answer

The GlobalProtect agent version is outdated.

Answer

The User-ID agent is offline.

Answer

SaaS Security API sync interval needs to be refreshed.

Question 16

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Accepted Answer

Inspect the GlobalProtect Client Settings in Panorama to ensure gateways and agent configurations are correctly assigned.. Option A is correct because the GlobalProtect Client Settings in Panorama determine which portals and gateways are pushed to the agent, and misassigned or missing gateway/agent configurations will prevent clients from connecting. Option B is correct because the portal and gateway present SSL/TLS certificates during the connection handshake; if these certificates are expired, have an untrusted chain, or use a hostname not matching the certificate, clients will reject the connection. Option E is correct because the Authentication Profile governs how users authenticate (RADIUS, LDAP, or SAML); if those servers are unreachable or not responding, the portal or gateway authentication step fails and the client cannot establish a session. Option C is not relevant because the WildFire file size upload limit affects threat inspection of file uploads, not GlobalProtect client connectivity. Option D is not relevant because the BGP AS number on a data center router pertains to routing peering with Prisma Access, not to mobile user GlobalProtect tunnel establishment.

Answer

Check the WildFire file size upload limit for malicious attachments.

Answer

Verify the BGP AS number configured on the customer data center router.

Question 17

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

Accepted Answer

Monitor > Logs > HIP Match.. HIP Match logs in Panorama (Monitor > Logs > HIP Match) record the results of Host Information Profile checks, including which HIP profiles matched or failed for a connecting endpoint. This is the correct log to determine whether HIP checks are failing for a specific mobile user. Threat, System, and Audit logs do not contain HIP match results.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > System.

Answer

Panorama > Cloud Services > Audit Log.

Question 18

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

Accepted Answer

BGP. Prisma Access supports BGP (Border Gateway Protocol) over IPsec for dynamic routing on Service Connections and Remote Networks.

Answer

EIGRP

Answer

RIPv2

Answer

OSPF

Question 19

An administrator is configuring Prisma Access for Secure Web Gateway (SWG) and needs to ensure that SSL decryption is applied to traffic from mobile users. Which component must be configured to enable SSL decryption in Prisma Access?

Accepted Answer

SSL Decryption policy in the Mobile Users policy rules. SSL decryption in Prisma Access is controlled by SSL Decryption policies configured under Mobile Users. These policies specify what traffic to decrypt and which decryption profile to apply. Other components like Service Connections or GlobalProtect portal settings do not enable decryption for user traffic.

Answer

SSL Inbound Inspection profile on the Remote Networks

Answer

SSL Forward Proxy settings in the Service Connection

Answer

Decryption profile in the GlobalProtect portal

Question 20

A security engineer is configuring Prisma Access to provide secure access to private applications hosted in an on-premises data center for mobile users. The engineer has set up a service connection and configured the private applications. However, users are unable to reach the applications. The engineer suspects that the issue is related to the service connection configuration. Which TWO items should the engineer verify to ensure the service connection is correctly established? (Choose two.)

Accepted Answer

The service connection is associated with the correct Prisma Access locations that serve the mobile users.. For mobile users to access private applications via a service connection, the service connection must be associated with the Prisma Access locations where users connect, and the IPSec tunnel must be operational. Verifying these two items ensures that traffic can be routed from the mobile user locations through the service connection to the on-premises data center.

Answer

The private applications are configured with the correct FQDN or IP address and are assigned to the service connection.

Answer

The mobile users' GlobalProtect configuration includes the service connection's gateway address as a split tunnel exclusion.

Answer

The service connection's BGP configuration is advertising the private application subnets to the mobile user locations.