SSE-Engineer Practice Exam 4 — 20 Questions

Question 1

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 2

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

Accepted Answer

Attach appropriate Security Profiles (such as Antivirus, Anti-Spyware, and Vulnerability Protection) to all active Security Policy allow rules.. Option C is correct because every Security Policy allow rule in Prisma Access should have Security Profiles attached (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire, and File Blocking as applicable) so that permitted traffic is inspected for threats rather than simply passed; without profiles, allowed sessions receive no content inspection. Option D is correct because App-ID and User-ID provide identity- and application-aware enforcement, allowing rules to match actual applications (including those using non-standard ports or SSL) and specific users/groups, which is far more precise and secure than legacy IP-and-port matching. Option E is correct because Panorama evaluates rules top-down, so specific allow rules must precede broad general rules to avoid being shadowed, and explicit deny rules for known malicious traffic provide deterministic blocking and clearer logging than relying on implicit deny. Option A is not correct because disabling SSL Decryption globally would blind inspection to encrypted threats and is not a performance best practice; decryption should be scoped selectively. Option B is not correct because using 'Any' application in Security Policy rules defeats App-ID visibility and control, weakens security, and is discouraged even though it may reduce rule count.

Answer

Disable SSL Decryption globally to maximize Prisma Access processing throughput across all mobile user nodes.

Answer

Configure all Security Policy rules to use 'Any' application to simplify rule maintenance and reduce rule count.

Question 3

An administrator is configuring Prisma Access for the first time and needs to onboard the Prisma Access infrastructure. Which step must be completed before configuring Remote Networks and Service Connections?

Accepted Answer

Activate the Prisma Access license and allocate the infrastructure. The first step in deploying Prisma Access is to activate the license and allocate the infrastructure. This provisions the cloud-based security processing nodes and network components. Only after this onboarding can Remote Networks, Service Connections, and other configurations be set up. Other tasks like GlobalProtect or BGP are part of subsequent configuration phases.

Answer

Set up a Panorama management server

Answer

Configure BGP peering with the customer's data center

Answer

Deploy a GlobalProtect portal and gateway

Question 4

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

Accepted Answer

Configure TCP MSS adjustment on the GlobalProtect tunnel settings or reduce the tunnel interface MTU.. TCP MSS adjustment (or lowering the tunnel interface MTU) is the correct fix because fragmentation on the GlobalProtect/Prisma Access tunnel occurs when the encapsulated packet exceeds the path MTU. By clamping TCP MSS on the tunnel or reducing the tunnel MTU, the endpoint negotiates a smaller segment size so packets fit inside the tunnel without fragmenting. This directly addresses the root cause of slow/failed rendering for mobile users.

Answer

Change the mobile user IP pool subnet mask from /24 to /16.

Answer

Disable WildFire file forwarding for large files.

Answer

Increase the decryption profile timeout value.

Question 5

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

Accepted Answer

In the Panorama GlobalProtect Client Settings configuration under Network Settings. In Prisma Access, the internal DNS servers that GlobalProtect clients use for corporate name resolution are defined in the GlobalProtect Client Settings configuration within Panorama, specifically under Network Settings (DNS Server fields). This pushes the primary and secondary DNS server IPs to the GlobalProtect agent so that split-tunnel DNS queries for internal domains are sent to corporate resolvers rather than the local ISP DNS.

Answer

In the Prisma SD-WAN DNS proxy forwarding table

Answer

Directly on the remote user local machine registry

Answer

In the cloud Managed Security Services Provider (MSSP) portal

Question 6

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. They want to ensure that all web traffic is scanned for threats and that file downloads are restricted based on file type. Which Prisma Access service should they configure to achieve this?

Accepted Answer

Configure a Security Policy rule in Prisma Access with URL Filtering and File Blocking profiles applied to the remote network zone.. To inspect web traffic and restrict file downloads by type for remote networks, you need a Security Policy rule with URL Filtering and File Blocking profiles. These profiles are applied to the appropriate zone and provide the required control. WildFire detects malware but doesn't block by file type, Data Filtering is for DLP, and SaaS Security is limited to SaaS applications.

Answer

Set up a SaaS Security inline policy to control sanctioned SaaS applications.

Answer

Configure a Decryption policy to inspect SSL traffic and then apply a Data Filtering profile.

Answer

Enable WildFire inline ML on the remote network firewall to detect malicious files.

Question 7

An administrator is configuring a Remote Network in Prisma Access to connect a branch office. The branch office has a single ISP link and requires high availability. The administrator wants to ensure that if the primary IPSec tunnel fails, traffic automatically switches to a secondary tunnel. Which Prisma Access feature should be configured to achieve this?

Accepted Answer

Multiple IPSec tunnels with BGP. High availability for a Remote Network is achieved by configuring multiple IPSec tunnels and using BGP for route failover. BGP dynamically withdraws routes when a tunnel fails, directing traffic to the remaining tunnel. Policy-Based Forwarding, QoS, and Explicit Proxy do not provide this automatic failover capability.

Answer

Explicit Proxy

Answer

Policy-Based Forwarding

Answer

Quality of Service (QoS)

Question 8

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

Accepted Answer

URL Filtering log. The URL Filtering log in Prisma Access records every web-browsing session that matches a URL Filtering profile, including the URL category, the action taken (allow/block/continue/override), the user, and the source. This is the only log type that directly captures blocked URLs and category ratings for user web attempts.

Answer

Threat log

Answer

Data Filtering log

Answer

HIP Match log

Question 9

A Prisma Access administrator notices that a specific remote network tunnel shows as up, but the branch users cannot reach any internet destinations. The tunnel interface on the branch CPE is up, and the administrator can ping the Prisma Access service IP. Which log type on the Prisma Access side should the administrator review first to determine whether traffic is being dropped by a security policy?

Accepted Answer

Traffic logs. When a remote network tunnel is up but users cannot reach the internet, the immediate suspicion is a security policy misconfiguration or a routing issue. Traffic logs on Prisma Access capture session-level details, including the applied security rule and action. Reviewing them will show if traffic is being denied and by which rule, enabling quick remediation. System, threat, and HIP logs do not provide this policy enforcement visibility for remote network traffic.

Answer

System logs

Answer

HIP Match logs

Answer

Threat logs

Question 10

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks. Prisma Access remote networks and mobile user configurations are managed centrally through Panorama using the Cloud Services plugin.

Answer

Prisma Access App > Traffic Steering > Remote Networks

Answer

Policies > Security > Remote Networks

Answer

Device > Setup > Operations > Remote Networks

Question 11

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

Accepted Answer

The BGP or static route redistribution settings that control which prefixes are advertised to Prisma Access. Reachability of internal applications through a Service Connection depends on the routes Prisma Access knows about. Administrators must confirm the static or summarized routes listed on the Service Connection and the redistribution settings that determine which prefixes are advertised. Missing or filtered routes cause intermittent or partial reachability, which matches the reported behavior.

Answer

The SSL decryption profile applied to the Service Connection

Answer

The IKEv2 pre-shared key used by the Service Connection tunnel

Answer

The GlobalProtect portal agent configuration for the London region

Question 12

An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)

Accepted Answer

BGP peer AS number and peering IP addresses for dynamic route exchange.. Option B is correct because a Prisma Access Service Connection uses BGP to exchange routes between the corporate data center and the Prisma Access infrastructure, so the BGP peer AS number and peering IP addresses must be configured on Panorama. Option D is correct because the Service Connection is an IPsec tunnel, requiring both an IKE Crypto Profile (for Phase 1) and an IPsec Crypto Profile (for Phase 2) to define encryption, authentication, and lifetime parameters. Option E is correct because Panorama must know the public peer IP address of the enterprise data center VPN gateway to establish the IPsec tunnel termination. Option A is incorrect because GlobalProtect client software download URLs are configured for mobile user/remote access deployments, not for Service Connections. Option C is incorrect because WMI probing schedules are used for User-ID and Active Directory domain discovery, which is unrelated to Service Connection tunnel configuration.

Answer

GlobalProtect client software download URLs for mobile endpoints.

Answer

WMI probing schedules for Active Directory domain discovery.

Question 13

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

Accepted Answer

Real-time blocking of unauthorized data uploads to sanctioned and unsanctioned cloud applications.. Inline CASB in Prisma Access inspects traffic in real time as users browse, so option C is correct: it can block unauthorized data uploads to both sanctioned and unsanctioned cloud applications before the data leaves the network. Option D is correct because inline CASB can insert tenant restriction headers (e.g., the Microsoft 365 tenant restriction HTTP header) to ensure users only access the organization's own tenant and not personal or foreign tenants. Option E is correct because inline inspection scans downloads in the traffic path and can immediately prevent malware from being downloaded from cloud storage platforms during browsing. Options A and B are not correct for inline CASB: deep historical scanning of files at rest (A) and out-of-band remediation of externally shared links via API webhooks (B) are capabilities of the API-based, out-of-band SaaS Security API, not the inline proxy-based CASB.

Answer

Deep historical scanning of files at rest stored within cloud SaaS storage repositories.

Answer

Out-of-band remediation of externally shared links via API webhooks.

Question 14

An administrator is troubleshooting a connectivity issue where remote mobile users cannot reach internal private applications via Prisma Access ZTNA. Which THREE diagnostic steps or verification checks should the administrator perform? (Choose three)

Accepted Answer

Verify that the GlobalProtect app on the user endpoint has successfully established a secure tunnel and updated its Host Information Profile (HIP). Option A is correct because Prisma Access ZTNA relies on the GlobalProtect app to establish the secure tunnel and report an up-to-date Host Information Profile (HIP); if the tunnel is down or HIP data is stale, the endpoint cannot be matched to the correct ZTNA policy and internal apps become unreachable. Option B is correct because the App Connectors are the components that publish and proxy internal private applications to Prisma Access; if they are disconnected or unhealthy in the management plane, mobile users have no path to those applications. Option D is correct because the Traffic and Threat logs show whether security policy, ZTNA rules, or threat inspection are allowing or dropping the application traffic, which is essential to pinpoint a policy-related block. Option C is incorrect because rebooting a public cloud hypervisor hosting the tenant is a disruptive, unsupported action that does not address ZTNA tunnel, connector, or policy causes. Option E is incorrect because changing the local ISP router's BGP autonomous system number is unrelated to Prisma Access ZTNA and would not fix endpoint-to-app connectivity.

Answer

Reboot the physical public cloud provider datacenter hypervisor hosting the tenant

Answer

Reconfigure the local ISP router's BGP autonomous system number to match the Prisma Access gateway

Question 15

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 16

An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the dedicated cloud-based analytics and monitoring service that provides real-time and historical operational dashboards for Prisma Access, including mobile user connection counts, per-region bandwidth utilization, and tunnel/health status. It aggregates telemetry from all Prisma Access components (mobile users, remote networks, service connections) into a single pane of glass, which is exactly what the administrator needs.

Answer

Panorama Traffic Logs

Answer

Command Line Interface (CLI) via SSH to Prisma Access nodes

Answer

Prisma Cloud Compute console

Question 17

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Accepted Answer

Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.. The CLI command 'show user ip-user-mapping all' displays the current IP-to-user mappings, and the Prisma Access monitoring dashboard shows User-ID status. This directly verifies whether User-ID mappings are populated for mobile users, which is required for user/group-based policy matching. If mappings are missing, policies won't match.

Answer

Check the GlobalProtect Gateway tunnel status.

Answer

Run 'show system software status'.

Answer

Verify the SSL Decryption certificate expiration date.

Question 18

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

Accepted Answer

Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.. Prisma Access App-ID inspection relies on application signatures that map to specific TCP/UDP ports. When an application runs on a non-standard port, the default App-ID signature won't match, so the session may be dropped or misclassified. Creating a Custom App-ID that explicitly lists the non-standard port, then referencing it in a security rule that permits that port, allows the traffic to be identified and inspected correctly through the explicit/transparent proxy.

Answer

Configure a static NAT rule for the non-standard ports on the service connection.

Answer

Disable GlobalProtect pre-logon mode.

Answer

Enable SSL Forward Proxy on the destination zones.

Question 19

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

Accepted Answer

GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode. GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode maintains the tunnel across network changes by automatically re-establishing the connection when the underlying network switches (Wi-Fi to cellular). Always On ensures the tunnel is brought up without user intervention, and seamless reconnection minimizes disruption during roaming. This is the client-side setting that addresses session persistence.

Answer

Explicit Proxy PAC file fallback mode

Answer

BGP route dampening on the Service Connection

Answer

IPsec Dead Peer Detection (DPD) timer set to zero

Question 20

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

Accepted Answer

Monitor > Logs > Threat.. In Prisma Access and PAN-OS, threat logs (Monitor > Logs > Threat) record all events generated by security profiles including Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire. When an Anti-Spyware profile triggers an alert, the detailed attack information — including the threat name, severity, source/destination, and often a packet capture (pcap) if configured — is stored in the Threat log. This is the correct location to investigate the specific event.

Answer

Monitor > Logs > HIP Match.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.