SSE-Engineer Practice Test 21 — 15 Questions

Question 1

An administrator is configuring Prisma Access for remote users and needs to ensure that split tunneling is used for specific applications. Which Prisma Access component is responsible for enforcing split tunneling policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect gateway. Split tunneling for remote users is enforced by the GlobalProtect gateway, which applies the configured split tunnel policy to direct traffic either through the tunnel or directly to the internet. The portal handles authentication and configuration delivery, while Service Connections and Insights serve different purposes. Thus, the gateway is the correct component.

Answer

Prisma Access Insights

Answer

GlobalProtect portal

Answer

Prisma Access Service Connection

Question 2

Users connected through a Prisma Access remote network report that traffic to a partner's public web application is being blocked, while the same application works from a mobile user tunnel. The administrator confirms a URL Filtering profile is applied to both the remote network and mobile user policies. Which log type and filter should the administrator use to determine why the remote network traffic is blocked?

Accepted Answer

URL Filtering logs filtered by the remote network users and the partner destination, to identify the matched category and action.. A URL Filtering block is captured in URL Filtering logs, which record the category, matched profile, and action. Since mobile users succeed and remote network users fail, the discrepancy lies in whichever URL Filtering profile applies to the remote network path. Filtering URL logs by those users and the partner destination surfaces the exact category and rule responsible.

Answer

Traffic logs filtered by the remote network source and destination, to check whether the session is allowed or denied at the firewall stage.

Answer

Data Filtering logs filtered by the application and the file direction to identify the blocked transfer.

Answer

Authentication logs filtered by the remote network users to confirm group mapping succeeded.

Question 3

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Accepted Answer

Using source/destination address objects or tags.. In Prisma Access security policy rules, traffic matching is driven by zone-based evaluation, so option E (defining source and destination zones) is essential because the firewall uses the source and destination security zones to determine which policy rule applies to a given flow. Option A (using source/destination address objects or tags) is also essential because address objects, address groups, and tags (including dynamic tags via VM-Series or User-ID/GlobalProtect context) provide the granular match criteria that identify which specific hosts, subnets, or user groups a rule governs. Together, zones plus address objects/tags form the core match criteria that ensure a policy is correctly applied to the intended traffic. Option B is not required because SSL inspection is a security profile/decryption setting, not a prerequisite for policy matching, and it is not applied to all traffic by default. Option C is incorrect because Prisma Access policies are zone-based, not physical-port-based, since the underlying infrastructure is abstracted in the cloud. Option D is incorrect because the GlobalProtect client version is an endpoint/app configuration concern, not a policy match criterion for applying security rules.

Answer

Enabling SSL inspection on all traffic.

Answer

Defining the physical port number.

Answer

Configuring the GlobalProtect client version.

Question 4

An administrator is configuring Prisma Access for remote users and needs to ensure that split tunneling is used for specific applications. Which Prisma Access component is responsible for enforcing split tunneling policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Service Connection to access private applications.. To inspect all mobile user traffic, you need a GlobalProtect portal and gateway to establish connectivity, and a Service Connection to reach private applications. Split tunneling would bypass inspection, Explicit Proxy is not for full traffic, and Remote Networks are for branches.

Answer

Set up an Explicit Proxy for mobile users.

Answer

Enable split tunneling to direct internet traffic directly to the internet.

Answer

Configure a Remote Network for each mobile user.

Question 5

An administrator needs to give a security operations analyst read-only access to Prisma Access logs and reports without allowing any configuration changes. Which Prisma Access administrative role should the administrator assign in the identity provider or Panorama?

Accepted Answer

A role that grants read-only access to Prisma Access logs and reports but no configuration permissions.. The administrator should assign a role that provides read-only access to Prisma Access logs and reports without configuration permissions. This follows least privilege, letting the analyst perform monitoring and reporting duties while preventing changes to policies, objects, or tenant settings.

Answer

A device administrator role scoped only to the firewall devices in the tenant.

Answer

An auditor role that can modify audit logs and retention settings for the tenant.

Answer

A superuser role that allows full configuration and monitoring access to the Prisma Access tenant.

Question 6

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

Accepted Answer

Configure split tunneling to route non-corporate or high-bandwidth web traffic (e.g., video streaming) directly to the internet.. Option A is correct because split tunneling lets you exclude non-corporate or high-bandwidth traffic such as video streaming from the Prisma Access tunnel and send it directly to the internet, reducing load and latency on the security processing path. Option C is correct because enabling Closest Gateway selection makes mobile users connect to the nearest Prisma Access location, shortening the network path and lowering latency. Option D is correct because QoS policies let you prioritize business-critical applications, ensuring they get appropriate bandwidth and treatment during congestion. Option B is incorrect because disabling threat inspection removes security protections and does not optimize performance legitimately. Option E is incorrect because backhauling all mobile traffic through a single centralized headquarters firewall adds latency and creates a bottleneck, the opposite of optimization.

Answer

Disable all threat inspection profiles for mobile users to bypass security processing.

Answer

Route all mobile user traffic through a single centralized headquarters datacenter firewall.

Question 7

A Prisma Access administrator is troubleshooting a remote network site where IPsec tunnels are flapping. The administrator suspects that the tunnel monitoring settings are too aggressive. Which configuration parameter should be adjusted to reduce flapping?

Accepted Answer

Adjust the dead peer detection (DPD) interval and retry count on the remote network IPSec tunnel.. Tunnel flapping in remote network IPsec tunnels is often caused by overly aggressive dead peer detection (DPD) settings. If DPD intervals are too short or retry counts too low, temporary network latency or packet loss can trigger tunnel teardown and re-establishment. Adjusting these parameters to be more lenient allows the tunnel to withstand transient issues, reducing flapping. This is the targeted solution for the described scenario.

Answer

Enable IKEv1 instead of IKEv2 for the remote network IPSec tunnel.

Answer

Modify the IPsec proposal encryption algorithms to use stronger ciphers.

Answer

Increase the IKEv2 rekey timer on the remote network IPSec tunnel.

Question 8

An administrator is troubleshooting a Prisma Access environment where threat prevention profiles are failing to block known malicious file downloads. Which THREE settings or logs should the administrator investigate? (Choose three)

Accepted Answer

Check the Threat and WildFire logs to see if the files were inspected, logged, or bypassed due to exclusions.. Option A is correct because the Threat and WildFire logs are the authoritative place to confirm whether a file was actually inspected, merely logged, or bypassed by a decryption exclusion or application override, which directly explains why malicious downloads are not being blocked. Option B is correct because SSL/TLS-encrypted payloads cannot be matched against antivirus or WildFire signatures unless SSL Decryption (forward proxy or inbound inspection) is applied to that traffic, so undecrypted sessions will silently pass malware. Option E is correct because a threat prevention profile only takes effect when the Anti-Spyware, Antivirus, and WildFire Analysis profiles are attached to the Security Policy rule that matches the traffic; if the rule references no profile or the wrong profile, files are never blocked. Option C is not relevant because the BGP AS number on the Remote Network CPE only affects routing and tunnel establishment, not content inspection or file blocking. Option D is not relevant because the GlobalProtect Portal client timeout governs how long a client can remain disconnected before re-authentication, and has no bearing on threat prevention or file inspection.

Answer

Check the BGP AS number on the Remote Network CPE.

Answer

Verify the GlobalProtect Portal client timeout setting.

Question 9

A security administrator is troubleshooting a URL Filtering policy in Prisma Access where users are able to access a category that should be blocked. Which tool in Panorama should the administrator use to test and verify which URL category a specific website falls under and which policy rule applies?

Accepted Answer

Use the URL Filtering lookup tool in Panorama or test via 'test url ' in the CLI.. Panorama's URL Filtering lookup tool and the CLI 'test url ' command query the URL categorization database and show which category a site belongs to and which policy rule matches. This is the direct way to verify why a URL is or isn't being blocked. It removes guesswork from URL Filtering troubleshooting.

Answer

Review the ACC top applications widget.

Answer

Check the GlobalProtect gateway connection status.

Answer

Examine the System log for category update errors.

Question 10

An administrator is setting up a new Prisma Access deployment and needs to ensure that the initial configuration is applied correctly. The administrator has already activated the Prisma Access license and is now in the Prisma Access configuration workflow. Which step must be completed first before configuring Remote Networks and Service Connections?

Accepted Answer

Configure the Prisma Access infrastructure settings, including the tenant and service connection type.. In the Prisma Access configuration workflow, the first step is to configure the infrastructure settings. This includes specifying the tenant, selecting the service connection type, and defining the locations for mobile users and remote networks. These settings are foundational and must be completed before moving on to more specific configurations like Remote Networks, Service Connections, or security policies.

Answer

Set up GlobalProtect portals and gateways for remote users.

Answer

Configure DNS and DHCP settings for the service connections.

Answer

Create security policies for remote users and remote networks.

Question 11

An administrator has deployed Prisma Access with a single Remote Network SPN at a branch office in Frankfurt. Users complain that after a failover of the primary ISP link, all traffic to SaaS applications is being forced through the backup link even though the primary link is healthy again. The administrator wants Prisma Access to automatically restore the preferred path without manual intervention. Which feature should be configured?

Accepted Answer

Path quality monitoring with failback on the Remote Network. Prisma Access Remote Networks support path quality monitoring and failback so that when the preferred ISP link becomes healthy again, traffic is automatically returned to it. This removes the need for manual tunnel flapping or administrator intervention and matches the scenario where traffic remained pinned to the backup link after the primary recovered.

Answer

Quality of Service (QoS) profiles on the IPSec tunnel

Answer

ECMP load balancing across both ISP links

Answer

BGP local preference tuning on the CPE router

Question 12

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

Accepted Answer

Hosting the GlobalProtect agent software and gateway lists.. The Portal provides authentication and the configuration/software updates to the GlobalProtect agent.

Answer

Terminating the IPSec tunnel from branch sites.

Answer

Managing Cloud Identity Engine sync.

Answer

Performing deep packet inspection.

Question 13

A Prisma Access administrator is troubleshooting why a mobile user's traffic is not being inspected for threats. The administrator suspects that the security policy rule is not applying the correct security profiles. Which Prisma Access component should the administrator examine to confirm that the security profiles are attached to the rule?

Accepted Answer

The security policy rule in the Prisma Access policy configuration.. Security profiles are applied through security policy rules. To ensure threat inspection, the administrator must verify that the rule matching the user's traffic has the correct profiles attached. The GlobalProtect portal, decryption policy, and service connection are not where profiles are configured. Checking the security policy rule directly confirms whether inspection is enabled for that traffic.

Answer

The GlobalProtect portal configuration.

Answer

The service connection configuration.

Answer

The decryption policy rules.

Question 14

An administrator needs to verify the license status and active subscriptions (such as WildFire, Threat Prevention, and URL Filtering) for Prisma Access in Panorama. Which menu path should be used?

Accepted Answer

Panorama > Cloud Services > Setup > Licenses or Panorama > License.. In Panorama managing Prisma Access, license and subscription information — including WildFire, Threat Prevention, URL Filtering, and other Prisma Access subscriptions — is viewed under Panorama > Cloud Services > Setup > Licenses, or alternatively under Panorama > License depending on the Panorama version and deployment. This is where administrators verify active subscriptions and license status for the Prisma Access tenant.

Answer

Monitor > Logs > System.

Answer

Objects > Applications.

Answer

Policies > NAT.

Question 15

An administrator is deploying Prisma Access for a new Remote Network site that requires access to both the internet and internal applications. The administrator has already configured the Remote Network and Service Connection. Users report that internet access works, but internal application access fails. The administrator confirms that the Service Connection BGP session is established and advertising routes. Which configuration should the administrator verify next on the Remote Network?

Accepted Answer

The Remote Network's static routes and the associated route table entries that direct internal subnet traffic toward the Service Connection tunnel.. Remote Networks rely on static routes to direct traffic to the Service Connection for internal subnets. Even with an established BGP session on the Service Connection, missing or incorrect static routes on the Remote Network will prevent internal application access. Verifying these routes is the correct next step.

Answer

The decryption profile applied to the Remote Network to confirm that internal application certificates are trusted.

Answer

The GlobalProtect portal configuration to ensure the Remote Network users are assigned the correct internal DNS servers.

Answer

The HIP profile assigned to Remote Network users to ensure they meet internal access requirements.