SSE-Engineer Practice Test 2 — 25 Questions

Question 1

An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multiple Security Processing Nodes (SPNs) distributed across multiple geographic regions. To ensure traffic processing occurs closest to users across North America, Europe, and Asia, the architect should deploy multiple Security Processing Nodes (SPNs) distributed across those geographic regions. SPNs are the compute nodes that perform security processing, and distributing them reduces latency by handling traffic near the user.

Answer

A dedicated hardware Panorama appliance in each branch office

Answer

Prisma SD-WAN appliances at every remote user laptop

Answer

A single centralized Prisma Access parent node in the headquarters region

Question 2

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

Accepted Answer

Panorama > Cloud Services > Status.. Panorama > Cloud Services > Status is the dedicated workspace that displays the overall health and status of Prisma Access infrastructure, including Mobile User and Remote Network nodes across regions. It shows service status, license usage, and node health. The other options are unrelated configuration or monitoring areas.

Answer

Objects > Certificates.

Answer

Policies > QoS.

Answer

Monitor > Managed Devices.

Question 3

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks > [Select Network] > BGP. BGP settings for remote networks are configured within the Remote Network definition in the Panorama Cloud Services plugin.

Answer

Objects > Remote Networks > BGP Profile

Answer

Network > Virtual Routers > BGP

Answer

Device > Setup > Routing > BGP

Question 4

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

Accepted Answer

Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.. Intermittent SAML authentication failures where the IdP logs success but Prisma Access logs failure are most commonly caused by clock skew between the IdP and Prisma Access service nodes exceeding the allowed tolerance (typically 5 minutes). SAML assertions include timestamps (NotBefore, NotOnOrAfter) that are validated; if the clocks are not synchronized, the assertion may be considered expired or not yet valid.

Answer

The GlobalProtect client software license has expired on Panorama.

Answer

The User-ID agent service on the Panorama management server is stopped.

Answer

WildFire cloud subscription has lapsed.

Question 5

An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?

Accepted Answer

GlobalProtect Split Tunneling based on Access Routes and Domains. Prisma Access allows Split Tunneling based on domains or destinations so that specific traffic (like video streaming or trusted SaaS) bypasses the VPN tunnel.

Answer

Explicit Proxy PAC file routing

Answer

SD-WAN Traffic Steering Policies

Answer

SSL Decryption Exclusion Objects

Question 6

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 7

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Accepted Answer

Address objects or Address Groups.. Address objects or Address Groups allow for efficient grouping and reuse in security policies.

Answer

URL filtering category.

Answer

Service objects based on port numbers only.

Answer

Interface-based rules.

Question 8

An administrator is deploying Prisma Access and needs to ensure that remote users can access internal applications hosted in a data center. The data center is connected to Prisma Access via a service connection. The administrator wants to avoid exposing internal IP addresses to the internet. Which Prisma Access component should be used to securely route traffic from remote users to the data center?

Accepted Answer

Service Connection. A Service Connection in Prisma Access provides a secure, private link between the Prisma Access infrastructure and the customer's data center. This allows remote users to access internal applications without exposing them to the internet. It is the correct component for securely routing traffic from remote users to the data center.

Answer

Remote Network

Answer

Mobile User

Answer

Explicit Proxy

Question 9

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Accepted Answer

In the GlobalProtect Portal configuration under Authentication. SAML authentication for mobile users is configured and referenced within the GlobalProtect Portal external authentication settings.

Answer

In the Panorama Log Forwarding profile

Answer

In the Prisma Access Remote Network BGP peer settings

Answer

In the Service Connection QoS profile

Question 10

A Prisma Access administrator is troubleshooting a mobile user who reports that they can connect via GlobalProtect but cannot access any internal resources. The administrator suspects that the issue is related to the user's group mapping. Which log type in Prisma Access should the administrator review to verify user-to-group mapping?

Accepted Answer

User-ID logs. User-to-group mapping in Prisma Access is handled by User-ID, which collects user information from directory services and maps users to groups. When a user cannot access internal resources despite a successful GlobalProtect connection, it is often because the user's group membership is not correctly recognized, causing group-based security policies to fail. The User-ID logs provide detailed information about user mapping events, including group associations, making them the correct logs to review.

Answer

Threat logs

Answer

GlobalProtect logs

Answer

Traffic logs

Question 11

An enterprise using Prisma Access has configured a Service Connection to their primary data center. Users at remote branches report that they cannot reach internal applications hosted in the data center. Upon checking Panorama, the Service Connection status shows 'Connected', but routing is failing. What configuration step is required on Prisma Access to advertise the remote network subnets to the data center?

Accepted Answer

Configure BGP peer settings and export rules on the Service Connection in Panorama.. The Service Connection in Prisma Access uses a secure tunnel (IPsec) to the data center, and routing information must be exchanged dynamically. BGP is the supported routing protocol for Service Connections, and export rules determine which remote network subnets (branch/remote user networks) are advertised to the data center. Without configuring BGP peer settings and export rules, the data center will not learn the routes to the remote subnets, causing connectivity failures even though the tunnel is 'Connected'.

Answer

Enable SSL Decryption on the Service Connection interface.

Answer

Create a GlobalProtect Portal authentication profile for the data center.

Answer

Configure Zone Protection profiles on the tunnel interface.

Question 12

A remote network connected via Prisma Access is experiencing packet drops due to Maximum Transmission Unit (MTU) size mismatches. Which troubleshooting technique or configuration should be verified to resolve IP packet fragmentation issues?

Accepted Answer

Enable TCP MSS clamping on the IPsec tunnel settings or ensure the local CPE device correctly handles ICMP Destination Unreachable messages.. MTU mismatches cause fragmentation issues when packets exceed the path MTU and ICMP 'fragmentation needed' messages are blocked. Enabling TCP MSS clamping on the IPsec tunnel forces the maximum segment size to fit within the tunnel MTU, preventing fragmentation, while ensuring the CPE handles ICMP Destination Unreachable (Type 3, Code 4) allows Path MTU Discovery to function correctly.

Answer

Change the mobile user authentication type from SAML to RADIUS.

Answer

Configure a WildFire analysis profile to bypass large files.

Answer

Increase the GlobalProtect client idle timeout value to 3600 seconds.

Question 13

An administrator troubleshooting a Prisma Access environment notices that specific traffic is bypassing security inspection. Upon checking the Security Policy, the administrator sees that a security rule has the profile setting set to 'None'. What does this configuration mean for traffic matching that rule?

Accepted Answer

Traffic allowed by the rule will not be inspected by Antivirus, Anti-Spyware, Vulnerability Protection, or WildFire security profiles.. When a security rule in Prisma Access has its security profile setting configured as 'None', the rule still permits the traffic based on its match criteria, but no security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, WildFire, URL Filtering, etc.) are applied to that traffic. This effectively creates an allow rule with zero content inspection, which is why the administrator observed traffic bypassing security inspection. The action of the rule is still 'Allow' — 'None' only refers to the profile group attached, not the rule action.

Answer

Traffic matching the rule is dropped automatically.

Answer

SSL decryption is automatically enabled.

Answer

Traffic is forced through the explicit proxy.

Question 14

A security engineer is configuring Prisma Access to inspect traffic from remote networks. The requirement is to apply different security policies based on the source IP address of the traffic. Which configuration object in Prisma Access should be used to define the source IP addresses for policy enforcement?

Accepted Answer

Remote Network Configuration. Remote network configurations in Prisma Access include the specification of the branch's IP addresses. These addresses are used as source addresses in security policies, enabling policy enforcement based on the originating branch. Other objects like Address Objects or EDLs can be used in policies but do not define the source IPs for remote networks.

Answer

Address Objects

Answer

Service Connection Configuration

Answer

External Dynamic Lists (EDLs)

Question 15

An administrator is configuring Prisma Access for the first time and needs to ensure that mobile users can resolve internal domain names. The administrator has enabled DNS proxy in the Mobile Users settings. Which additional configuration is required to resolve internal domains?

Accepted Answer

Add the internal domains to the DNS proxy's domain list and specify the internal DNS servers for resolution.. The DNS proxy feature supports split DNS by allowing administrators to specify internal domains and the DNS servers responsible for them. This configuration ensures that queries for internal domains are forwarded to the appropriate internal DNS servers, while other queries are resolved externally. Without this, internal domain resolution would fail. The other options do not address the required DNS proxy configuration.

Answer

Configure a static route on the mobile user gateway to reach the internal DNS servers.

Answer

Create a security policy rule allowing DNS traffic from mobile users to the internal DNS servers.

Answer

Enable DNS Security on the mobile user gateway to inspect internal DNS queries.

Question 16

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

Accepted Answer

Decryption policy configuration ensuring traffic is not bypassing inspection. Option A is correct because if a Decryption policy (SSL Forward Proxy) is not configured or the traffic is excluded from decryption, encrypted sessions bypass content inspection and Threat Prevention profiles cannot evaluate the payload, so the decryption policy must be verified to ensure traffic is not bypassing inspection. Option D is correct because Threat Prevention inspection only occurs when the matching Security Policy rule has the appropriate Threat Prevention profiles attached — Antivirus, Vulnerability Protection, and Anti-Spyware — so the rule must be checked to confirm these profiles are applied to the user traffic. Option B is not relevant because CASB API connector tokens relate to SaaS application visibility and data loss prevention via API-based out-of-band scanning, not inline Threat Prevention inspection of remote user traffic. Option C is not relevant because the username-to-IP mapping agent affects user identification and policy matching, not the Threat Prevention inspection pipeline itself. Option E is not relevant because Service Connection BGP keepalive intervals affect routing adjacency stability between Prisma Access and on-premises/service connections, not Threat Prevention inspection of remote user traffic.

Answer

Cloud Access Security Broker (CASB) API connector tokens

Answer

GlobalProtect user username-to-IP mapping agent status

Answer

Service Connection BGP peer keepalive intervals

Question 17

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Accepted Answer

Check GlobalProtect client settings in Panorama to ensure HIP report generation and submission intervals are correctly configured.. Option C is correct because HIP checks on Prisma Access mobile users depend on the GlobalProtect client generating and submitting HIP reports, and those behaviors are governed by the HIP report generation and submission interval settings configured in the GlobalProtect agent settings in Panorama; verifying these settings confirms the client is actually sending HIP data for evaluation. Option D is correct because the Monitor > Logs > HIP Match log records the results of HIP-based compliance evaluations, showing which HIP profiles matched or failed for each user/device, which is the direct way to verify that HIP checks are operating correctly. Option A is incorrect because NAT policy rules only affect address translation and have no bearing on HIP report generation or evaluation. Option B is incorrect because restarting a physical branch firewall is irrelevant to Prisma Access mobile user HIP checks, which are enforced in the Prisma Access cloud infrastructure. Option E is incorrect because updating the URL Filtering database affects web content inspection, not HIP check functionality.

Answer

Modify the NAT policy rules.

Answer

Restart the physical branch firewall.

Answer

Update the URL Filtering database.

Question 18

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

Accepted Answer

Prisma Access plugin. The Prisma Access plugin must be installed on Panorama to enable the Prisma Access configuration workflows, including onboarding, tenant management, and pushing security policy to the Prisma Access cloud infrastructure. Without this plugin, Panorama cannot manage Prisma Access nodes or service connections. It is the required integration component for Panorama-managed Prisma Access deployments.

Answer

SD-WAN plugin

Answer

VM-Series plugin

Answer

Cortex Data Lake plugin

Question 19

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

Accepted Answer

Inspect Proxy Authentication and Decryption profiles to ensure authentication challenges are correctly processed.. Option A is correct because in a Prisma Access explicit proxy deployment, Proxy Authentication and Decryption profiles determine how the firewall handles authentication challenges and SSL decryption; if these are misconfigured, the proxy may silently drop or fail to respond to the client's CONNECT/GET requests, producing connection timeouts. Option C is correct because Security Policy rules must explicitly permit traffic to the explicit proxy listener ports (for example, TCP 8080) on the Prisma Access proxy; if the policy denies or does not match that traffic, sessions time out before reaching the proxy service. Option D is correct because the explicit proxy port and proxy profile configured on Prisma Access must match the port and PAC file/browser settings on the client; a mismatch means the browser sends requests to a port the proxy is not listening on, resulting in connection timeouts. Option B is not relevant because BGP AS numbers apply to Service Connection routing and do not affect explicit proxy listener behavior or client proxy sessions. Option E is not relevant because GlobalProtect pre-logon timeout pertains to GlobalProtect remote access tunnels, not to explicit proxy web traffic.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the GlobalProtect client pre-logon timeout value.

Question 20

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

Accepted Answer

A SaaS security policy rule that identifies the application and applies the allow or block action.. SaaS security policies are the Prisma Access mechanism for identifying SaaS applications and enforcing sanctioned versus unsanctioned behavior. They allow the administrator to permit and inspect approved SaaS applications for data patterns while blocking unsanctioned ones, which matches the team's requirement precisely.

Answer

A decryption policy that decrypts all SSL traffic to SaaS applications.

Answer

A URL filtering profile that categorizes SaaS domains and applies block or allow actions.

Answer

A security policy rule using application filters for all web-browsing traffic.