SSE-Engineer Practice Test 3 — 25 Questions

Question 1

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Security Policy rule source zone or user-group mapping does not match the incoming traffic flow.. When the user is authenticated but traffic is dropped by policy, it usually indicates that the source user or group mapping is not being correctly identified in the Security Policy, or the specific traffic rule is missing.

Answer

The GlobalProtect portal is down.

Answer

The CIE directory sync is failing.

Answer

The Prisma Access license has expired.

Question 2

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

Accepted Answer

Panorama > Job Status or Monitor > Logs > Config / System.. Panorama surfaces configuration push results and errors in two places: the Job Status view (Panorama > Job Status) shows the outcome of each commit/push job including success, failure, and warnings, while Monitor > Logs > Config and Monitor > Logs > System capture the detailed config and system-level error messages generated during the push. Together these are the authoritative locations for diagnosing why a push to Prisma Access nodes failed.

Answer

Cloud Services > Status > Remote Networks.

Answer

Device > High Availability.

Answer

Policies > Security > Audit.

Question 3

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

Accepted Answer

WildFire. WildFire is Palo Alto Networks cloud-based malware analysis and sandbox engine.

Answer

Data Filtering

Answer

URL Filtering

Answer

Antivirus Profile

Question 4

An administrator is configuring Prisma Access for a new remote network site. The site has a single ISP link and requires high availability for the IPSec tunnel to Prisma Access. The administrator wants to ensure that if the primary Prisma Access gateway becomes unavailable, the tunnel automatically fails over to a secondary gateway. Which feature should the administrator configure on the remote network device?

Accepted Answer

Configure the remote network with multiple IPSec tunnels to different Prisma Access gateways and enable tunnel monitoring with failover.. To achieve high availability for a remote network with a single ISP link, the administrator should configure multiple IPSec tunnels to different Prisma Access gateways and enable tunnel monitoring with failover. This allows the remote network device to detect a failure on the primary tunnel and automatically switch to the secondary tunnel, ensuring continuous connectivity.

Answer

Configure the remote network with multiple IPSec tunnels to different Prisma Access gateways and enable ECMP.

Answer

Configure the remote network to use IKEv2 with multiple proposals to negotiate with any available Prisma Access gateway.

Answer

Configure the remote network with a single IPSec tunnel and enable Dead Peer Detection (DPD) with a short interval.

Question 5

An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?

Accepted Answer

SSL Decryption is disabled for the traffic flow.. CASB inline policies in Prisma Access rely on the firewall's content inspection engine to identify files and apply actions. If SSL Decryption is not enabled for the traffic flow, the firewall cannot see inside the TLS session, so it cannot identify the file upload or match the inline CASB policy. The rule may show the correct application, but without decryption the file-level action cannot trigger.

Answer

The GlobalProtect agent version is outdated.

Answer

The User-ID agent is offline.

Answer

SaaS Security API sync interval needs to be refreshed.

Question 6

An administrator is troubleshooting a Prisma Access mobile user deployment where GlobalProtect clients are unable to connect. Which THREE components or settings should the administrator inspect to resolve the connection failure? (Choose three)

Accepted Answer

Inspect the GlobalProtect Client Settings in Panorama to ensure gateways and agent configurations are correctly assigned.. Option A is correct because the GlobalProtect Client Settings in Panorama determine which portals and gateways are pushed to the agent, and misassigned or missing gateway/agent configurations will prevent clients from connecting. Option B is correct because the portal and gateway present SSL/TLS certificates during the connection handshake; if these certificates are expired, have an untrusted chain, or use a hostname not matching the certificate, clients will reject the connection. Option E is correct because the Authentication Profile governs how users authenticate (RADIUS, LDAP, or SAML); if those servers are unreachable or not responding, the portal or gateway authentication step fails and the client cannot establish a session. Option C is not relevant because the WildFire file size upload limit affects threat inspection of file uploads, not GlobalProtect client connectivity. Option D is not relevant because the BGP AS number on a data center router pertains to routing peering with Prisma Access, not to mobile user GlobalProtect tunnel establishment.

Answer

Check the WildFire file size upload limit for malicious attachments.

Answer

Verify the BGP AS number configured on the customer data center router.

Question 7

An administrator needs to verify whether Host Information Profile (HIP) checks are failing for a specific mobile user attempting to connect to Prisma Access. Which log should the administrator review in Panorama?

Accepted Answer

Monitor > Logs > HIP Match.. HIP Match logs in Panorama (Monitor > Logs > HIP Match) record the results of Host Information Profile checks, including which HIP profiles matched or failed for a connecting endpoint. This is the correct log to determine whether HIP checks are failing for a specific mobile user. Threat, System, and Audit logs do not contain HIP match results.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > System.

Answer

Panorama > Cloud Services > Audit Log.

Question 8

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

Accepted Answer

BGP. Prisma Access supports BGP (Border Gateway Protocol) over IPsec for dynamic routing on Service Connections and Remote Networks.

Answer

EIGRP

Answer

RIPv2

Answer

OSPF

Question 9

An administrator is configuring Prisma Access for Secure Web Gateway (SWG) and needs to ensure that SSL decryption is applied to traffic from mobile users. Which component must be configured to enable SSL decryption in Prisma Access?

Accepted Answer

SSL Decryption policy in the Mobile Users policy rules. SSL decryption in Prisma Access is controlled by SSL Decryption policies configured under Mobile Users. These policies specify what traffic to decrypt and which decryption profile to apply. Other components like Service Connections or GlobalProtect portal settings do not enable decryption for user traffic.

Answer

SSL Inbound Inspection profile on the Remote Networks

Answer

SSL Forward Proxy settings in the Service Connection

Answer

Decryption profile in the GlobalProtect portal

Question 10

A security engineer is configuring Prisma Access to provide secure access to private applications hosted in an on-premises data center for mobile users. The engineer has set up a service connection and configured the private applications. However, users are unable to reach the applications. The engineer suspects that the issue is related to the service connection configuration. Which TWO items should the engineer verify to ensure the service connection is correctly established? (Choose two.)

Accepted Answer

The service connection is associated with the correct Prisma Access locations that serve the mobile users.. For mobile users to access private applications via a service connection, the service connection must be associated with the Prisma Access locations where users connect, and the IPSec tunnel must be operational. Verifying these two items ensures that traffic can be routed from the mobile user locations through the service connection to the on-premises data center.

Answer

The private applications are configured with the correct FQDN or IP address and are assigned to the service connection.

Answer

The mobile users' GlobalProtect configuration includes the service connection's gateway address as a split tunnel exclusion.

Answer

The service connection's BGP configuration is advertising the private application subnets to the mobile user locations.

Question 11

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 12

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

Accepted Answer

Attach appropriate Security Profiles (such as Antivirus, Anti-Spyware, and Vulnerability Protection) to all active Security Policy allow rules.. Option C is correct because every Security Policy allow rule in Prisma Access should have Security Profiles attached (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire, and File Blocking as applicable) so that permitted traffic is inspected for threats rather than simply passed; without profiles, allowed sessions receive no content inspection. Option D is correct because App-ID and User-ID provide identity- and application-aware enforcement, allowing rules to match actual applications (including those using non-standard ports or SSL) and specific users/groups, which is far more precise and secure than legacy IP-and-port matching. Option E is correct because Panorama evaluates rules top-down, so specific allow rules must precede broad general rules to avoid being shadowed, and explicit deny rules for known malicious traffic provide deterministic blocking and clearer logging than relying on implicit deny. Option A is not correct because disabling SSL Decryption globally would blind inspection to encrypted threats and is not a performance best practice; decryption should be scoped selectively. Option B is not correct because using 'Any' application in Security Policy rules defeats App-ID visibility and control, weakens security, and is discouraged even though it may reduce rule count.

Answer

Disable SSL Decryption globally to maximize Prisma Access processing throughput across all mobile user nodes.

Answer

Configure all Security Policy rules to use 'Any' application to simplify rule maintenance and reduce rule count.

Question 13

An administrator is configuring Prisma Access for the first time and needs to onboard the Prisma Access infrastructure. Which step must be completed before configuring Remote Networks and Service Connections?

Accepted Answer

Activate the Prisma Access license and allocate the infrastructure. The first step in deploying Prisma Access is to activate the license and allocate the infrastructure. This provisions the cloud-based security processing nodes and network components. Only after this onboarding can Remote Networks, Service Connections, and other configurations be set up. Other tasks like GlobalProtect or BGP are part of subsequent configuration phases.

Answer

Set up a Panorama management server

Answer

Configure BGP peering with the customer's data center

Answer

Deploy a GlobalProtect portal and gateway

Question 14

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

Accepted Answer

Configure TCP MSS adjustment on the GlobalProtect tunnel settings or reduce the tunnel interface MTU.. TCP MSS adjustment (or lowering the tunnel interface MTU) is the correct fix because fragmentation on the GlobalProtect/Prisma Access tunnel occurs when the encapsulated packet exceeds the path MTU. By clamping TCP MSS on the tunnel or reducing the tunnel MTU, the endpoint negotiates a smaller segment size so packets fit inside the tunnel without fragmenting. This directly addresses the root cause of slow/failed rendering for mobile users.

Answer

Change the mobile user IP pool subnet mask from /24 to /16.

Answer

Disable WildFire file forwarding for large files.

Answer

Increase the decryption profile timeout value.

Question 15

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

Accepted Answer

In the Panorama GlobalProtect Client Settings configuration under Network Settings. In Prisma Access, the internal DNS servers that GlobalProtect clients use for corporate name resolution are defined in the GlobalProtect Client Settings configuration within Panorama, specifically under Network Settings (DNS Server fields). This pushes the primary and secondary DNS server IPs to the GlobalProtect agent so that split-tunnel DNS queries for internal domains are sent to corporate resolvers rather than the local ISP DNS.

Answer

In the Prisma SD-WAN DNS proxy forwarding table

Answer

Directly on the remote user local machine registry

Answer

In the cloud Managed Security Services Provider (MSSP) portal

Question 16

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. They want to ensure that all web traffic is scanned for threats and that file downloads are restricted based on file type. Which Prisma Access service should they configure to achieve this?

Accepted Answer

Configure a Security Policy rule in Prisma Access with URL Filtering and File Blocking profiles applied to the remote network zone.. To inspect web traffic and restrict file downloads by type for remote networks, you need a Security Policy rule with URL Filtering and File Blocking profiles. These profiles are applied to the appropriate zone and provide the required control. WildFire detects malware but doesn't block by file type, Data Filtering is for DLP, and SaaS Security is limited to SaaS applications.

Answer

Set up a SaaS Security inline policy to control sanctioned SaaS applications.

Answer

Configure a Decryption policy to inspect SSL traffic and then apply a Data Filtering profile.

Answer

Enable WildFire inline ML on the remote network firewall to detect malicious files.

Question 17

An administrator is configuring a Remote Network in Prisma Access to connect a branch office. The branch office has a single ISP link and requires high availability. The administrator wants to ensure that if the primary IPSec tunnel fails, traffic automatically switches to a secondary tunnel. Which Prisma Access feature should be configured to achieve this?

Accepted Answer

Multiple IPSec tunnels with BGP. High availability for a Remote Network is achieved by configuring multiple IPSec tunnels and using BGP for route failover. BGP dynamically withdraws routes when a tunnel fails, directing traffic to the remaining tunnel. Policy-Based Forwarding, QoS, and Explicit Proxy do not provide this automatic failover capability.

Answer

Explicit Proxy

Answer

Policy-Based Forwarding

Answer

Quality of Service (QoS)

Question 18

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

Accepted Answer

URL Filtering log. The URL Filtering log in Prisma Access records every web-browsing session that matches a URL Filtering profile, including the URL category, the action taken (allow/block/continue/override), the user, and the source. This is the only log type that directly captures blocked URLs and category ratings for user web attempts.

Answer

Threat log

Answer

Data Filtering log

Answer

HIP Match log

Question 19

A Prisma Access administrator notices that a specific remote network tunnel shows as up, but the branch users cannot reach any internet destinations. The tunnel interface on the branch CPE is up, and the administrator can ping the Prisma Access service IP. Which log type on the Prisma Access side should the administrator review first to determine whether traffic is being dropped by a security policy?

Accepted Answer

Traffic logs. When a remote network tunnel is up but users cannot reach the internet, the immediate suspicion is a security policy misconfiguration or a routing issue. Traffic logs on Prisma Access capture session-level details, including the applied security rule and action. Reviewing them will show if traffic is being denied and by which rule, enabling quick remediation. System, threat, and HIP logs do not provide this policy enforcement visibility for remote network traffic.

Answer

System logs

Answer

HIP Match logs

Answer

Threat logs

Question 20

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks. Prisma Access remote networks and mobile user configurations are managed centrally through Panorama using the Cloud Services plugin.

Answer

Prisma Access App > Traffic Steering > Remote Networks

Answer

Policies > Security > Remote Networks

Answer

Device > Setup > Operations > Remote Networks