SSE-Engineer Practice Test 4 — 25 Questions

Question 1

An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the dedicated cloud-based analytics and monitoring service that provides real-time and historical operational dashboards for Prisma Access, including mobile user connection counts, per-region bandwidth utilization, and tunnel/health status. It aggregates telemetry from all Prisma Access components (mobile users, remote networks, service connections) into a single pane of glass, which is exactly what the administrator needs.

Answer

Panorama Traffic Logs

Answer

Command Line Interface (CLI) via SSH to Prisma Access nodes

Answer

Prisma Cloud Compute console

Question 2

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Accepted Answer

Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.. The CLI command 'show user ip-user-mapping all' displays the current IP-to-user mappings, and the Prisma Access monitoring dashboard shows User-ID status. This directly verifies whether User-ID mappings are populated for mobile users, which is required for user/group-based policy matching. If mappings are missing, policies won't match.

Answer

Check the GlobalProtect Gateway tunnel status.

Answer

Run 'show system software status'.

Answer

Verify the SSL Decryption certificate expiration date.

Question 3

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

Accepted Answer

Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.. Prisma Access App-ID inspection relies on application signatures that map to specific TCP/UDP ports. When an application runs on a non-standard port, the default App-ID signature won't match, so the session may be dropped or misclassified. Creating a Custom App-ID that explicitly lists the non-standard port, then referencing it in a security rule that permits that port, allows the traffic to be identified and inspected correctly through the explicit/transparent proxy.

Answer

Configure a static NAT rule for the non-standard ports on the service connection.

Answer

Disable GlobalProtect pre-logon mode.

Answer

Enable SSL Forward Proxy on the destination zones.

Question 4

An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?

Accepted Answer

GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode. GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode maintains the tunnel across network changes by automatically re-establishing the connection when the underlying network switches (Wi-Fi to cellular). Always On ensures the tunnel is brought up without user intervention, and seamless reconnection minimizes disruption during roaming. This is the client-side setting that addresses session persistence.

Answer

Explicit Proxy PAC file fallback mode

Answer

BGP route dampening on the Service Connection

Answer

IPsec Dead Peer Detection (DPD) timer set to zero

Question 5

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

Accepted Answer

Monitor > Logs > Threat.. In Prisma Access and PAN-OS, threat logs (Monitor > Logs > Threat) record all events generated by security profiles including Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire. When an Anti-Spyware profile triggers an alert, the detailed attack information — including the threat name, severity, source/destination, and often a packet capture (pcap) if configured — is stored in the Threat log. This is the correct location to investigate the specific event.

Answer

Monitor > Logs > HIP Match.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.

Question 6

Which cloud infrastructure providers host the backend Security Processing Nodes (SPNs) used by Prisma Access?

Accepted Answer

AWS and Google Cloud Platform (GCP). Prisma Access is built on leading hyper-scaler cloud infrastructure, specifically AWS and Google Cloud Platform (GCP).

Answer

Oracle Cloud Infrastructure (OCI) and IBM Cloud

Answer

Microsoft Azure only

Answer

On-premises enterprise datacenters exclusively

Question 7

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Accepted Answer

Antivirus and Anti-Spyware profiles. To inspect outbound web traffic for malware and spyware, the Security policy rule must have Antivirus and Anti-Spyware security profiles attached. These profiles perform content inspection for malicious files and spyware signatures on allowed traffic, which is required for Prisma Access to detect and block those threats.

Answer

Decryption profile and URL filtering profile only

Answer

QoS Profile and Zone Protection profile

Answer

HIP Profile and WildFire analysis profile

Question 8

An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?

Accepted Answer

GlobalProtect cloud DNS resolution and regional gateway priority settings. Prisma Access uses GlobalProtect cloud DNS resolution and regional gateway priority settings to automatically route users to the nearest regional cloud node. When a mobile user connects, GlobalProtect resolves the closest gateway based on the user's source IP geolocation and the configured priority of gateways in each region. This is automatic and requires no manual per-laptop configuration.

Answer

Active Directory site-to-site replication

Answer

Explicit Proxy PAC file geographic strings

Answer

Manual IP routing configuration on each user laptop

Question 9

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

Accepted Answer

Shadow IT discovery and risk scoring of unapproved cloud applications. Option B is correct because Prisma Access SaaS Security includes Shadow IT discovery, which uses traffic telemetry to identify unsanctioned cloud applications and assigns each a risk score so administrators can decide whether to block, allow, or coach users. Option D is correct because SaaS application activity controls provide granular, per-application policy enforcement—for example, allowing access to a collaboration tool while blocking actions such as external file sharing, public link creation, or uploads to personal accounts. Together these features deliver the visibility and action-level control the administrator needs over file sharing and collaboration SaaS. Option A is incorrect because IPsec crypto profiles govern VPN tunnel encryption parameters for branch connectivity, not SaaS application control. Option C is incorrect because GlobalProtect client version deployment rules manage endpoint agent software versions, not SaaS usage policies. Option E is incorrect because WMI-based user mapping polling relates to User-ID agent configuration for mapping users to IP addresses, not SaaS Security enforcement.

Answer

IPsec crypto profile selection for branch offices

Answer

GlobalProtect client software version deployment rules

Answer

WMI-based user mapping polling intervals

Question 10

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

Accepted Answer

Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.. DNS and WINS settings for GlobalProtect mobile users are configured under Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config. If internal hostnames fail to resolve while external sites work, the DNS server list or suffix pushed to clients is likely missing or incorrect, so this is the first place to verify. The split-tunnel domain inclusion only routes traffic; it does not supply DNS servers.

Answer

Panorama > Prisma Access > Monitoring > ACC.

Answer

Panorama > Cloud Services > Status > Traffic Log.

Answer

Panorama > Firewall > Network Profiles > Interface.

Question 11

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

Accepted Answer

Panorama > Cloud Services > Setup > Infrastructure / Status.. Prisma Access infrastructure version information is displayed under Panorama > Cloud Services > Setup > Infrastructure / Status, where the cloud service plugin shows the current Prisma Access version, tenant status, and component versions. This is the authoritative location for verifying the running cloud infrastructure version.

Answer

Policies > Security.

Answer

Device > Certificates.

Answer

Monitor > Dynamic Updates.

Question 12

A Prisma Access administrator is troubleshooting a mobile user who reports that after connecting via GlobalProtect, they cannot access internal web servers by hostname, but can access them by IP address. Other mobile users in the same region do not have this issue. Which component should the administrator verify first?

Accepted Answer

The DNS server configuration in the GlobalProtect portal agent configuration for the user's region.. The ability to reach internal servers by IP but not by hostname indicates a DNS resolution problem. In Prisma Access, DNS settings for mobile users are pushed via the GlobalProtect portal agent configuration. If the DNS servers for the user's region are misconfigured or missing, the user cannot resolve internal hostnames. Verifying the DNS server configuration is the correct first step.

Answer

The SSL decryption policy applied to the user's traffic to ensure it is not blocking DNS queries.

Answer

The security policy rules that allow or deny traffic from the mobile user to the internal web servers.

Answer

The GlobalProtect app logs on the user's endpoint to check for HIP failures.

Question 13

A security engineer is troubleshooting a Prisma Access deployment where mobile users report that traffic to a specific SaaS application is being inspected but the CASB inline policy is not applying the expected data-loss prevention action. The engineer confirms the SaaS application is identified in the traffic logs. Which log or dashboard should the engineer examine to determine whether the CASB policy matched and what action was taken?

Accepted Answer

The Data Filtering log, filtering on the SaaS application and the DLP action.. CASB inline policy matches, including the SaaS application identified and the action enforced such as alert or block, are recorded in the Data Filtering log. When a mobile user's traffic to a SaaS application is inspected but the expected DLP action does not occur, the Data Filtering log shows whether the rule matched and what action was taken. The Threat log, System log, and URL Filtering log do not capture CASB policy match and action details.

Answer

The System log, filtering on the CASB policy name and the commit status.

Answer

The Threat log, filtering on the SaaS application name and the CASB policy action.

Answer

The URL Filtering log, filtering on the SaaS application category and the user.

Question 14

An administrator is configuring Prisma Access for a branch office to provide secure internet access. They want to ensure that the branch users' traffic is inspected for threats and that access to risky URLs is blocked. Which two components are required in the Prisma Access configuration to achieve this? (Choose two.)

Accepted Answer

A Threat Prevention profile applied to the same Security Policy rule to detect and block exploits and malware.. To inspect branch traffic for threats and block risky URLs, you need a Security Policy rule that allows and inspects the traffic, with both URL Filtering and Threat Prevention profiles attached. URL Filtering blocks risky categories, while Threat Prevention detects and blocks exploits and malware. Other components like decryption, DNS Security, or File Blocking are not mandatory for the stated requirements.

Answer

A File Blocking profile to prevent executable downloads.

Answer

A Decryption policy to decrypt all SSL traffic from branch users.

Answer

A DNS Security policy to sinkhole malicious domains.

Question 15

A Prisma Access engineer is troubleshooting a mobile user who cannot access an internal application after successfully connecting via GlobalProtect. The engineer suspects that the issue is related to the split-tunnel configuration. Which TWO actions should the engineer take to verify that the correct routes are being pushed to the client? (Choose two.)

Accepted Answer

Review the GlobalProtect agent logs on the user's endpoint for the received route table.. To diagnose split-tunnel routing issues for a mobile user, the engineer must confirm both the intended configuration and the actual client behavior. The gateway configuration defines which routes should be pushed, while the client logs show which routes were received. If either is missing the internal subnet, the user cannot access the application. These two actions together isolate whether the problem is in the configuration or in the client's application of the routes.

Answer

Run a packet capture on the Prisma Access service connection to see if traffic arrives.

Answer

Verify the user's authentication and group mapping in the Prisma Access directory sync.

Answer

Inspect the IPsec tunnel status between the service connection and the remote network.

Question 16

A network security administrator is configuring Prisma Access to provide secure web gateway services to mobile users. The requirement is that all web traffic from the mobile users must be inspected for threats and URL filtering, and the administrator wants the simplest deployment that does not require installing certificates on the endpoints. Which Prisma Access capability should the administrator enable?

Accepted Answer

GlobalProtect with the Prisma Access security processing node inspecting the tunneled traffic.. GlobalProtect tunnels the mobile user's traffic to a Prisma Access security processing node, where it is inspected for threats and URL filtering without requiring proxy configuration or endpoint certificate installation. This is the standard and simplest way to provide secure web gateway services to mobile users, and it covers all traffic from the endpoint rather than only browser traffic. Explicit proxy requires client configuration, and SSL decryption requires a trust certificate on each endpoint.

Answer

A remote network connection that tunnels branch web traffic to Prisma Access for inspection.

Answer

Explicit proxy with authentication, requiring the browser to be configured with a proxy address and port.

Answer

SSL decryption with a forward proxy trust certificate installed on each endpoint.

Question 17

A Prisma Access administrator is troubleshooting a mobile user who cannot access a specific internal web application. The application is reachable from other mobile users, and the user's GlobalProtect connection is established. The administrator wants to verify whether the user's traffic is being decrypted and inspected by the security policy. Which TWO actions should the administrator take to confirm that SSL decryption is applied to the user's session? (Choose two.)

Accepted Answer

Review the decryption logs to see if the session appears. To confirm SSL decryption is applied to a specific session, the administrator should check both traffic logs and decryption logs. The traffic log's 'Decrypted' flag indicates whether the session was decrypted, while decryption logs provide detailed records of decrypted sessions, including the policy matched. Together, they verify that decryption occurred and can help identify why a security policy may not have blocked the traffic.

Answer

Check the system logs for decryption-related events

Answer

Examine the GlobalProtect app logs on the user's endpoint for SSL errors

Answer

Use the Prisma Access CLI to run 'show session all' for the user

Question 18

A security engineer is configuring Prisma Access to protect mobile users from malicious downloads. The requirement is that files downloaded from the internet by mobile users must be analyzed for zero-day malware, and the analysis must not delay the user's download. Which Prisma Access feature should the engineer configure?

Accepted Answer

WildFire cloud analysis with the forward file copy while the download proceeds.. WildFire cloud analysis forwards a copy of the downloaded file to the WildFire cloud for sandbox analysis while allowing the user's download to continue, so there is no delay. If the file is found malicious, a signature is delivered to the security processing node to block future downloads and to generate WildFire logs. Inline machine learning, file blocking, and decryption do not by themselves provide cloud sandbox analysis without delaying the user.

Answer

WildFire inline machine learning with real-time signature delivery to the security processing node.

Answer

A file blocking profile that blocks all executable files from the internet for mobile users.

Answer

A decryption policy with a forward proxy trust certificate to inspect the download content.

Question 19

An administrator needs to ensure that Prisma Access mobile users are authenticated using multi-factor authentication (MFA) before accessing corporate resources. Which Prisma Access component is responsible for enforcing MFA?

Accepted Answer

Identity Provider (IdP). MFA is enforced by the Identity Provider (IdP) that Prisma Access uses for SAML authentication. The IdP challenges users for additional credentials, and Prisma Access accepts the authentication result. Other components like the portal or gateway do not enforce MFA themselves.

Answer

Prisma Access security policy

Answer

GlobalProtect portal

Answer

GlobalProtect gateway

Question 20

A network administrator is troubleshooting a Prisma Access remote network deployment where users at a branch office are experiencing slow access to cloud applications. The administrator has verified that the IPsec tunnel is up and that there is no packet loss on the tunnel. Which tool should the administrator use to monitor the performance and latency of the Service Connection?

Accepted Answer

Prisma Access Dashboard's Service Connection health metrics. The Prisma Access Dashboard's Service Connection health metrics are specifically designed to monitor the performance of Service Connections, including latency, jitter, and packet loss. When remote network users experience slow access to cloud applications despite a healthy IPsec tunnel, the bottleneck may be at the Service Connection. Using the dashboard metrics allows the administrator to quickly assess if the Service Connection is experiencing degraded performance.

Answer

Panorama's Managed Devices health monitor

Answer

CLI commands on the remote network firewall to check tunnel statistics

Answer

GlobalProtect app logs on the branch office users' devices