SSE-Engineer Practice Test 5 — 25 Questions

Question 1

An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL Decryption policy with a Forward Trust certificate. Inbound and outbound SSL/TLS Decryption is critical for Prisma Access SWG and CASB to inspect application payloads, read SNI, and apply granular control over cloud applications.

Answer

Quality of Service (QoS) profile for SaaS acceleration

Answer

User-ID agent mapping via LDAP integration

Answer

DNS Security with external recursive resolver redirection

Question 2

An administrator implements a new Decryption policy in Prisma Access to inspect inbound traffic to a public-facing application hosted behind a Prisma Access Public IP. After deployment, users report receiving certificate warning errors. What should the administrator inspect first to resolve the warning?

Accepted Answer

Verify that the correct server certificate and private key are imported into Panorama and bound to the Inbound Decryption rule.. Inbound SSL decryption requires the specific server certificate and private key to be imported into Panorama and referenced in the Decryption policy.

Answer

Check whether the GlobalProtect client version on the user's laptop is up to date.

Answer

Ensure that WildFire analysis is disabled for inbound decrypted traffic.

Answer

Verify the OCSP responder settings under Device > Setup > Sessions.

Question 3

An administrator needs to review configuration changes made to Prisma Access settings in Panorama over the past week to determine who modified a security policy. Which log should the administrator examine?

Accepted Answer

Monitor > Logs > Config.. Configuration logs record all changes made to configurations in Panorama.

Answer

Monitor > Logs > Threat.

Answer

Monitor > Logs > Data Filtering.

Answer

Monitor > Logs > Traffic.

Question 4

An architect is designing a high-availability Remote Network location for Prisma Access. Which TWO methods can be used to ensure redundancy for branch office traffic connecting to Prisma Access? (Choose two)

Accepted Answer

Deploy dual branch routers establishing independent IPSec tunnels to Prisma Access. Branch office redundancy in Prisma Access can be achieved by deploying redundant IPSec tunnels from the branch router to Prisma Access and utilizing BGP path selection, or by deploying redundant branch hardware devices.

Answer

Enable VRRP directly across the Prisma Access cloud gateway public IP addresses

Answer

Configure Spanning Tree Protocol (STP) across the IPSec tunnel interfaces

Answer

Use L2TPv3 link aggregation across the cloud service edge

Question 5

An enterprise is deploying Prisma Access and wants to ensure that user identity mapping is gathered efficiently from Microsoft Entra ID (formerly Azure AD) without deploying physical User-ID agents inside the cloud network. Which integration method should be used?

Accepted Answer

Cloud Identity Engine (CIE). Prisma Access supports User-ID integration with Azure AD via the Cloud Identity Engine (CIE) or direct cloud-based User-ID agentless polling.

Answer

WMI probing from Prisma Access nodes

Answer

GlobalProtect client registry polling

Answer

Syslog server parsing via Service Connection

Question 6

A security engineer is troubleshooting a ZTNA connection issue where remote users running GlobalProtect are unable to reach internal applications hosted behind a Prisma Access Remote Network. The mobile users and remote networks are in the same region, but direct branch-to-branch routing is failing. Which Prisma Access feature must be verified to ensure direct traffic flow between mobile users and remote networks without backhauling to the cloud service nodes?

Accepted Answer

Mobile User to Remote Network direct routing. Prisma Access supports Mobile User to Remote Network (MU-to-RN) direct traffic routing, which allows traffic to flow between mobile users and remote networks directly when both are connected to the same service node location.

Answer

Explicit Proxy PAC file redirect

Answer

Prisma Access Insights Regional Peering

Answer

Clean Pipe architecture

Question 7

A security engineer is configuring a Prisma Access Remote Network location with redundant IPsec tunnels to ensure high availability. What configuration requirement must be met on the customer premise equipment (CPE) router to support dynamic routing over these redundant tunnels?

Accepted Answer

BGP peering must be established across both tunnels with the Prisma Access service node.. BGP peering must be configured over both IPsec tunnels, with appropriate path metrics or AS path prepending to manage active/backup or active/active flow.

Answer

Static floating routes with identical metrics must be used.

Answer

OSPF area 0 must be configured on the CPE interface.

Answer

GRE encapsulation must wrap the IPsec packets.

Question 8

Which component of Prisma Access is responsible for providing centralized management, monitoring, and reporting for all SWG, ZTNA, CASB, and FWaaS features?

Accepted Answer

Panorama. Panorama is the centralized management and logging platform for Prisma Access.

Answer

Prisma Access Insights

Answer

GlobalProtect App

Answer

Prisma Cloud

Question 9

An organization wants to restrict access to a sensitive internal financial database so that only users belonging to the 'Finance-Dept' Active Directory group and connecting from compliant corporate laptops can access it. Which Prisma Access security feature combines user identity, device posture, and application access control?

Accepted Answer

HIP (Host Information Profile) matching in Security Policies. Prisma Access ZTNA policy enforcement leverages User-ID, HIP (Host Information Profile) checks, and App-ID to enforce least-privilege access.

Answer

URL Filtering Custom Categories

Answer

Zone Protection profiles

Answer

CASB Inline Policy Rules

Question 10

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Accepted Answer

Objects -> Security Profiles -> DNS Security. DNS Security profiles are attached to Security Policy rules in Panorama to inspect and take action on DNS requests.

Answer

Policies -> NAT

Answer

Panorama -> Cloud Services -> GlobalProtect -> DNS

Answer

Network Services -> DNS Proxy

Question 11

An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?

Accepted Answer

GlobalProtect cloud DNS resolution and regional gateway priority settings. GlobalProtect cloud service uses a worldwide DNS infrastructure and cloud routing mechanism to direct client connection requests to the nearest geographic node.

Answer

Active Directory site-to-site replication

Answer

Explicit Proxy PAC file geographic strings

Answer

Manual IP routing configuration on each user laptop

Question 12

A security engineer is troubleshooting traffic inspection issues in Prisma Access FWaaS. Traffic between two mobile users is bypassing security policy inspection. Which THREE factors could cause intra-zone or inter-user traffic to bypass security inspection in Prisma Access? (Choose three)

Accepted Answer

Security policy rules configured with the 'App-Override' or custom bypass settings for specific applications.. Traffic bypassing inspection can be caused by explicit decryption bypass rules, clientless or split-tunnel configurations, or specific application bypass features.

Answer

GlobalProtect portal banner message customization.

Answer

Panorama template commit pending status on Remote Networks.

Question 13

An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect outgoing traffic for specific patterns, file types, and sensitive data to prevent data exfiltration in SWG deployments.

Answer

Zone Protection profile

Answer

Antivirus profile

Answer

URL Filtering profile

Question 14

An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?

Accepted Answer

SSL Decryption is disabled for the traffic flow.. Inline CASB controls in Prisma Access require SSL Decryption to be enabled because SaaS traffic is encrypted via HTTPS.

Answer

The GlobalProtect agent version is outdated.

Answer

The User-ID agent is offline.

Answer

SaaS Security API sync interval needs to be refreshed.

Question 15

Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?

Accepted Answer

Firewall as a Service (FWaaS). Firewall as a Service (FWaaS) provides comprehensive Layer 7 inspection for all traffic traversing Prisma Access.

Answer

CASB API scanning

Answer

Prisma Access Insights

Answer

GlobalProtect Portal

Question 16

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

Accepted Answer

DNS Security. WildFire and DNS Security provide real-time threat intelligence and automated threat prevention across Prisma Access.

Answer

Prisma Access Insights

Answer

SaaS Security API

Answer

GlobalProtect Cloud Service Agent

Question 17

An administrator is setting up Prisma Access logging and monitoring. Which THREE logs or reporting features in Panorama provide insights into SWG, ZTNA, and CASB activities? (Choose three)

Accepted Answer

Threat logs for malware, spyware, and vulnerability exploit detections.. Panorama provides specialized logs for URLs, threats, traffic, and SaaS activities to monitor SSE domains.

Answer

Hardware environmental temperature and power supply status logs.

Answer

CLI debug logs from physical core router interfaces.

Question 18

An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)

Accepted Answer

Granular action control such as allowing read-only access while blocking file uploads to sanctioned or unsanctioned SaaS tenants. Prisma Access SWG and inline CASB allow administrators to control specific application actions (e.g., block uploads), inspect traffic using URL filtering categories, and enforce data loss prevention via Data Filtering profiles.

Answer

Direct peer-to-peer BGP routing exchanges with external public web servers

Answer

Local BIOS firmware flashing and motherboard diagnostics for remote client laptops

Question 19

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Question 20

When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?

Accepted Answer

GlobalProtect Portal. The GlobalProtect Portal handles user authentication, client software updates, and assigns the optimal GlobalProtect Gateway.

Answer

Service Connection

Answer

GlobalProtect Gateway

Answer

Remote Network