SSE-Engineer Practice Test 3 — 10 Questions

Question 1

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch users experience slow throughput to SaaS applications. The IPsec tunnel to Prisma Access is up, but performance is degraded. The administrator suspects that traffic is not being forwarded to the optimal Service Connection. Which action should the administrator take to verify that Prisma Access is selecting the correct egress point for the branch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examine the traffic logs for the session and check the egress interface field. Traffic logs are the primary tool for verifying egress selection in Prisma Access. The egress interface field in the traffic log indicates the Service Connection used for a given session. For Remote Networks, administrators can filter logs by source IP and destination to see whether traffic egresses through the intended Service Connection, confirming optimal routing.

Answer

Check the GlobalProtect gateway selection logs on the portal

Answer

Review the IPsec tunnel statistics on the branch firewall

Answer

Run a traceroute from the branch firewall to the SaaS application

Question 2

An administrator is configuring Prisma Access to secure outbound internet traffic from a remote network site. The administrator wants to ensure that all traffic from the branch is inspected by Prisma Access security services, including threat prevention and URL filtering, before reaching the internet. Which Prisma Access component must be configured to direct branch traffic to the cloud security services?

Accepted Answer

A remote network connection configured with a IPSec tunnel to the Prisma Access regional hub.. A remote network connection is the Prisma Access feature designed to connect branch offices or data centers to the Prisma Access cloud infrastructure. It uses an IPSec tunnel to the regional hub, ensuring that all traffic from the branch is inspected by Prisma Access security services before reaching the internet. This provides consistent enforcement of threat prevention, URL filtering, and other policies for branch users.

Answer

A service connection with a static IP address and BGP peering to the Prisma Access infrastructure.

Answer

A Prisma Access explicit proxy configuration for the branch office web browsers.

Answer

A GlobalProtect portal and gateway configuration for the branch office users.

Question 3

Which component in Prisma Access is responsible for performing decryption, content inspection, and threat prevention for mobile users?

Accepted Answer

Compute Location. In Prisma Access, the Compute Location (also called the compute node or service infrastructure) is the component that performs decryption, content inspection, and threat prevention for mobile users. When GlobalProtect mobile users connect, their traffic is routed through a Prisma Access compute location where security processing (App-ID, Content-ID, Threat Prevention, URL Filtering, decryption) occurs before being forwarded to the destination.

Answer

GlobalProtect Portal

Answer

Service Connection

Answer

Panorama

Answer

Cloud Identity Engine

Question 4

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Accepted Answer

Panorama > Cloud Services > Configuration > Mobile Users > Client Settings. Mobile user DNS settings for Prisma Access are configured under Panorama > Cloud Services > Configuration > Mobile Users > Client Settings, where the admin specifies the DNS servers (corporate internal resolvers) that GlobalProtect clients should use. This is the cloud-managed location for mobile user client configuration, including DNS, split tunnel, and other agent settings.

Answer

Objects > GlobalProtect > DNS Profile

Answer

Device > Setup > Services > DNS

Answer

Network > GlobalProtect > Gateway > DNS

Question 5

A security engineer is configuring Prisma Access to enforce threat prevention on all traffic from remote networks. The engineer wants to ensure that the threat prevention profile is applied to both inbound and outbound traffic. Where should the engineer attach the threat prevention profile in the Prisma Access policy?

Accepted Answer

In the security policy rule that allows traffic, under the Actions tab, by selecting the threat prevention profile in the Profile Setting.. Threat prevention profiles in Prisma Access are applied through security policy rules. The engineer should edit the relevant security rule, go to the Actions tab, and select the threat prevention profile in the Profile Setting. This applies the profile to all traffic matching the rule, covering both inbound and outbound directions if the rule does. The other options refer to policies that do not attach threat prevention profiles.

Answer

In the Data Loss Prevention (DLP) profile, by enabling threat prevention scanning.

Answer

In the decryption policy rule, under the Actions tab, by selecting the threat prevention profile.

Answer

In the application override policy, by selecting the threat prevention profile for each application.

Question 6

An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?

Accepted Answer

Multiple Security Processing Nodes (SPNs) distributed across multiple geographic regions. To ensure traffic processing occurs closest to users across North America, Europe, and Asia, the architect should deploy multiple Security Processing Nodes (SPNs) distributed across those geographic regions. SPNs are the compute nodes that perform security processing, and distributing them reduces latency by handling traffic near the user.

Answer

A dedicated hardware Panorama appliance in each branch office

Answer

Prisma SD-WAN appliances at every remote user laptop

Answer

A single centralized Prisma Access parent node in the headquarters region

Question 7

A network engineer is configuring Prisma Access and needs to verify the status of deployed Mobile User nodes across different regions. Which Panorama workspace is dedicated to displaying the overall health and status of Prisma Access infrastructure?

Accepted Answer

Panorama > Cloud Services > Status.. Panorama > Cloud Services > Status is the dedicated workspace that displays the overall health and status of Prisma Access infrastructure, including Mobile User and Remote Network nodes across regions. It shows service status, license usage, and node health. The other options are unrelated configuration or monitoring areas.

Answer

Objects > Certificates.

Answer

Policies > QoS.

Answer

Monitor > Managed Devices.

Question 8

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks > [Select Network] > BGP. BGP settings for remote networks are configured within the Remote Network definition in the Panorama Cloud Services plugin.

Answer

Objects > Remote Networks > BGP Profile

Answer

Network > Virtual Routers > BGP

Answer

Device > Setup > Routing > BGP

Question 9

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

Accepted Answer

Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.. Intermittent SAML authentication failures where the IdP logs success but Prisma Access logs failure are most commonly caused by clock skew between the IdP and Prisma Access service nodes exceeding the allowed tolerance (typically 5 minutes). SAML assertions include timestamps (NotBefore, NotOnOrAfter) that are validated; if the clocks are not synchronized, the assertion may be considered expired or not yet valid.

Answer

The GlobalProtect client software license has expired on Panorama.

Answer

The User-ID agent service on the Panorama management server is stopped.

Answer

WildFire cloud subscription has lapsed.

Question 10

An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?

Accepted Answer

GlobalProtect Split Tunneling based on Access Routes and Domains. Prisma Access allows Split Tunneling based on domains or destinations so that specific traffic (like video streaming or trusted SaaS) bypasses the VPN tunnel.

Answer

Explicit Proxy PAC file routing

Answer

SD-WAN Traffic Steering Policies

Answer

SSL Decryption Exclusion Objects