SSE-Engineer Practice Test 1 — 30 Questions

Question 1

Which action should an administrator take to update the Prisma Access software and plugin versions across the deployment?

Accepted Answer

Panorama > Plugin > Cloud Services > Updates. Panorama manages Prisma Access updates through the Software and Cloud Services plugin update mechanisms.

Answer

Device > Software > Prisma Access

Answer

Policies > Management > Updates

Answer

Monitor > Software Updates > Cloud

Question 2

An administrator wants to view real-time metrics, node status, and active connection counts for Prisma Access Mobile Users and Remote Networks directly from Panorama. Which tool within Panorama should the administrator access?

Accepted Answer

Prisma Access Insights. Prisma Access Insights provides a centralized dashboard in Panorama for monitoring service health, bandwidth utilization, and active connections.

Answer

GlobalProtect Portal Diagnostics Tool

Answer

Command Center CLI

Answer

Cloud Identity Engine Console

Question 3

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. To use CIE with Prisma Access, you must connect the directory service via the CIE agent or integration, configure the Authentication Profile in Panorama to point to CIE, and apply group mapping.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 4

When configuring a Remote Network (RN) connection to an on-premises data center, which parameter is required to ensure proper routing of internal traffic via the IPSec tunnel?

Accepted Answer

The BGP peer IP address or static routes defining the internal subnets.. The BGP peer configuration or static routes within the Remote Network settings ensure the Prisma Access cloud knows which subnets to route through the tunnel.

Answer

Primary and Secondary IKE gateways.

Answer

The User-ID agent IP address.

Answer

The GlobalProtect Gateway IP.

Question 5

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

Accepted Answer

Enable HIP data collection on the GlobalProtect agent settings.. HIP enforcement requires collecting profiles via the GlobalProtect agent and enforcing them in Security rules.

Answer

Configure static ARP entries on the GlobalProtect gateway.

Answer

Deploy WildFire appliance hardware at every branch location.

Answer

Install a local proxy server on every mobile device.

Question 6

An organization requires that specific SaaS applications are accessed only by corporate-managed devices that pass a specific HIP check. Which policy type should the administrator configure?

Accepted Answer

Security Policy Rule referencing the HIP Profile. HIP checks are enforced within Security Policy rules by referencing the desired HIP Object or HIP Profile in the rule's criteria.

Answer

Decryption Policy applying inbound SSL decryption

Answer

QoS Policy referencing the HIP Object

Answer

Authentication Policy enforcing GlobalProtect gateway authentication

Question 7

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

Accepted Answer

Configure split tunneling to route non-corporate or high-bandwidth web traffic (e.g., video streaming) directly to the internet.. Traffic optimization for mobile users involves split tunneling, optimal gateway selection, and QoS.

Answer

Disable all threat inspection profiles for mobile users to bypass security processing.

Answer

Route all mobile user traffic through a single centralized headquarters datacenter firewall.

Question 8

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks. Prisma Access remote networks and mobile user configurations are managed centrally through Panorama using the Cloud Services plugin.

Answer

Prisma Access App > Traffic Steering > Remote Networks

Answer

Policies > Security > Remote Networks

Answer

Device > Setup > Operations > Remote Networks

Question 9

Where do administrators configure service connections in Prisma Access to connect the cloud security infrastructure to the organization's data center or headquarters?

Accepted Answer

Panorama > Cloud Services > Configuration > Service Connections. Service connections are configured in the Panorama Cloud Services plugin to establish secure tunnels back to corporate datacenters.

Answer

Network > Interfaces > Tunnel

Answer

Policies > QoS > Service Connections

Answer

Device > Cloud Services > GlobalProtect

Question 10

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks > [Select Network] > BGP. BGP settings for remote networks are configured within the Remote Network definition in the Panorama Cloud Services plugin.

Answer

Objects > Remote Networks > BGP Profile

Answer

Network > Virtual Routers > BGP

Answer

Device > Setup > Routing > BGP

Question 11

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

Accepted Answer

Vulnerability Protection profile. WildFire and Vulnerability Protection profiles defend against zero-day exploits and known vulnerabilities.

Answer

Decryption profile assigned directly to the threat engine

Answer

Zone Protection profile

Answer

QoS profile for traffic shaping

Question 12

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Accepted Answer

Configure a Directory Service connector to sync users and groups from Active Directory.. CIE requires directory service integration, cloud tenant setup, and agent or sync configuration.

Answer

Install physical Domain Controllers inside each Prisma Access cloud node.

Answer

Configure BGP peering between CIE and the enterprise DNS servers.

Question 13

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

Accepted Answer

Traffic and Threat logs. Panorama provides traffic, threat, and HIP match logs alongside ACC dashboards for visibility.

Answer

Active Directory replication event logs

Answer

Local hypervisor resource utilization logs

Answer

Switch spanning-tree topology tables

Question 14

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 15

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Accepted Answer

Local ISP latency and bandwidth.. Compute locations are chosen based on proximity to users, licensing availability, and the specific traffic type.

Answer

The number of users in the local branch.

Answer

The color of the hardware appliance.

Question 16

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Accepted Answer

Implement dynamic routing protocols (BGP) over the IPsec tunnels to facilitate automatic failover.. Remote network redundancy relies on redundant IPsec tunnels, BGP multipath/failover, and dual edge routers.

Answer

Cluster physical firewalls in an Active-Active HA pair inside the Prisma Access cloud infrastructure.

Answer

Manually update static routes on employee laptops whenever a remote network link fails.

Question 17

When deploying Prisma Access, which component acts as the central management plane to push security policies, configurations, and software updates to all cloud-managed SPNs?

Accepted Answer

Panorama. Panorama acts as the central management plane for Prisma Access.

Answer

GlobalProtect Portal

Answer

AWS Transit Gateway Manager

Answer

Prisma Access Cloud Controller

Question 18

Which cloud infrastructure providers host the backend Security Processing Nodes (SPNs) used by Prisma Access?

Accepted Answer

AWS and Google Cloud Platform (GCP). Prisma Access is built on leading hyper-scaler cloud infrastructure, specifically AWS and Google Cloud Platform (GCP).

Answer

Oracle Cloud Infrastructure (OCI) and IBM Cloud

Answer

Microsoft Azure only

Answer

On-premises enterprise datacenters exclusively

Question 19

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

Accepted Answer

BGP. Prisma Access supports BGP (Border Gateway Protocol) over IPsec for dynamic routing on Service Connections and Remote Networks.

Answer

EIGRP

Answer

RIPv2

Answer

OSPF

Question 20

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

Accepted Answer

Cloud Identity Engine Agent. The Cloud Identity Engine Agent runs on-premises and establishes an outbound secure connection to CIE, synchronizing directory data without requiring inbound firewall changes.

Answer

Prisma Access User-ID Syslog Listener

Answer

GlobalProtect Gateway Proxy

Answer

Panorama Log Collector