SSE-Engineer Practice Test 2 — 30 Questions

Question 1

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 2

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Accepted Answer

Using source/destination address objects or tags.. Security policies require zones and address objects (or user groups) to identify traffic uniquely.

Answer

Enabling SSL inspection on all traffic.

Answer

Defining the physical port number.

Answer

Configuring the GlobalProtect client version.

Question 3

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Accepted Answer

In the GlobalProtect Portal configuration under Authentication. SAML authentication for mobile users is configured and referenced within the GlobalProtect Portal external authentication settings.

Answer

In the Panorama Log Forwarding profile

Answer

In the Prisma Access Remote Network BGP peer settings

Answer

In the Service Connection QoS profile

Question 4

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Accepted Answer

Create a HIP Object, add it to a HIP Profile, and apply it to a Security Policy rule source criteria.. Host Information Profile (HIP) objects must be defined, added to a HIP Object Profile, and then referenced in a Security Policy rule.

Answer

Configure an App-ID override rule and assign the device certificate to the User-ID agent.

Answer

Enable SSL Forward Proxy and add the device serial number to the GlobalProtect portal whitelist.

Answer

Assign a dynamic address group to the user and create a custom URL filtering category for the SaaS app.

Question 5

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

Accepted Answer

Hosting the GlobalProtect agent software and gateway lists.. The Portal provides authentication and the configuration/software updates to the GlobalProtect agent.

Answer

Terminating the IPSec tunnel from branch sites.

Answer

Managing Cloud Identity Engine sync.

Answer

Performing deep packet inspection.

Question 6

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. HIP requires the agent to be enabled, the objects to be defined, and the security policy to reference them.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 7

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Accepted Answer

An identity provider (IdP) integration, such as Azure AD or Okta.. CIE requires an identity source integration and the enablement of the CIE service on the tenant.

Answer

Active Directory Domain Controller installation on Prisma Access.

Answer

Configuring DNS on the local workstation.

Answer

Deploying a hardware firewall at every branch.

Question 8

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

Accepted Answer

Service Connection. A Service Connection is used to connect enterprise headquarters or data centers to Prisma Access.

Answer

Prisma SD-WAN Hub Integration

Answer

GlobalProtect Gateway Connection

Answer

Remote Network Connection

Question 9

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Accepted Answer

Address objects or Address Groups.. Address objects or Address Groups allow for efficient grouping and reuse in security policies.

Answer

URL filtering category.

Answer

Service objects based on port numbers only.

Answer

Interface-based rules.

Question 10

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

Accepted Answer

Automatic IP address allocation managed by Prisma Access. Prisma Access automatically manages and allocates dynamic IP pools for mobile users via Panorama.

Answer

Static IP assignment per user via Active Directory attributes

Answer

Static IP assignment via local DHCP server in each branch office

Answer

Manual entry by users upon connection

Question 11

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

Accepted Answer

URL Filtering with real-time category lookups. Prisma Access provides comprehensive cloud-delivered security services including Threat Prevention, URL Filtering, and WildFire malware analysis natively on SPNs.

Answer

Local enterprise data center physical power failover management

Answer

Physical rack-and-stack server hardware maintenance by the customer

Question 12

An enterprise wants to implement Firewall as a Service (FWaaS) using Prisma Access to protect inter-branch traffic and internet traffic. Which Panorama template type is primarily used to push network and device configurations to Prisma Access nodes?

Accepted Answer

Cloud Services templates. Panorama uses Cloud Services templates to manage network, interface, and routing settings for Prisma Access locations.

Answer

Stack templates

Answer

Prisma Access Global templates

Answer

Mobile User dynamic templates

Question 13

An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?

Accepted Answer

On the Remote Network configuration in Panorama under Bandwidth Allocation and QoS. QoS profiles in Prisma Access for remote networks are applied on the Remote Network configuration settings in Panorama under Cloud Services.

Answer

Inside the GlobalProtect Gateway agent configuration profile

Answer

Globally inside the Palo Alto Networks WildFire configuration

Answer

Directly on the customer branch router CLI via MQC

Question 14

A company requires that Prisma Access FWaaS inspects all inter-zone traffic between two different remote branch offices connected via Prisma Access. By default, how does Prisma Access handle traffic between two Remote Networks attached to the same service region?

Accepted Answer

Traffic between Remote Networks is dropped by default unless explicitly allowed by security policy and inter-branch routing is enabled.. Prisma Access supports inter-branch routing, allowing traffic between remote networks to be inspected by security policies when inter-branch traffic is enabled.

Answer

Traffic must be backhauled to the corporate data center via a Service Connection before reaching another branch.

Answer

Remote Networks cannot communicate with each other under any circumstance.

Answer

Traffic is automatically bypassed and sent directly over public internet.

Question 15

An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?

Accepted Answer

By establishing multiple tunnels terminating on separate SPNs and using BGP multi-path or local preference for failover. Prisma Access supports redundant IPSec tunnels from branch routers, utilizing BGP to manage path selection and failover between the tunnels.

Answer

By utilizing VRRP across the cloud public IP addresses

Answer

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Answer

By configuring LACP bonding directly across the cloud IPSec endpoints

Question 16

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 17

An administrator is configuring Source NAT (SNAT) for Prisma Access Remote Networks. Which TWO reasons explain why SNAT is necessary in certain network designs? (Choose two)

Accepted Answer

To resolve overlapping IP address spaces between multiple branch offices. SNAT is used to prevent IP address overlapping between branch sites and to hide internal network structures when accessing external destinations.

Answer

To authenticate GlobalProtect users against Active Directory

Answer

To replace the requirement for BGP routing over Service Connections

Answer

To assign dynamic IPv6 addresses to individual remote worker laptops

Question 18

When configuring GlobalProtect mobile users in Prisma Access, which THREE settings are typically defined within the GlobalProtect Client Settings configuration? (Choose three)

Accepted Answer

Connect method (e.g., On-Demand, Always-On). GlobalProtect Client Settings define client behavior such as internal DNS servers, gateway preferences, and connection modes.

Answer

Prisma Access Remote Network BGP ASN

Answer

Service Connection public gateway IP address

Question 19

Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?

Accepted Answer

WildFire. WildFire is Palo Alto Networks cloud-based malware analysis and sandbox engine.

Answer

Data Filtering

Answer

URL Filtering

Answer

Antivirus Profile

Question 20

An organization requires that Prisma Access Secure Web Gateway inspects all inbound and outbound TLS traffic for employees browsing external websites. However, HR and healthcare applications must be bypassed due to privacy regulations. Where in Panorama must the administrator configure the exception for these categories?

Accepted Answer

Policies -> Decryption. Decryption policy rules in Panorama allow administrators to bypass decryption based on URL categories such as healthcare and financial services.

Answer

Panorama -> Cloud Services -> User Access

Answer

Network Services -> Prisma Access -> Decryption Bypass

Answer

Objects -> Custom URL Category