SSE-Engineer Practice Test 4 — 10 Questions

Question 1

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 2

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Accepted Answer

Using source/destination address objects or tags.. Security policies require zones and address objects (or user groups) to identify traffic uniquely.

Answer

Enabling SSL inspection on all traffic.

Answer

Defining the physical port number.

Answer

Configuring the GlobalProtect client version.

Question 3

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Accepted Answer

In the GlobalProtect Portal configuration under Authentication. SAML authentication for mobile users is configured and referenced within the GlobalProtect Portal external authentication settings.

Answer

In the Panorama Log Forwarding profile

Answer

In the Prisma Access Remote Network BGP peer settings

Answer

In the Service Connection QoS profile

Question 4

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Accepted Answer

Create a HIP Object, add it to a HIP Profile, and apply it to a Security Policy rule source criteria.. Host Information Profile (HIP) objects must be defined, added to a HIP Object Profile, and then referenced in a Security Policy rule.

Answer

Configure an App-ID override rule and assign the device certificate to the User-ID agent.

Answer

Enable SSL Forward Proxy and add the device serial number to the GlobalProtect portal whitelist.

Answer

Assign a dynamic address group to the user and create a custom URL filtering category for the SaaS app.

Question 5

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

Accepted Answer

Hosting the GlobalProtect agent software and gateway lists.. The Portal provides authentication and the configuration/software updates to the GlobalProtect agent.

Answer

Terminating the IPSec tunnel from branch sites.

Answer

Managing Cloud Identity Engine sync.

Answer

Performing deep packet inspection.

Question 6

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. HIP requires the agent to be enabled, the objects to be defined, and the security policy to reference them.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 7

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Accepted Answer

An identity provider (IdP) integration, such as Azure AD or Okta.. CIE requires an identity source integration and the enablement of the CIE service on the tenant.

Answer

Active Directory Domain Controller installation on Prisma Access.

Answer

Configuring DNS on the local workstation.

Answer

Deploying a hardware firewall at every branch.

Question 8

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

Accepted Answer

Service Connection. A Service Connection is used to connect enterprise headquarters or data centers to Prisma Access.

Answer

Prisma SD-WAN Hub Integration

Answer

GlobalProtect Gateway Connection

Answer

Remote Network Connection

Question 9

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Accepted Answer

Address objects or Address Groups.. Address objects or Address Groups allow for efficient grouping and reuse in security policies.

Answer

URL filtering category.

Answer

Service objects based on port numbers only.

Answer

Interface-based rules.

Question 10

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

Accepted Answer

Automatic IP address allocation managed by Prisma Access. Prisma Access automatically manages and allocates dynamic IP pools for mobile users via Panorama.

Answer

Static IP assignment per user via Active Directory attributes

Answer

Static IP assignment via local DHCP server in each branch office

Answer

Manual entry by users upon connection