SSE-Engineer Practice Test 5 — 10 Questions

Question 1

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

Accepted Answer

Decryption policy configuration ensuring traffic is not bypassing inspection. Option A is correct because if a Decryption policy (SSL Forward Proxy) is not configured or the traffic is excluded from decryption, encrypted sessions bypass content inspection and Threat Prevention profiles cannot evaluate the payload, so the decryption policy must be verified to ensure traffic is not bypassing inspection. Option D is correct because Threat Prevention inspection only occurs when the matching Security Policy rule has the appropriate Threat Prevention profiles attached — Antivirus, Vulnerability Protection, and Anti-Spyware — so the rule must be checked to confirm these profiles are applied to the user traffic. Option B is not relevant because CASB API connector tokens relate to SaaS application visibility and data loss prevention via API-based out-of-band scanning, not inline Threat Prevention inspection of remote user traffic. Option C is not relevant because the username-to-IP mapping agent affects user identification and policy matching, not the Threat Prevention inspection pipeline itself. Option E is not relevant because Service Connection BGP keepalive intervals affect routing adjacency stability between Prisma Access and on-premises/service connections, not Threat Prevention inspection of remote user traffic.

Answer

Cloud Access Security Broker (CASB) API connector tokens

Answer

GlobalProtect user username-to-IP mapping agent status

Answer

Service Connection BGP peer keepalive intervals

Question 2

Which TWO troubleshooting methods are effective when verifying whether Host Information Profile (HIP) checks are operating correctly for Prisma Access mobile users? (Choose two)

Accepted Answer

Check GlobalProtect client settings in Panorama to ensure HIP report generation and submission intervals are correctly configured.. Option C is correct because HIP checks on Prisma Access mobile users depend on the GlobalProtect client generating and submitting HIP reports, and those behaviors are governed by the HIP report generation and submission interval settings configured in the GlobalProtect agent settings in Panorama; verifying these settings confirms the client is actually sending HIP data for evaluation. Option D is correct because the Monitor > Logs > HIP Match log records the results of HIP-based compliance evaluations, showing which HIP profiles matched or failed for each user/device, which is the direct way to verify that HIP checks are operating correctly. Option A is incorrect because NAT policy rules only affect address translation and have no bearing on HIP report generation or evaluation. Option B is incorrect because restarting a physical branch firewall is irrelevant to Prisma Access mobile user HIP checks, which are enforced in the Prisma Access cloud infrastructure. Option E is incorrect because updating the URL Filtering database affects web content inspection, not HIP check functionality.

Answer

Modify the NAT policy rules.

Answer

Restart the physical branch firewall.

Answer

Update the URL Filtering database.

Question 3

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

Accepted Answer

Prisma Access plugin. The Prisma Access plugin must be installed on Panorama to enable the Prisma Access configuration workflows, including onboarding, tenant management, and pushing security policy to the Prisma Access cloud infrastructure. Without this plugin, Panorama cannot manage Prisma Access nodes or service connections. It is the required integration component for Panorama-managed Prisma Access deployments.

Answer

SD-WAN plugin

Answer

VM-Series plugin

Answer

Cortex Data Lake plugin

Question 4

An administrator is troubleshooting a Prisma Access explicit proxy deployment where users report that specific web applications are failing with connection timeout errors. Which THREE areas should the administrator check? (Choose three)

Accepted Answer

Inspect Proxy Authentication and Decryption profiles to ensure authentication challenges are correctly processed.. Option A is correct because in a Prisma Access explicit proxy deployment, Proxy Authentication and Decryption profiles determine how the firewall handles authentication challenges and SSL decryption; if these are misconfigured, the proxy may silently drop or fail to respond to the client's CONNECT/GET requests, producing connection timeouts. Option C is correct because Security Policy rules must explicitly permit traffic to the explicit proxy listener ports (for example, TCP 8080) on the Prisma Access proxy; if the policy denies or does not match that traffic, sessions time out before reaching the proxy service. Option D is correct because the explicit proxy port and proxy profile configured on Prisma Access must match the port and PAC file/browser settings on the client; a mismatch means the browser sends requests to a port the proxy is not listening on, resulting in connection timeouts. Option B is not relevant because BGP AS numbers apply to Service Connection routing and do not affect explicit proxy listener behavior or client proxy sessions. Option E is not relevant because GlobalProtect pre-logon timeout pertains to GlobalProtect remote access tunnels, not to explicit proxy web traffic.

Answer

Verify the BGP AS number on the Service Connection.

Answer

Check the GlobalProtect client pre-logon timeout value.

Question 5

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

Accepted Answer

A SaaS security policy rule that identifies the application and applies the allow or block action.. SaaS security policies are the Prisma Access mechanism for identifying SaaS applications and enforcing sanctioned versus unsanctioned behavior. They allow the administrator to permit and inspect approved SaaS applications for data patterns while blocking unsanctioned ones, which matches the team's requirement precisely.

Answer

A decryption policy that decrypts all SSL traffic to SaaS applications.

Answer

A URL filtering profile that categorizes SaaS domains and applies block or allow actions.

Answer

A security policy rule using application filters for all web-browsing traffic.

Question 6

An administrator is configuring Prisma Access for mobile users and wants to ensure that all traffic to and from the internet is inspected by the Secure Web Gateway (SWG) service. The administrator has enabled the SWG license and configured a security policy rule to allow web traffic. However, users report that they can access malicious websites that should be blocked. What is the most likely missing configuration?

Accepted Answer

The security policy rule does not have a URL Filtering profile attached to it.. To block malicious websites, a URL Filtering profile must be attached to the security policy rule that allows web traffic. The SWG license enables the service, but enforcement requires the profile. Without it, the rule allows all web traffic without inspection, letting users access malicious sites. Attaching a URL Filtering profile with appropriate categories blocked resolves the issue.

Answer

The mobile users are not assigned to the correct security zone in the Prisma Access configuration.

Answer

The GlobalProtect portal configuration does not include the SWG gateway address.

Answer

The SWG license is not activated on the Prisma Access tenant.

Question 7

An enterprise deployment of Prisma Access utilizes Kerberos authentication for mobile users. Users report frequent authentication prompt failures when connecting via GlobalProtect from external networks. What is the most likely root cause of Kerberos authentication failure in this scenario?

Accepted Answer

Lack of direct network line-of-sight or routing from the mobile user's remote location to the internal Active Directory Domain Controllers via a Service Connection.. Kerberos requires the client to reach a Key Distribution Center (KDC) — typically an internal Active Directory Domain Controller — to obtain a Ticket Granting Ticket. A mobile user on an external network has no direct line-of-sight to internal DCs unless Prisma Access provides a Service Connection with routing to those DCs. Without that path, the Kerberos exchange cannot complete, causing authentication prompt failures.

Answer

WildFire cloud subscription has expired.

Answer

The decryption policy is missing an inbound rule.

Answer

The GlobalProtect client software license is invalid.

Question 8

An administrator is troubleshooting a Prisma Access mobile user environment where users are unable to connect because of an invalid certificate error presented by the GlobalProtect Portal. Which configuration element in Panorama should be verified?

Accepted Answer

Verify that the SSL/TLS certificate assigned to the GlobalProtect Portal configuration is valid, not expired, and trusted by the client devices.. The GlobalProtect Portal presents an SSL/TLS certificate to connecting clients during the portal handshake. If that certificate is expired, self-signed without a trusted chain, or has a mismatched CN/SAN, clients will reject the connection with an invalid certificate error before any tunnel or authentication occurs. The correct remediation is to verify the certificate assigned under Panorama > Cloud Services > Prisma Access > GlobalProtect Portal configuration is valid and trusted by the endpoints.

Answer

Check the IPsec crypto profile under Network > Network Profiles > IPsec Crypto.

Answer

Check the User-ID agent connection timeout settings.

Answer

Verify the BGP AS number on the Remote Network node.

Question 9

A Prisma Access administrator is troubleshooting a remote network deployment where users experience intermittent connectivity failures. The administrator notices that the IPsec tunnel frequently flaps. Which component should the administrator check to determine if the tunnel is being renegotiated due to mismatched proposal settings?

Accepted Answer

The IKE and IPsec crypto profiles on both the branch CPE and the Prisma Access service connection.. Intermittent IPsec tunnel flaps are typically caused by mismatched crypto profiles or proposal settings. The IKE and IPsec crypto profiles must align on both the branch CPE and the Prisma Access service connection. Verifying these profiles ensures that the tunnel parameters match, preventing renegotiation failures. GlobalProtect portal, security policies, and DNS proxy settings do not impact tunnel negotiation and are not relevant to this issue.

Answer

The security policy rules applied to the remote network traffic.

Answer

The DNS proxy settings on the service connection.

Answer

The GlobalProtect portal configuration for mobile users.

Question 10

Which TWO actions should an administrator take when troubleshooting an IPsec site-to-site tunnel failure between a customer CPE device and a Prisma Access Remote Network node? (Choose two)

Accepted Answer

Verify that IKE Phase 1 and Phase 2 proposal parameters (encryption, authentication, Diffie-Hellman groups) match between the CPE and Prisma Access node.. Option C is correct because an IPsec site-to-site tunnel requires the IKE Phase 1 (ISAKMP) and Phase 2 (IPsec) proposals to be identical on both peers, including encryption algorithms (e.g., AES-256), authentication/hash (e.g., SHA-256), Diffie-Hellman groups (e.g., group 14), and lifetimes; any mismatch in these parameters causes the IKE negotiation to fail before the tunnel establishes. Option E is correct because Panorama collects the Prisma Access Remote Network node's System logs and operational IKE/IPsec logs, which record the exact negotiation failure reason (e.g., NO_PROPOSAL_CHOSEN, INVALID_KE_PAYLOAD, or phase-1/phase-2 mismatch), allowing the administrator to pinpoint the fault. Option A is not relevant because the mobile user SAML authentication profile applies to GlobalProtect user authentication, not to the IKE pre-shared-key or certificate authentication used by a site-to-site tunnel. Option B is not appropriate because disabling security policy rules does not affect IKE/IPsec tunnel establishment and would unnecessarily remove enforcement across all remote locations. Option D is not relevant because the GlobalProtect agent runs on remote user endpoints and has no role in a CPE-to-Prisma Access Remote Network IPsec tunnel.

Answer

Reconfigure the mobile user SAML authentication profile.

Answer

Disable all security policy rules across all remote locations.

Answer

Restart the GlobalProtect agent on all remote user endpoints.