SSE-Engineer Practice Questions 1 — 50 Questions

Question 1

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use destination-based security policy rules that reference the production and development subnets as separate destination addresses. Prisma Access security policy rules can match on destination addresses, so the administrator can write separate rules for production and development subnets. This provides distinct inspection and enforcement for each workload type while reusing a single Service Connection, meeting the requirement without adding tunnels or on-premises changes.

Answer

Configure policy-based forwarding on the Service Connection

Answer

Create separate Service Connections for production and development subnets

Answer

Apply different decryption profiles to the Service Connection tunnel

Question 2

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Accepted Answer

Objects -> Security Profiles -> DNS Security. DNS Security profiles are attached to Security Policy rules in Panorama to inspect and take action on DNS requests.

Answer

Policies -> NAT

Answer

Panorama -> Cloud Services -> GlobalProtect -> DNS

Answer

Network Services -> DNS Proxy

Question 3

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Accepted Answer

Create HIP Objects and HIP Profiles in Panorama, then reference those profiles in Security Policy rules.. HIP enforcement in Prisma Access requires creating HIP Objects (which define the check, e.g., antimalware presence/version) and HIP Profiles (which combine objects into a logical condition), then referencing the HIP profile in Security Policy rules. This is the standard Panorama workflow for endpoint compliance gating. Without the profile referenced in policy, HIP data is collected but not enforced.

Answer

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Answer

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Answer

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Question 4

An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?

Accepted Answer

SSL Decryption policy with a Forward Trust certificate. To accurately identify and control SaaS applications that use domain fronting and complex URL structures, the administrator must enable SSL Decryption with a Forward Trust certificate. Decryption allows the firewall to see the actual SNI and HTTP Host header, enabling the CASB inline policy to correctly identify the application and apply controls. Without decryption, domain fronting hides the true destination.

Answer

Quality of Service (QoS) profile for SaaS acceleration

Answer

User-ID agent mapping via LDAP integration

Answer

DNS Security with external recursive resolver redirection

Question 5

A Prisma Access mobile user connects successfully via GlobalProtect but cannot reach any internal applications hosted behind a Service Connection. The administrator confirms the Service Connection status is green and the user's HIP profile is compliant. Which log source should the administrator check first to verify that the user's traffic is being routed through the expected Service Connection?

Accepted Answer

Traffic logs filtered by the user and destination. Traffic logs are the authoritative source for verifying session-level routing in Prisma Access. They include fields such as source user, destination, and the Service Connection or egress interface used. By filtering on the mobile user and the internal application IP, the administrator can see whether the traffic is being sent through the expected Service Connection or being dropped, which directly diagnoses the issue.

Answer

GlobalProtect App logs on the endpoint

Answer

HIP match logs in the Prisma Access gateway

Answer

System logs on the Prisma Access portal

Question 6

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. Option B is correct because, to enforce group-based policy in Prisma Access, Panorama must have Group Mapping Settings that point to the Cloud Identity Engine as the directory source so it can resolve user-to-group memberships for policy matching. Option D is correct because an Authentication Profile in Panorama must reference the Cloud Identity Engine container so that user authentication requests are validated against the CIE directory service, enabling User-ID to associate authenticated users with their groups. Option A is incorrect because disabling MFA is not required and would weaken security; MFA can coexist with CIE-based authentication. Option C is incorrect because installing GlobalProtect on domain controllers is unnecessary and inappropriate; CIE connects to directory services via APIs/connectors, not by running the agent on domain controllers. Option E is incorrect because manual CSV uploads are not part of CIE integration and do not provide the real-time group mapping that CIE delivers.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 7

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

Accepted Answer

GlobalProtect app logs on the endpoint. GlobalProtect app logs on the endpoint are the best source to verify which DNS servers the client is using. They record the DNS settings received from the gateway, including split-DNS domains and the corresponding DNS servers. By examining these logs, the administrator can confirm whether internal domains are being resolved by the correct internal DNS server or if they are incorrectly sent to an external DNS server.

Answer

System logs on the Prisma Access portal

Answer

HIP match logs in the Prisma Access gateway

Answer

Traffic logs filtered by DNS application

Question 8

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

Accepted Answer

Service health and status of cloud infrastructure and tunnels. Prisma Access Insights provides visibility into service health, license utilization, active user counts, and bandwidth consumption across locations.

Answer

Individual endpoint user Windows registry configurations

Answer

Local branch switch port VLAN configurations

Question 9

An administrator is troubleshooting a Prisma Access mobile user environment where users report that authentication via RADIUS is failing. Where should the administrator check for RADIUS communication errors and timeout events in Panorama?

Accepted Answer

Monitor > Logs > System or Authentication logs in Panorama.. RADIUS authentication failures and timeouts are logged in the System and Authentication logs in Panorama (Monitor > Logs). These logs capture the authentication request, response, and any timeout or communication errors with the RADIUS server. This is the correct place to diagnose the failure.

Answer

Policies > NAT.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > Threat.

Question 10

An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?

Accepted Answer

Enable BGP on the Service Connection and specify the peer AS and peer IP address.. For BGP peering over a Service Connection, you must enable BGP and provide the peer AS and peer IP address. This allows dynamic route exchange with the on-premises router, which uses a private AS number. Prisma Access supports BGP over Service Connections, and this configuration ensures proper routing and failover for traffic destined to on-premises resources.

Answer

Configure a static route to the on-premises network.

Answer

Set up an IPSec tunnel with BGP over it.

Answer

Configure OSPF on the Service Connection.

Question 11

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 12

An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?

Accepted Answer

The Security Policy rule allowing traffic from mobile users to the Service Connection zone is missing or misconfigured.. The most likely cause is a missing or misconfigured Security Policy rule allowing traffic from mobile users to the Service Connection zone. Even if the Service Connection is up and routing is correct, without an explicit allow rule, traffic is blocked by default. Split tunnel, route advertisement, and DNS are less likely given the described symptoms.

Answer

The Service Connection's tunnel interface is not advertising the application's subnet to Prisma Access.

Answer

The mobile user's DNS is not resolving the application's FQDN to the correct IP address.

Answer

The mobile user's GlobalProtect app is not configured to include the application's subnet in the split tunnel.

Question 13

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. Option A is correct because BGP peering requires the AS numbers to be properly configured: for eBGP the local and remote AS must differ and match each side's configured peer AS, while for iBGP both peers must use the same AS, so a mismatch prevents the session from establishing and routes from being learned. Option B is correct because even with an established session, Prisma Access will not learn any prefixes unless the CPE actually advertises them via BGP network or redistribute statements, so confirming the advertised prefixes is essential. Option D is correct because the BGP peer IP configured on Prisma Access must exactly match the CPE's BGP source/peer address (and vice versa) for the TCP session on port 179 to form; a mismatch means no peering and no route exchange. Option C is not relevant because WildFire cloud analysis is a threat-detection subscription and has no bearing on BGP route learning. Option E is not relevant because GlobalProtect portal SSL certificate expiration affects remote-user VPN authentication, not Remote Network BGP peering.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 14

An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?

Accepted Answer

Traffic logs. Traffic logs are the most comprehensive source for troubleshooting access issues in Prisma Access. They record session details including the matching security policy rule, the action, and the reason for denial. This allows administrators to quickly identify if a security policy is blocking access to a private application. Other log types focus on specific security events and do not provide the same level of detail for policy enforcement.

Answer

URL filtering logs

Answer

Data filtering logs

Answer

Threat logs

Question 15

When troubleshooting a Prisma Access issue, an engineer needs to generate a Tech Support File (TSF) specifically for the Prisma Access cloud infrastructure. Where is this option located in Panorama?

Accepted Answer

Panorama > Cloud Services > Setup > Support.. TSFs for Prisma Access can be generated under Panorama > Cloud Services > Setup > Support.

Answer

Device > Support > Tech Support File.

Answer

Monitor > Logs > System.

Answer

Policies > Security.

Question 16

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

Accepted Answer

The GlobalProtect app logs on the user's endpoint, looking for tunnel disconnect and reconnect events.. Intermittent loss of all applications for a few seconds suggests the GlobalProtect tunnel is flapping. The GlobalProtect app logs on the endpoint record tunnel state changes, including disconnects and reconnects. These logs provide the necessary detail to confirm flapping and identify patterns, such as timeouts or network changes. Other tools lack the per-user tunnel state history.

Answer

The Prisma Access system logs, filtering for GlobalProtect gateway events.

Answer

The Prisma Access dashboard's GlobalProtect status page, checking the number of connected users.

Answer

The traffic logs, filtering for denied sessions from the mobile user's IP address.

Question 17

When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)

Accepted Answer

App-ID based security policies that explicitly name specific internal applications rather than subnets. Option D is correct because ZTNA 2.0 in Prisma Access enforces least-privileged access through App-ID based security policies that identify specific internal applications (e.g., 'web-app-finance' or 'ssh-server-01') instead of broad subnet ranges, so only the intended application is reachable. Option E is correct because App Connectors are the mandatory component deployed inside the internal network that host the private applications; they establish outbound-initiated tunnels to Prisma Access and publish those apps to the service, enabling per-app access without exposing the network. The other options are not required: PPTP is a deprecated, insecure legacy VPN protocol and is not part of ZTNA 2.0 (A); PAC files are a proxy auto-configuration mechanism for web traffic, not a ZTNA private-app access requirement (B); and assigning public IP addresses to every internal workstation is unnecessary and contrary to ZTNA principles, since App Connectors and the Prisma Access infrastructure handle connectivity without exposing endpoints (C).

Answer

Legacy PPTP VPN dial-in server integration

Answer

Explicit PAC files distributed to all internal users

Answer

Public IP addresses assigned to every internal workstation

Question 18

An administrator notices that users connecting via Prisma Access Remote Networks are unable to reach a specific internal application hosted in the corporate datacenter. The traffic is dropped by Prisma Access. Which tool in Panorama should the administrator use first to verify if the security policy is matching and blocking the traffic in real-time?

Accepted Answer

Traffic Logs with a filter for the source user and destination IP, checking the 'Drop Reason' field.. Traffic Logs in Panorama are the authoritative source for confirming whether a session was allowed or denied by security policy, and the 'Drop Reason' field explicitly identifies policy-based drops (e.g., 'policy-deny', 'rule match'). Filtering by source user and destination IP isolates the specific flow in question and shows the matching rule in real time. This directly answers whether the security policy is the cause of the drop.

Answer

GlobalProtect app diagnostics tab on the endpoint.

Answer

Prisma Access Insight path quality monitoring.

Answer

Panorama Dynamic Updates status page.

Question 19

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 20

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

Accepted Answer

Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users.. Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users provides regional status and cloud infrastructure metrics for Prisma Access. This feature shows the health, performance, and status of Prisma Access nodes across different regions, allowing administrators to identify latency or disconnection issues tied to a specific location. It is the centralized monitoring point for regional infrastructure health.

Answer

Policies > QoS > Bandwidth Management.

Answer

Device > High Availability.

Answer

Monitor > Traffic > GlobalProtect Analytics.