SSE-Engineer Practice Questions 2 — 50 Questions

Question 1

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 2

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

Accepted Answer

Continuous Trust Verification via periodic Host Information Profile (HIP) re-evaluation and app-connector telemetry. ZTNA 2.0 in Prisma Access enforces continuous trust verification by re-evaluating device posture (HIP checks) and user context periodically during active sessions, cutting off access if conditions change.

Answer

Pre-logon GlobalProtect connection mode

Answer

Explicit proxy PAC file auto-discovery

Answer

RADIUS single sign-on (SSO) integration with Multi-Factor Authentication

Question 3

A remote network user in a Prisma Access deployment is experiencing intermittent packet loss and slow application performance over the IPsec tunnel to the Remote Network (RN) node. Upon checking the system logs, the network engineer notices repetitive IKE rekey negotiations. Which troubleshooting step should be taken first to identify the root cause?

Accepted Answer

Verify that Dead Peer Detection (DPD) intervals match between the CPE device and Prisma Access node, and check tunnel monitoring statistics.. Checking the IPsec and IKE tunnel status via the Prisma Access CLI or Panorama status monitor helps identify cryptographic mismatch or dead peer detection (DPD) timeouts causing flapping.

Answer

Disable SSL decryption on the Security Predefined Policy.

Answer

Change the mobile user portal authentication profile.

Answer

Restart the GlobalProtect service on the remote user's endpoint.

Question 4

An enterprise requires their mobile users to use a Secure Web Gateway (SWG) service that intercepts all web traffic without requiring explicit browser proxy configurations on each client machine. Which Prisma Access deployment method meets this requirement transparently?

Accepted Answer

GlobalProtect client in transparent tunnel mode forwarding traffic to Prisma Access SWG. Prisma Access transparently intercepts web traffic from mobile users via the GlobalProtect app operating in layer-3 tunnel mode, eliminating the need for PAC files or manual proxy settings.

Answer

GRE tunnel forwarding from local ISP routers

Answer

Static NAT configuration on the branch office gateway

Answer

GlobalProtect client in explicit proxy mode

Question 5

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. BGP troubleshooting requires verifying peer IP addresses, AS numbers, authentication keys, and network prefix advertisements.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 6

Which TWO configuration steps should an administrator verify when troubleshooting an issue where Panorama cannot push updates or configurations to Prisma Access nodes? (Choose two)

Accepted Answer

Check Panorama > Job Status to review specific error codes and failed configuration push tasks.. Troubleshooting Panorama-to-Prisma Access communication involves checking management plane connectivity, service setup status, and job status error messages.

Answer

Restart the CPE device at the branch office.

Answer

Update the URL Filtering database manually.

Answer

Modify the NAT policy rules on the remote firewall.

Question 7

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Accepted Answer

Device > Server Profiles > SAML Identity Provider. SAML identity provider server profiles are configured in Panorama under Device or Server Profiles before being assigned to GlobalProtect authentication profiles.

Answer

Network > GlobalProtect > Portal > Authentication

Answer

Panorama > Cloud Services > Authentication > SAML

Answer

Objects > Cloud Identity Engine > SAML

Question 8

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

LDAP directory authentication. Prisma Access supports multiple authentication mechanisms including SAML 2.0 and LDAP/RADIUS via authentication profiles.

Answer

Local database accounts stored on the individual Prisma Access cloud nodes

Answer

WPA3 Enterprise 802.1X enterprise tunneling

Answer

IPsec Pre-Shared Key user authentication

Question 9

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

Accepted Answer

In the Panorama Security Policy rule matching the traffic.. Security Profiles must be attached to the Security Policy rules that govern the specific traffic flow.

Answer

In the GlobalProtect Gateway settings.

Answer

In the Service Connection configuration.

Answer

In the Cloud Identity Engine configuration.

Question 10

An enterprise is planning a Prisma Access Remote Networks deployment with overlapping RFC 1918 IP address spaces across several acquired branch offices. Which Prisma Access feature must the architect implement to successfully route traffic without changing the local branch IP schemes?

Accepted Answer

Source NAT (SNAT) configured for Remote Networks traffic. Source NAT (SNAT) or Network Address Translation mechanisms must be used to handle overlapping IP spaces when connecting multiple remote networks to Prisma Access.

Answer

Destination NAT rules on the Service Connections

Answer

GRE tunneling with static default routes

Answer

BGP AS-Path Prepending across all branch tunnels

Question 11

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Accepted Answer

Check the IPsec tunnel status under Panorama > Cloud Services > Status > Remote Networks.. IPsec tunnel status can be validated via cloud status monitors and standard tunnel monitoring logs.

Answer

Inspect the GlobalProtect client runtime logs on the mobile user's laptop.

Answer

Check the DNS resolver settings in the local device setup tab.

Answer

Run a physical cable test from the Prisma Access cloud node to the carrier router.

Question 12

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Accepted Answer

Objects > Decryption > SSL Decryption Profile. SSL Decryption profiles govern cipher suites, minimum TLS versions, and handling of unsupported options.

Answer

Panorama > Cloud Services > Global Settings > Decryption

Answer

Device > Certificate Management > SSL Policy

Answer

Policies > Decryption > Settings

Question 13

An administrator is troubleshooting a scenario where remote users connected via Prisma Access Mobile Users cannot access a specific newly added subnet behind a Remote Network location. Which configuration check should the administrator perform first in Panorama?

Accepted Answer

Verify that Security Policy rules permit traffic from the Mobile Users zone to the Remote Networks zone, and that the remote subnet is included in the Remote Network configuration.. To allow communication between different Prisma Access access types (such as Mobile Users to Remote Networks), the administrator must ensure that inter-zone traffic is permitted and that routing/address spaces are properly advertised in Panorama.

Answer

Restart the Cloud Identity Engine agent on the domain controller to refresh IP-to-user mappings.

Answer

Reinstall the GlobalProtect agent on all remote user machines to update the gateway list.

Answer

Generate a new API key in Prisma Access Insights to force a routing table recalculation.

Question 14

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Accepted Answer

Configure Cloud Identity Engine (CIE) settings in Panorama to sync directory services.. The Cloud Identity Engine (CIE) acts as the directory sync mechanism to gather user and group mapping information for Prisma Access.

Answer

Configure a User-ID agent on every branch router.

Answer

Install the GlobalProtect agent with local syslog forwarding.

Answer

Enable captive portal authentication on all remote network firewalls.

Question 15

An administrator configures Decryption Policies in Prisma Access to inspect inbound traffic destined for internal applications published via Service Connections. Users report that certain internal web applications using custom internal Certificate Authorities (CAs) are failing TLS handshakes. Where should the administrator check and install the enterprise internal CA certificate to resolve this inspection issue?

Accepted Answer

Panorama > Certificate Management > Certificates, and ensure the internal CA is imported and trusted for SSL decryption.. For Prisma Access to successfully issue forward proxy certificates or trust internal servers during SSL decryption, the internal enterprise CA certificate must be imported into the Certificate Management store in Panorama and marked as a trusted root CA.

Answer

GlobalProtect Portal > Client Settings > Authentication, and push the CA via client configuration.

Answer

Cloud Identity Engine > Settings > Trusted Roots, and sync the certificate via LDAP.

Answer

Prisma Access Insights > Policies > Decryption, and toggle the 'Bypass Internal CA' switch.

Question 16

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Accepted Answer

Create HIP Objects and HIP Profiles in Panorama, then reference those profiles in Security Policy rules.. HIP data is gathered by the GlobalProtect agent, forwarded to Prisma Access, and then evaluated in Security Policy rules via HIP Objects and HIP Profiles.

Answer

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Answer

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Answer

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Question 17

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Accepted Answer

Monitor > ACC or the Prisma Access App dashboard. The Prisma Access monitoring app and Panorama's ACC provide real-time dashboards for mobile user connectivity.

Answer

Policies > Security > Status

Answer

Network > GlobalProtect > Runtime

Answer

Device > Status > Active Users

Question 18

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

Accepted Answer

A valid public IP address and a pre-shared key matching the IKE gateway configuration defined in Panorama.. To establish a secure IPsec tunnel between a branch office and Prisma Access, the branch office router must be configured with a public IP address, support IKEv2, and use a pre-shared key or certificate matching the Panorama Remote Networks configuration.

Answer

The GlobalProtect app configured in manual gateway connection mode.

Answer

An active Prisma Access Insights API token for dynamic routing updates.

Answer

The Cloud Identity Engine agent installed locally on the branch router's operating system.

Question 19

When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?

Accepted Answer

Panorama Administrator role with Cloud Services plugin permissions. Administrators require appropriate Panorama roles with permissions to commit and push changes to Cloud Services templates and device groups.

Answer

Network Administrator without Cloud Services access

Answer

Prisma Cloud Administrator

Answer

GlobalProtect Read-Only Operator

Question 20

A network administrator needs to verify that the QoS (Quality of Service) settings applied to Prisma Access mobile users are prioritizing real-time voice and video traffic correctly. Where are QoS profiles applied in the Prisma Access configuration hierarchy in Panorama?

Accepted Answer

Panorama -> Cloud Services -> Configuration -> QoS Policy. QoS profiles in Prisma Access are applied within the QoS policy rules and associated with the Cloud Services mobile user or remote network configuration to prioritize traffic classes.

Answer

Objects -> QoS Profiles -> Global

Answer

GlobalProtect Portal -> Client Settings -> QoS

Answer

Network -> Interfaces -> Tunnel -> QoS