SSE-Engineer Practice Test 7 — 10 Questions

Question 1

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 2

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

Accepted Answer

Attach appropriate Security Profiles (such as Antivirus, Anti-Spyware, and Vulnerability Protection) to all active Security Policy allow rules.. Option C is correct because every Security Policy allow rule in Prisma Access should have Security Profiles attached (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire, and File Blocking as applicable) so that permitted traffic is inspected for threats rather than simply passed; without profiles, allowed sessions receive no content inspection. Option D is correct because App-ID and User-ID provide identity- and application-aware enforcement, allowing rules to match actual applications (including those using non-standard ports or SSL) and specific users/groups, which is far more precise and secure than legacy IP-and-port matching. Option E is correct because Panorama evaluates rules top-down, so specific allow rules must precede broad general rules to avoid being shadowed, and explicit deny rules for known malicious traffic provide deterministic blocking and clearer logging than relying on implicit deny. Option A is not correct because disabling SSL Decryption globally would blind inspection to encrypted threats and is not a performance best practice; decryption should be scoped selectively. Option B is not correct because using 'Any' application in Security Policy rules defeats App-ID visibility and control, weakens security, and is discouraged even though it may reduce rule count.

Answer

Disable SSL Decryption globally to maximize Prisma Access processing throughput across all mobile user nodes.

Answer

Configure all Security Policy rules to use 'Any' application to simplify rule maintenance and reduce rule count.

Question 3

An administrator is configuring Prisma Access for the first time and needs to onboard the Prisma Access infrastructure. Which step must be completed before configuring Remote Networks and Service Connections?

Accepted Answer

Activate the Prisma Access license and allocate the infrastructure. The first step in deploying Prisma Access is to activate the license and allocate the infrastructure. This provisions the cloud-based security processing nodes and network components. Only after this onboarding can Remote Networks, Service Connections, and other configurations be set up. Other tasks like GlobalProtect or BGP are part of subsequent configuration phases.

Answer

Set up a Panorama management server

Answer

Configure BGP peering with the customer's data center

Answer

Deploy a GlobalProtect portal and gateway

Question 4

An enterprise user reports that when connected to Prisma Access Mobile Users, certain internal applications load extremely slowly or fail to render images. Investigation reveals that packet fragmentation is occurring. Which Prisma Access setting should the administrator adjust to mitigate this fragmentation issue for mobile users?

Accepted Answer

Configure TCP MSS adjustment on the GlobalProtect tunnel settings or reduce the tunnel interface MTU.. TCP MSS adjustment (or lowering the tunnel interface MTU) is the correct fix because fragmentation on the GlobalProtect/Prisma Access tunnel occurs when the encapsulated packet exceeds the path MTU. By clamping TCP MSS on the tunnel or reducing the tunnel MTU, the endpoint negotiates a smaller segment size so packets fit inside the tunnel without fragmenting. This directly addresses the root cause of slow/failed rendering for mobile users.

Answer

Change the mobile user IP pool subnet mask from /24 to /16.

Answer

Disable WildFire file forwarding for large files.

Answer

Increase the decryption profile timeout value.

Question 5

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

Accepted Answer

In the Panorama GlobalProtect Client Settings configuration under Network Settings. In Prisma Access, the internal DNS servers that GlobalProtect clients use for corporate name resolution are defined in the GlobalProtect Client Settings configuration within Panorama, specifically under Network Settings (DNS Server fields). This pushes the primary and secondary DNS server IPs to the GlobalProtect agent so that split-tunnel DNS queries for internal domains are sent to corporate resolvers rather than the local ISP DNS.

Answer

In the Prisma SD-WAN DNS proxy forwarding table

Answer

Directly on the remote user local machine registry

Answer

In the cloud Managed Security Services Provider (MSSP) portal

Question 6

A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. They want to ensure that all web traffic is scanned for threats and that file downloads are restricted based on file type. Which Prisma Access service should they configure to achieve this?

Accepted Answer

Configure a Security Policy rule in Prisma Access with URL Filtering and File Blocking profiles applied to the remote network zone.. To inspect web traffic and restrict file downloads by type for remote networks, you need a Security Policy rule with URL Filtering and File Blocking profiles. These profiles are applied to the appropriate zone and provide the required control. WildFire detects malware but doesn't block by file type, Data Filtering is for DLP, and SaaS Security is limited to SaaS applications.

Answer

Set up a SaaS Security inline policy to control sanctioned SaaS applications.

Answer

Configure a Decryption policy to inspect SSL traffic and then apply a Data Filtering profile.

Answer

Enable WildFire inline ML on the remote network firewall to detect malicious files.

Question 7

An administrator is configuring a Remote Network in Prisma Access to connect a branch office. The branch office has a single ISP link and requires high availability. The administrator wants to ensure that if the primary IPSec tunnel fails, traffic automatically switches to a secondary tunnel. Which Prisma Access feature should be configured to achieve this?

Accepted Answer

Multiple IPSec tunnels with BGP. High availability for a Remote Network is achieved by configuring multiple IPSec tunnels and using BGP for route failover. BGP dynamically withdraws routes when a tunnel fails, directing traffic to the remaining tunnel. Policy-Based Forwarding, QoS, and Explicit Proxy do not provide this automatic failover capability.

Answer

Explicit Proxy

Answer

Policy-Based Forwarding

Answer

Quality of Service (QoS)

Question 8

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

Accepted Answer

URL Filtering log. The URL Filtering log in Prisma Access records every web-browsing session that matches a URL Filtering profile, including the URL category, the action taken (allow/block/continue/override), the user, and the source. This is the only log type that directly captures blocked URLs and category ratings for user web attempts.

Answer

Threat log

Answer

Data Filtering log

Answer

HIP Match log

Question 9

A Prisma Access administrator notices that a specific remote network tunnel shows as up, but the branch users cannot reach any internet destinations. The tunnel interface on the branch CPE is up, and the administrator can ping the Prisma Access service IP. Which log type on the Prisma Access side should the administrator review first to determine whether traffic is being dropped by a security policy?

Accepted Answer

Traffic logs. When a remote network tunnel is up but users cannot reach the internet, the immediate suspicion is a security policy misconfiguration or a routing issue. Traffic logs on Prisma Access capture session-level details, including the applied security rule and action. Reviewing them will show if traffic is being denied and by which rule, enabling quick remediation. System, threat, and HIP logs do not provide this policy enforcement visibility for remote network traffic.

Answer

System logs

Answer

HIP Match logs

Answer

Threat logs

Question 10

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks. Prisma Access remote networks and mobile user configurations are managed centrally through Panorama using the Cloud Services plugin.

Answer

Prisma Access App > Traffic Steering > Remote Networks

Answer

Policies > Security > Remote Networks

Answer

Device > Setup > Operations > Remote Networks