SSE-Engineer Practice Test 7 — 10 Questions

Question 1

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the IPsec tunnel status under Panorama > Cloud Services > Status > Remote Networks.. IPsec tunnel status can be validated via cloud status monitors and standard tunnel monitoring logs.

Answer

Inspect the GlobalProtect client runtime logs on the mobile user's laptop.

Answer

Check the DNS resolver settings in the local device setup tab.

Answer

Run a physical cable test from the Prisma Access cloud node to the carrier router.

Question 2

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Accepted Answer

Objects > Decryption > SSL Decryption Profile. SSL Decryption profiles govern cipher suites, minimum TLS versions, and handling of unsupported options.

Answer

Panorama > Cloud Services > Global Settings > Decryption

Answer

Device > Certificate Management > SSL Policy

Answer

Policies > Decryption > Settings

Question 3

An administrator is troubleshooting a scenario where remote users connected via Prisma Access Mobile Users cannot access a specific newly added subnet behind a Remote Network location. Which configuration check should the administrator perform first in Panorama?

Accepted Answer

Verify that Security Policy rules permit traffic from the Mobile Users zone to the Remote Networks zone, and that the remote subnet is included in the Remote Network configuration.. To allow communication between different Prisma Access access types (such as Mobile Users to Remote Networks), the administrator must ensure that inter-zone traffic is permitted and that routing/address spaces are properly advertised in Panorama.

Answer

Restart the Cloud Identity Engine agent on the domain controller to refresh IP-to-user mappings.

Answer

Reinstall the GlobalProtect agent on all remote user machines to update the gateway list.

Answer

Generate a new API key in Prisma Access Insights to force a routing table recalculation.

Question 4

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Accepted Answer

Configure Cloud Identity Engine (CIE) settings in Panorama to sync directory services.. The Cloud Identity Engine (CIE) acts as the directory sync mechanism to gather user and group mapping information for Prisma Access.

Answer

Configure a User-ID agent on every branch router.

Answer

Install the GlobalProtect agent with local syslog forwarding.

Answer

Enable captive portal authentication on all remote network firewalls.

Question 5

An administrator configures Decryption Policies in Prisma Access to inspect inbound traffic destined for internal applications published via Service Connections. Users report that certain internal web applications using custom internal Certificate Authorities (CAs) are failing TLS handshakes. Where should the administrator check and install the enterprise internal CA certificate to resolve this inspection issue?

Accepted Answer

Panorama > Certificate Management > Certificates, and ensure the internal CA is imported and trusted for SSL decryption.. For Prisma Access to successfully issue forward proxy certificates or trust internal servers during SSL decryption, the internal enterprise CA certificate must be imported into the Certificate Management store in Panorama and marked as a trusted root CA.

Answer

GlobalProtect Portal > Client Settings > Authentication, and push the CA via client configuration.

Answer

Cloud Identity Engine > Settings > Trusted Roots, and sync the certificate via LDAP.

Answer

Prisma Access Insights > Policies > Decryption, and toggle the 'Bypass Internal CA' switch.

Question 6

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Accepted Answer

Create HIP Objects and HIP Profiles in Panorama, then reference those profiles in Security Policy rules.. HIP data is gathered by the GlobalProtect agent, forwarded to Prisma Access, and then evaluated in Security Policy rules via HIP Objects and HIP Profiles.

Answer

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Answer

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Answer

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Question 7

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Accepted Answer

Monitor > ACC or the Prisma Access App dashboard. The Prisma Access monitoring app and Panorama's ACC provide real-time dashboards for mobile user connectivity.

Answer

Policies > Security > Status

Answer

Network > GlobalProtect > Runtime

Answer

Device > Status > Active Users

Question 8

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

Accepted Answer

A valid public IP address and a pre-shared key matching the IKE gateway configuration defined in Panorama.. To establish a secure IPsec tunnel between a branch office and Prisma Access, the branch office router must be configured with a public IP address, support IKEv2, and use a pre-shared key or certificate matching the Panorama Remote Networks configuration.

Answer

The GlobalProtect app configured in manual gateway connection mode.

Answer

An active Prisma Access Insights API token for dynamic routing updates.

Answer

The Cloud Identity Engine agent installed locally on the branch router's operating system.

Question 9

When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?

Accepted Answer

Panorama Administrator role with Cloud Services plugin permissions. Administrators require appropriate Panorama roles with permissions to commit and push changes to Cloud Services templates and device groups.

Answer

Network Administrator without Cloud Services access

Answer

Prisma Cloud Administrator

Answer

GlobalProtect Read-Only Operator

Question 10

A network administrator needs to verify that the QoS (Quality of Service) settings applied to Prisma Access mobile users are prioritizing real-time voice and video traffic correctly. Where are QoS profiles applied in the Prisma Access configuration hierarchy in Panorama?

Accepted Answer

Panorama -> Cloud Services -> Configuration -> QoS Policy. QoS profiles in Prisma Access are applied within the QoS policy rules and associated with the Cloud Services mobile user or remote network configuration to prioritize traffic classes.

Answer

Objects -> QoS Profiles -> Global

Answer

GlobalProtect Portal -> Client Settings -> QoS

Answer

Network -> Interfaces -> Tunnel -> QoS