SSE-Engineer Practice Test 8 — 10 Questions

Question 1

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Accepted Answer

Panorama > Cloud Services > Configuration > Mobile Users > Client Settings. GlobalProtect client settings, including primary and secondary DNS servers assigned to mobile users, are configured within the GlobalProtect Client Settings in Panorama.

Answer

Objects > GlobalProtect > DNS Profile

Answer

Device > Setup > Services > DNS

Answer

Network > GlobalProtect > Gateway > DNS

Question 2

An administrator is planning a Prisma Access deployment and needs to configure Service Connections to connect the enterprise data center to the cloud. Which TWO requirements must be met for a successful BGP peering session over a Service Connection? (Choose two)

Accepted Answer

Ensure the advertised BGP routes do not overlap with Prisma Access internal reserved subnets. Service Connections require a valid BGP Autonomous System Number (ASN) and proper IP subnet addressing that does not conflict with Prisma Access reserved ranges.

Answer

Deploy a physical hardware firewall inside the AWS cloud VPC

Answer

Configure LACP active-active bonding on the Service Connection tunnel interfaces

Answer

Enable static default routing without configuring any routing protocols

Question 3

An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?

Accepted Answer

Monitor -> Logs -> Authentication. Prisma Access status and operational logs related to user authentication and SAML can be monitored via Panorama operational commands and SaaS / User-ID status dashboards.

Answer

Monitor -> Traffic -> Session End

Answer

Objects -> Authentication -> SAML Test

Answer

Panorama -> Cloud Services -> Health -> Infrastructure

Question 4

A Prisma Access administrator notices that remote network traffic destined for another remote network (branch-to-branch traffic) is being dropped or failing to establish. What is the required configuration to allow branch-to-branch traffic?

Accepted Answer

Enable 'Branch-to-Branch' routing under Panorama > Cloud Services > Configuration > Remote Networks and create matching security rules.. By default, branch-to-branch traffic in Prisma Access must be explicitly allowed in the Prisma Access traffic steering and security policy configurations.

Answer

Configure static routes pointing to the loopback interface on every remote network gateway.

Answer

Enable GlobalProtect Clientless VPN on all remote network gateways.

Answer

Deploy dedicated external hardware firewalls at each branch location.

Question 5

Which component in Prisma Access is responsible for performing decryption, content inspection, and threat prevention for mobile users?

Accepted Answer

Compute Location. The Service Connection is for branch-to-datacenter traffic, while the Compute Location handles the actual inspection for mobile users.

Answer

GlobalProtect Portal

Answer

Service Connection

Answer

Panorama

Answer

Cloud Identity Engine

Question 6

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

Accepted Answer

In the Panorama GlobalProtect Client Settings configuration under Network Settings. DNS server IPs for remote users are configured in the GlobalProtect client configuration within Panorama under Cloud Services > Configuration > Users > GlobalProtect.

Answer

In the Prisma SD-WAN DNS proxy forwarding table

Answer

Directly on the remote user local machine registry

Answer

In the cloud Managed Security Services Provider (MSSP) portal

Question 7

An administrator is troubleshooting a HIP (Host Information Profile) check failure for mobile users. Where can the administrator view the collected HIP reports and check compliance status in real-time?

Accepted Answer

Monitor > Logs > HIP Matches. HIP check data and reports for connected mobile users can be inspected via the Panorama operational commands or ACC/Monitor tabs.

Answer

Device > Certificate Management > HIP

Answer

Panorama > Cloud Services > Status > HIP

Answer

GlobalProtect > Gateway > Agent > HIP Objects

Question 8

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Accepted Answer

Antivirus and Anti-Spyware profiles. Antivirus and Anti-Spyware profiles inspect traffic passing through security rules for known malware and command-and-control signatures.

Answer

Decryption profile and URL filtering profile only

Answer

QoS Profile and Zone Protection profile

Answer

HIP Profile and WildFire analysis profile

Question 9

An administrator wants to configure Prisma Access Secure Web Gateway to block access to sites categorized as 'Gambling' during working hours, but allow them during lunch breaks. Which Panorama feature enables time-based policy enforcement?

Accepted Answer

Schedule Objects applied to Security Policy rules. Schedule objects in Panorama can be applied to Security Policy rules to enforce rules only during specified days and times.

Answer

Prisma Access Insights time-window filters

Answer

URL Filtering custom time-out profiles

Answer

GlobalProtect Portal connection timers

Question 10

A security analyst is investigating a Prisma Access FWaaS alert indicating a brute-force attack against an internal server published via a Service Connection. Which security profile should be tuned to detect and block this network-layer attack signature?

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection profiles inspect network traffic for known exploit signatures, including brute-force attempts and protocol anomalies.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

URL Filtering Profile