SSE-Engineer Practice Test 8 — 10 Questions

Question 1

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BGP or static route redistribution settings that control which prefixes are advertised to Prisma Access. Reachability of internal applications through a Service Connection depends on the routes Prisma Access knows about. Administrators must confirm the static or summarized routes listed on the Service Connection and the redistribution settings that determine which prefixes are advertised. Missing or filtered routes cause intermittent or partial reachability, which matches the reported behavior.

Answer

The SSL decryption profile applied to the Service Connection

Answer

The IKEv2 pre-shared key used by the Service Connection tunnel

Answer

The GlobalProtect portal agent configuration for the London region

Question 2

An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)

Accepted Answer

BGP peer AS number and peering IP addresses for dynamic route exchange.. Option B is correct because a Prisma Access Service Connection uses BGP to exchange routes between the corporate data center and the Prisma Access infrastructure, so the BGP peer AS number and peering IP addresses must be configured on Panorama. Option D is correct because the Service Connection is an IPsec tunnel, requiring both an IKE Crypto Profile (for Phase 1) and an IPsec Crypto Profile (for Phase 2) to define encryption, authentication, and lifetime parameters. Option E is correct because Panorama must know the public peer IP address of the enterprise data center VPN gateway to establish the IPsec tunnel termination. Option A is incorrect because GlobalProtect client software download URLs are configured for mobile user/remote access deployments, not for Service Connections. Option C is incorrect because WMI probing schedules are used for User-ID and Active Directory domain discovery, which is unrelated to Service Connection tunnel configuration.

Answer

GlobalProtect client software download URLs for mobile endpoints.

Answer

WMI probing schedules for Active Directory domain discovery.

Question 3

An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)

Accepted Answer

Real-time blocking of unauthorized data uploads to sanctioned and unsanctioned cloud applications.. Inline CASB in Prisma Access inspects traffic in real time as users browse, so option C is correct: it can block unauthorized data uploads to both sanctioned and unsanctioned cloud applications before the data leaves the network. Option D is correct because inline CASB can insert tenant restriction headers (e.g., the Microsoft 365 tenant restriction HTTP header) to ensure users only access the organization's own tenant and not personal or foreign tenants. Option E is correct because inline inspection scans downloads in the traffic path and can immediately prevent malware from being downloaded from cloud storage platforms during browsing. Options A and B are not correct for inline CASB: deep historical scanning of files at rest (A) and out-of-band remediation of externally shared links via API webhooks (B) are capabilities of the API-based, out-of-band SaaS Security API, not the inline proxy-based CASB.

Answer

Deep historical scanning of files at rest stored within cloud SaaS storage repositories.

Answer

Out-of-band remediation of externally shared links via API webhooks.

Question 4

An administrator is troubleshooting a connectivity issue where remote mobile users cannot reach internal private applications via Prisma Access ZTNA. Which THREE diagnostic steps or verification checks should the administrator perform? (Choose three)

Accepted Answer

Verify that the GlobalProtect app on the user endpoint has successfully established a secure tunnel and updated its Host Information Profile (HIP). Option A is correct because Prisma Access ZTNA relies on the GlobalProtect app to establish the secure tunnel and report an up-to-date Host Information Profile (HIP); if the tunnel is down or HIP data is stale, the endpoint cannot be matched to the correct ZTNA policy and internal apps become unreachable. Option B is correct because the App Connectors are the components that publish and proxy internal private applications to Prisma Access; if they are disconnected or unhealthy in the management plane, mobile users have no path to those applications. Option D is correct because the Traffic and Threat logs show whether security policy, ZTNA rules, or threat inspection are allowing or dropping the application traffic, which is essential to pinpoint a policy-related block. Option C is incorrect because rebooting a public cloud hypervisor hosting the tenant is a disruptive, unsupported action that does not address ZTNA tunnel, connector, or policy causes. Option E is incorrect because changing the local ISP router's BGP autonomous system number is unrelated to Prisma Access ZTNA and would not fix endpoint-to-app connectivity.

Answer

Reboot the physical public cloud provider datacenter hypervisor hosting the tenant

Answer

Reconfigure the local ISP router's BGP autonomous system number to match the Prisma Access gateway

Question 5

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 6

An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the dedicated cloud-based analytics and monitoring service that provides real-time and historical operational dashboards for Prisma Access, including mobile user connection counts, per-region bandwidth utilization, and tunnel/health status. It aggregates telemetry from all Prisma Access components (mobile users, remote networks, service connections) into a single pane of glass, which is exactly what the administrator needs.

Answer

Panorama Traffic Logs

Answer

Command Line Interface (CLI) via SSH to Prisma Access nodes

Answer

Prisma Cloud Compute console

Question 7

A network engineer is troubleshooting user identification issues in Prisma Access where security policies relying on user groups are not matching traffic. Which troubleshooting command or Panorama feature should be used to verify if User-ID mappings are correctly populated for mobile users?

Accepted Answer

Use the CLI operational command 'show user ip-user-mapping all' or check User-ID status in the Prisma Access monitoring dashboard.. The CLI command 'show user ip-user-mapping all' displays the current IP-to-user mappings, and the Prisma Access monitoring dashboard shows User-ID status. This directly verifies whether User-ID mappings are populated for mobile users, which is required for user/group-based policy matching. If mappings are missing, policies won't match.

Answer

Check the GlobalProtect Gateway tunnel status.

Answer

Run 'show system software status'.

Answer

Verify the SSL Decryption certificate expiration date.

Question 8

An enterprise has deployed Prisma Access with explicit proxy and transparent proxy configurations. Users are reporting that applications using custom non-standard TCP ports are failing to connect through the Remote Network node. What feature should the engineer inspect to ensure the ports are allowed through App-ID inspection?

Accepted Answer

Inspect the custom application definitions and ensure Custom App-IDs are mapped to the correct non-standard ports, and that security rules permit those ports.. Prisma Access App-ID inspection relies on application signatures that map to specific TCP/UDP ports. When an application runs on a non-standard port, the default App-ID signature won't match, so the session may be dropped or misclassified. Creating a Custom App-ID that explicitly lists the non-standard port, then referencing it in a security rule that permits that port, allows the traffic to be identified and inspected correctly through the explicit/transparent proxy.

Answer

Configure a static NAT rule for the non-standard ports on the service connection.

Answer

Disable GlobalProtect pre-logon mode.

Answer

Enable SSL Forward Proxy on the destination zones.

Question 9

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode. GlobalProtect App configuration with seamless tunnel reconnection and 'Always On' mode maintains the tunnel across network changes by automatically re-establishing the connection when the underlying network switches (Wi-Fi to cellular). Always On ensures the tunnel is brought up without user intervention, and seamless reconnection minimizes disruption during roaming. This is the client-side setting that addresses session persistence.

Answer

Explicit Proxy PAC file fallback mode

Answer

BGP route dampening on the Service Connection

Answer

IPsec Dead Peer Detection (DPD) timer set to zero

Question 10

An administrator is investigating a security alert in Prisma Access triggered by an Anti-Spyware profile. Which log contains the detailed packet capture (pcap) or attack details for this specific event?

Accepted Answer

Monitor > Logs > Threat.. In Prisma Access and PAN-OS, threat logs (Monitor > Logs > Threat) record all events generated by security profiles including Antivirus, Anti-Spyware, Vulnerability Protection, and WildFire. When an Anti-Spyware profile triggers an alert, the detailed attack information — including the threat name, severity, source/destination, and often a packet capture (pcap) if configured — is stored in the Threat log. This is the correct location to investigate the specific event.

Answer

Monitor > Logs > HIP Match.

Answer

Panorama > Cloud Services > Audit Log.

Answer

Monitor > Logs > URL Filtering.