SSE-Engineer Practice Test 9 — 10 Questions

Question 1

Which cloud infrastructure providers host the backend Security Processing Nodes (SPNs) used by Prisma Access?

Accepted Answer

AWS and Google Cloud Platform (GCP). Prisma Access is built on leading hyper-scaler cloud infrastructure, specifically AWS and Google Cloud Platform (GCP).

Answer

Oracle Cloud Infrastructure (OCI) and IBM Cloud

Answer

Microsoft Azure only

Answer

On-premises enterprise datacenters exclusively

Question 2

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Accepted Answer

Antivirus and Anti-Spyware profiles. To inspect outbound web traffic for malware and spyware, the Security policy rule must have Antivirus and Anti-Spyware security profiles attached. These profiles perform content inspection for malicious files and spyware signatures on allowed traffic, which is required for Prisma Access to detect and block those threats.

Answer

Decryption profile and URL filtering profile only

Answer

QoS Profile and Zone Protection profile

Answer

HIP Profile and WildFire analysis profile

Question 3

An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?

Accepted Answer

GlobalProtect cloud DNS resolution and regional gateway priority settings. Prisma Access uses GlobalProtect cloud DNS resolution and regional gateway priority settings to automatically route users to the nearest regional cloud node. When a mobile user connects, GlobalProtect resolves the closest gateway based on the user's source IP geolocation and the configured priority of gateways in each region. This is automatic and requires no manual per-laptop configuration.

Answer

Active Directory site-to-site replication

Answer

Explicit Proxy PAC file geographic strings

Answer

Manual IP routing configuration on each user laptop

Question 4

An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)

Accepted Answer

Shadow IT discovery and risk scoring of unapproved cloud applications. Option B is correct because Prisma Access SaaS Security includes Shadow IT discovery, which uses traffic telemetry to identify unsanctioned cloud applications and assigns each a risk score so administrators can decide whether to block, allow, or coach users. Option D is correct because SaaS application activity controls provide granular, per-application policy enforcement—for example, allowing access to a collaboration tool while blocking actions such as external file sharing, public link creation, or uploads to personal accounts. Together these features deliver the visibility and action-level control the administrator needs over file sharing and collaboration SaaS. Option A is incorrect because IPsec crypto profiles govern VPN tunnel encryption parameters for branch connectivity, not SaaS application control. Option C is incorrect because GlobalProtect client version deployment rules manage endpoint agent software versions, not SaaS usage policies. Option E is incorrect because WMI-based user mapping polling relates to User-ID agent configuration for mapping users to IP addresses, not SaaS Security enforcement.

Answer

IPsec crypto profile selection for branch offices

Answer

GlobalProtect client software version deployment rules

Answer

WMI-based user mapping polling intervals

Question 5

An administrator notices that a subset of mobile users connecting via GlobalProtect in Prisma Access cannot resolve internal corporate hostnames, while external websites load normally. The split-tunnel configuration includes the corporate domain. Where should the administrator check first in Panorama to troubleshoot this DNS resolution failure?

Accepted Answer

Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config > DNS and-or WINS.. DNS and WINS settings for GlobalProtect mobile users are configured under Panorama > Prisma Access > Service Setup > Mobile Users > GlobalProtect Client Settings > Client Config. If internal hostnames fail to resolve while external sites work, the DNS server list or suffix pushed to clients is likely missing or incorrect, so this is the first place to verify. The split-tunnel domain inclusion only routes traffic; it does not supply DNS servers.

Answer

Panorama > Prisma Access > Monitoring > ACC.

Answer

Panorama > Cloud Services > Status > Traffic Log.

Answer

Panorama > Firewall > Network Profiles > Interface.

Question 6

An administrator needs to verify the exact version of Prisma Access running on the cloud infrastructure. Where in Panorama is this version information displayed?

Accepted Answer

Panorama > Cloud Services > Setup > Infrastructure / Status.. Prisma Access infrastructure version information is displayed under Panorama > Cloud Services > Setup > Infrastructure / Status, where the cloud service plugin shows the current Prisma Access version, tenant status, and component versions. This is the authoritative location for verifying the running cloud infrastructure version.

Answer

Policies > Security.

Answer

Device > Certificates.

Answer

Monitor > Dynamic Updates.

Question 7

A Prisma Access administrator is troubleshooting a mobile user who reports that after connecting via GlobalProtect, they cannot access internal web servers by hostname, but can access them by IP address. Other mobile users in the same region do not have this issue. Which component should the administrator verify first?

Accepted Answer

The DNS server configuration in the GlobalProtect portal agent configuration for the user's region.. The ability to reach internal servers by IP but not by hostname indicates a DNS resolution problem. In Prisma Access, DNS settings for mobile users are pushed via the GlobalProtect portal agent configuration. If the DNS servers for the user's region are misconfigured or missing, the user cannot resolve internal hostnames. Verifying the DNS server configuration is the correct first step.

Answer

The SSL decryption policy applied to the user's traffic to ensure it is not blocking DNS queries.

Answer

The security policy rules that allow or deny traffic from the mobile user to the internal web servers.

Answer

The GlobalProtect app logs on the user's endpoint to check for HIP failures.

Question 8

A security engineer is troubleshooting a Prisma Access deployment where mobile users report that traffic to a specific SaaS application is being inspected but the CASB inline policy is not applying the expected data-loss prevention action. The engineer confirms the SaaS application is identified in the traffic logs. Which log or dashboard should the engineer examine to determine whether the CASB policy matched and what action was taken?

Accepted Answer

The Data Filtering log, filtering on the SaaS application and the DLP action.. CASB inline policy matches, including the SaaS application identified and the action enforced such as alert or block, are recorded in the Data Filtering log. When a mobile user's traffic to a SaaS application is inspected but the expected DLP action does not occur, the Data Filtering log shows whether the rule matched and what action was taken. The Threat log, System log, and URL Filtering log do not capture CASB policy match and action details.

Answer

The System log, filtering on the CASB policy name and the commit status.

Answer

The Threat log, filtering on the SaaS application name and the CASB policy action.

Answer

The URL Filtering log, filtering on the SaaS application category and the user.

Question 9

An administrator is configuring Prisma Access for a branch office to provide secure internet access. They want to ensure that the branch users' traffic is inspected for threats and that access to risky URLs is blocked. Which two components are required in the Prisma Access configuration to achieve this? (Choose two.)

Accepted Answer

A Threat Prevention profile applied to the same Security Policy rule to detect and block exploits and malware.. To inspect branch traffic for threats and block risky URLs, you need a Security Policy rule that allows and inspects the traffic, with both URL Filtering and Threat Prevention profiles attached. URL Filtering blocks risky categories, while Threat Prevention detects and blocks exploits and malware. Other components like decryption, DNS Security, or File Blocking are not mandatory for the stated requirements.

Answer

A File Blocking profile to prevent executable downloads.

Answer

A Decryption policy to decrypt all SSL traffic from branch users.

Answer

A DNS Security policy to sinkhole malicious domains.

Question 10

A Prisma Access engineer is troubleshooting a mobile user who cannot access an internal application after successfully connecting via GlobalProtect. The engineer suspects that the issue is related to the split-tunnel configuration. Which TWO actions should the engineer take to verify that the correct routes are being pushed to the client? (Choose two.)

Accepted Answer

Review the GlobalProtect agent logs on the user's endpoint for the received route table.. To diagnose split-tunnel routing issues for a mobile user, the engineer must confirm both the intended configuration and the actual client behavior. The gateway configuration defines which routes should be pushed, while the client logs show which routes were received. If either is missing the internal subnet, the user cannot access the application. These two actions together isolate whether the problem is in the configuration or in the client's application of the routes.

Answer

Run a packet capture on the Prisma Access service connection to see if traffic arrives.

Answer

Verify the user's authentication and group mapping in the Prisma Access directory sync.

Answer

Inspect the IPsec tunnel status between the service connection and the remote network.