SSE-Engineer Practice Test 9 — 10 Questions

Question 1

An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BGP peer AS number and peering IP addresses for dynamic route exchange.. Service Connections require defining the remote peer IP address, IPsec crypto settings, and BGP peering parameters for routing.

Answer

GlobalProtect client software download URLs for mobile endpoints.

Answer

WMI probing schedules for Active Directory domain discovery.

Question 2

An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)

Accepted Answer

Cloud-scale redundant gateway architecture across multiple geographic locations. Prisma Access provides mobile user high availability via automated gateway selection, regional redundancy, and client reconnect capabilities.

Answer

Static routing tables configured locally on Windows and macOS registry settings

Answer

Manual IPsec tunnel failover scripting executed on each endpoint device

Answer

On-premise physical hardware load balancers deployed in front of mobile user tunnels

Question 3

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Accepted Answer

The internal subnets are not included in the GlobalProtect Agent Split Tunneling 'Include Access Route' list.. Split tunneling configurations or missing network includes in the GlobalProtect agent configuration prevent traffic from routing correctly to internal networks.

Answer

The user's Active Directory password has expired in the Cloud Identity Engine.

Answer

The WildFire file size limit was exceeded.

Answer

The HIP check failed due to an outdated operating system patch.

Question 4

Which administrative role or tool is primarily used to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the cloud-managed dashboard used to monitor health, status, and analytics of the Prisma Access deployment.

Answer

Prisma Cloud Compute Console

Answer

WildFire portal

Answer

Cortex XDR incident management console

Question 5

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

Accepted Answer

Prisma Access ADEM (Autonomous Digital Experience Management). Autonomous DEM (ADEM) for Prisma Access provides visibility into end-user experience, endpoint health, and path performance.

Answer

WildFire Portal reporting

Answer

Panorama Packet Capture utility

Answer

GlobalProtect Syslog Analyzer

Question 6

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

Accepted Answer

Prisma Access plugin. The Prisma Access plugin is required on Panorama to configure and manage Prisma Access infrastructure.

Answer

SD-WAN plugin

Answer

VM-Series plugin

Answer

Cortex Data Lake plugin

Question 7

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

Accepted Answer

Attach appropriate Security Profiles (such as Antivirus, Anti-Spyware, and Vulnerability Protection) to all active Security Policy allow rules.. Prisma Access security best practices include placing explicit block rules at the top, leveraging application-layer filtering rather than relying solely on ports/IPs, and utilizing Security Profiles (antivirus, anti-spyware, URL filtering) across rules.

Answer

Disable SSL Decryption globally to maximize Prisma Access processing throughput across all mobile user nodes.

Answer

Configure all Security Policy rules to use 'Any' application to simplify rule maintenance and reduce rule count.

Question 8

Which log category in Prisma Access records events when a user's host information profile (HIP) changes or fails a compliance check?

Accepted Answer

HIP Match log. HIP Match logs record endpoint compliance evaluation results.

Answer

System log

Answer

Configuration log

Answer

User-ID log

Question 9

When troubleshooting a Prisma Access deployment where traffic from remote users is failing Threat Prevention inspection, which TWO components or configurations must be verified? (Choose two)

Accepted Answer

Decryption policy configuration ensuring traffic is not bypassing inspection. For Threat Prevention to inspect traffic in Prisma Access, Decryption policies must be active (since most traffic is SSL/TLS encrypted) and Anti-Spyware/Antivirus security profiles must be attached to the respective Security Policy rules.

Answer

Cloud Access Security Broker (CASB) API connector tokens

Answer

GlobalProtect user username-to-IP mapping agent status

Answer

Service Connection BGP peer keepalive intervals

Question 10

An administrator notices that the Panorama management server is failing to push configuration updates to Prisma Access nodes. Where should the administrator check for configuration push failure details and error logs in Panorama?

Accepted Answer

Panorama > Job Status or Monitor > Logs > Config / System.. Job status and config push logs in Panorama record failures and specific error messages when pushing configurations to Prisma Access.

Answer

Cloud Services > Status > Remote Networks.

Answer

Device > High Availability.

Answer

Policies > Security > Audit.