SSE-Engineer Hard Questions — 25 Difficult Questions

Question 1

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. To use CIE with Prisma Access, you must connect the directory service via the CIE agent or integration, configure the Authentication Profile in Panorama to point to CIE, and apply group mapping.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 2

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

Accepted Answer

Configure split tunneling to route non-corporate or high-bandwidth web traffic (e.g., video streaming) directly to the internet.. Traffic optimization for mobile users involves split tunneling, optimal gateway selection, and QoS.

Answer

Disable all threat inspection profiles for mobile users to bypass security processing.

Answer

Route all mobile user traffic through a single centralized headquarters datacenter firewall.

Question 3

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Accepted Answer

Configure a Directory Service connector to sync users and groups from Active Directory.. CIE requires directory service integration, cloud tenant setup, and agent or sync configuration.

Answer

Install physical Domain Controllers inside each Prisma Access cloud node.

Answer

Configure BGP peering between CIE and the enterprise DNS servers.

Question 4

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 5

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Accepted Answer

Local ISP latency and bandwidth.. Compute locations are chosen based on proximity to users, licensing availability, and the specific traffic type.

Answer

The number of users in the local branch.

Answer

The color of the hardware appliance.

Question 6

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Accepted Answer

Implement dynamic routing protocols (BGP) over the IPsec tunnels to facilitate automatic failover.. Remote network redundancy relies on redundant IPsec tunnels, BGP multipath/failover, and dual edge routers.

Answer

Cluster physical firewalls in an Active-Active HA pair inside the Prisma Access cloud infrastructure.

Answer

Manually update static routes on employee laptops whenever a remote network link fails.

Question 7

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 8

An engineer is troubleshooting a routing issue where a remote network branch connected to Prisma Access cannot reach another remote network branch (branch-to-branch routing). Which THREE configuration items must be verified to ensure successful branch-to-branch traffic flow? (Choose three)

Accepted Answer

Verify that Security Policy rules permit traffic between the respective branch zones. Branch-to-branch routing in Prisma Access requires explicit configuration, including enabling branch-to-branch traffic in Panorama, ensuring proper security policies permit the traffic, and correct route advertisement.

Answer

Verify that local branch DHCP lease times are set to 8 hours

Answer

Check that all mobile user clients have disabled split tunneling

Question 9

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

Accepted Answer

The Security Policy rule source zone or user-group mapping does not match the incoming traffic flow.. When the user is authenticated but traffic is dropped by policy, it usually indicates that the source user or group mapping is not being correctly identified in the Security Policy, or the specific traffic rule is missing.

Answer

The GlobalProtect portal is down.

Answer

The CIE directory sync is failing.

Answer

The Prisma Access license has expired.

Question 10

An engineer is troubleshooting BGP routing between a customer data center and Prisma Access over a Service Connection. The data center router is advertising routes, but Prisma Access is not installing them into the routing table. What is the most likely cause?

Accepted Answer

The advertised prefixes overlap with the reserved Prisma Access internal service subnet 10.255.0.0/16. Service Connections require BGP peering, and advertised routes must match supported prefix lengths and be properly configured within the Panorama Service Connection settings.

Answer

The BGP hold timer is set higher than 180 seconds

Answer

BGP authentication type is set to MD5 instead of SHA-256

Answer

The Autonomous System Number (ASN) is a private 4-byte ASN

Question 11

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 12

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. HIP requires the agent to be enabled, the objects to be defined, and the security policy to reference them.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 13

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

Accepted Answer

URL Filtering with real-time category lookups. Prisma Access provides comprehensive cloud-delivered security services including Threat Prevention, URL Filtering, and WildFire malware analysis natively on SPNs.

Answer

Local enterprise data center physical power failover management

Answer

Physical rack-and-stack server hardware maintenance by the customer

Question 14

An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?

Accepted Answer

On the Remote Network configuration in Panorama under Bandwidth Allocation and QoS. QoS profiles in Prisma Access for remote networks are applied on the Remote Network configuration settings in Panorama under Cloud Services.

Answer

Inside the GlobalProtect Gateway agent configuration profile

Answer

Globally inside the Palo Alto Networks WildFire configuration

Answer

Directly on the customer branch router CLI via MQC

Question 15

A company requires that Prisma Access FWaaS inspects all inter-zone traffic between two different remote branch offices connected via Prisma Access. By default, how does Prisma Access handle traffic between two Remote Networks attached to the same service region?

Accepted Answer

Traffic between Remote Networks is dropped by default unless explicitly allowed by security policy and inter-branch routing is enabled.. Prisma Access supports inter-branch routing, allowing traffic between remote networks to be inspected by security policies when inter-branch traffic is enabled.

Answer

Traffic must be backhauled to the corporate data center via a Service Connection before reaching another branch.

Answer

Remote Networks cannot communicate with each other under any circumstance.

Answer

Traffic is automatically bypassed and sent directly over public internet.

Question 16

An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?

Accepted Answer

By establishing multiple tunnels terminating on separate SPNs and using BGP multi-path or local preference for failover. Prisma Access supports redundant IPSec tunnels from branch routers, utilizing BGP to manage path selection and failover between the tunnels.

Answer

By utilizing VRRP across the cloud public IP addresses

Answer

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Answer

By configuring LACP bonding directly across the cloud IPSec endpoints

Question 17

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 18

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 19

A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?

Accepted Answer

Continuous Trust Verification via periodic Host Information Profile (HIP) re-evaluation and app-connector telemetry. ZTNA 2.0 in Prisma Access enforces continuous trust verification by re-evaluating device posture (HIP checks) and user context periodically during active sessions, cutting off access if conditions change.

Answer

Pre-logon GlobalProtect connection mode

Answer

Explicit proxy PAC file auto-discovery

Answer

RADIUS single sign-on (SSO) integration with Multi-Factor Authentication

Question 20

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. BGP troubleshooting requires verifying peer IP addresses, AS numbers, authentication keys, and network prefix advertisements.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.