SSE-Engineer Hard Questions — 25 Difficult Questions

Question 1

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use destination-based security policy rules that reference the production and development subnets as separate destination addresses. Prisma Access security policy rules can match on destination addresses, so the administrator can write separate rules for production and development subnets. This provides distinct inspection and enforcement for each workload type while reusing a single Service Connection, meeting the requirement without adding tunnels or on-premises changes.

Answer

Configure policy-based forwarding on the Service Connection

Answer

Create separate Service Connections for production and development subnets

Answer

Apply different decryption profiles to the Service Connection tunnel

Question 2

An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?

Accepted Answer

Objects -> Security Profiles -> DNS Security. DNS Security profiles are attached to Security Policy rules in Panorama to inspect and take action on DNS requests.

Answer

Policies -> NAT

Answer

Panorama -> Cloud Services -> GlobalProtect -> DNS

Answer

Network Services -> DNS Proxy

Question 3

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Accepted Answer

Create HIP Objects and HIP Profiles in Panorama, then reference those profiles in Security Policy rules.. HIP enforcement in Prisma Access requires creating HIP Objects (which define the check, e.g., antimalware presence/version) and HIP Profiles (which combine objects into a logical condition), then referencing the HIP profile in Security Policy rules. This is the standard Panorama workflow for endpoint compliance gating. Without the profile referenced in policy, HIP data is collected but not enforced.

Answer

Deploy a Prisma Access Service Connection to proxy endpoint security telemetry to Panorama.

Answer

Configure the Cloud Identity Engine to query local endpoint registries directly for antimalware signatures.

Answer

Enable User-ID syslog mapping to ingest antimalware status logs from third-party endpoint protection servers.

Question 4

A security engineer is troubleshooting a ZTNA connection issue where remote users running GlobalProtect are unable to reach internal applications hosted behind a Prisma Access Remote Network. The mobile users and remote networks are in the same region, but direct branch-to-branch routing is failing. Which Prisma Access feature must be verified to ensure direct traffic flow between mobile users and remote networks without backhauling to the cloud service nodes?

Accepted Answer

Mobile User to Remote Network direct routing. Prisma Access supports Mobile User to Remote Network direct routing, which allows GlobalProtect mobile users to reach resources behind a Remote Network location directly without backhauling traffic through the Prisma Access service nodes. This feature must be enabled and verified when users and remote networks are in the same region but traffic is not flowing directly. It is the specific feature that governs branch-to-branch (mobile user to remote network) traffic paths.

Answer

Explicit Proxy PAC file redirect

Answer

Prisma Access Insights Regional Peering

Answer

Clean Pipe architecture

Question 5

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. Option B is correct because, to enforce group-based policy in Prisma Access, Panorama must have Group Mapping Settings that point to the Cloud Identity Engine as the directory source so it can resolve user-to-group memberships for policy matching. Option D is correct because an Authentication Profile in Panorama must reference the Cloud Identity Engine container so that user authentication requests are validated against the CIE directory service, enabling User-ID to associate authenticated users with their groups. Option A is incorrect because disabling MFA is not required and would weaken security; MFA can coexist with CIE-based authentication. Option C is incorrect because installing GlobalProtect on domain controllers is unnecessary and inappropriate; CIE connects to directory services via APIs/connectors, not by running the agent on domain controllers. Option E is incorrect because manual CSV uploads are not part of CIE integration and do not provide the real-time group mapping that CIE delivers.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 6

An administrator is troubleshooting a Prisma Access mobile user who reports that DNS resolution for internal domains fails intermittently. The user is connected via GlobalProtect, and the internal DNS servers are reachable. The administrator suspects that DNS queries are being sent to the wrong DNS server due to split-tunnel configuration. Which log source should the administrator check to see which DNS server the client is using for internal queries?

Accepted Answer

GlobalProtect app logs on the endpoint. GlobalProtect app logs on the endpoint are the best source to verify which DNS servers the client is using. They record the DNS settings received from the gateway, including split-DNS domains and the corresponding DNS servers. By examining these logs, the administrator can confirm whether internal domains are being resolved by the correct internal DNS server or if they are incorrectly sent to an external DNS server.

Answer

System logs on the Prisma Access portal

Answer

HIP match logs in the Prisma Access gateway

Answer

Traffic logs filtered by DNS application

Question 7

An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?

Accepted Answer

Enable BGP on the Service Connection and specify the peer AS and peer IP address.. For BGP peering over a Service Connection, you must enable BGP and provide the peer AS and peer IP address. This allows dynamic route exchange with the on-premises router, which uses a private AS number. Prisma Access supports BGP over Service Connections, and this configuration ensures proper routing and failover for traffic destined to on-premises resources.

Answer

Configure a static route to the on-premises network.

Answer

Set up an IPSec tunnel with BGP over it.

Answer

Configure OSPF on the Service Connection.

Question 8

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 9

An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?

Accepted Answer

The Security Policy rule allowing traffic from mobile users to the Service Connection zone is missing or misconfigured.. The most likely cause is a missing or misconfigured Security Policy rule allowing traffic from mobile users to the Service Connection zone. Even if the Service Connection is up and routing is correct, without an explicit allow rule, traffic is blocked by default. Split tunnel, route advertisement, and DNS are less likely given the described symptoms.

Answer

The Service Connection's tunnel interface is not advertising the application's subnet to Prisma Access.

Answer

The mobile user's DNS is not resolving the application's FQDN to the correct IP address.

Answer

The mobile user's GlobalProtect app is not configured to include the application's subnet in the split tunnel.

Question 10

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. Option A is correct because BGP peering requires the AS numbers to be properly configured: for eBGP the local and remote AS must differ and match each side's configured peer AS, while for iBGP both peers must use the same AS, so a mismatch prevents the session from establishing and routes from being learned. Option B is correct because even with an established session, Prisma Access will not learn any prefixes unless the CPE actually advertises them via BGP network or redistribute statements, so confirming the advertised prefixes is essential. Option D is correct because the BGP peer IP configured on Prisma Access must exactly match the CPE's BGP source/peer address (and vice versa) for the TCP session on port 179 to form; a mismatch means no peering and no route exchange. Option C is not relevant because WildFire cloud analysis is a threat-detection subscription and has no bearing on BGP route learning. Option E is not relevant because GlobalProtect portal SSL certificate expiration affects remote-user VPN authentication, not Remote Network BGP peering.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.

Question 11

An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?

Accepted Answer

Traffic logs. Traffic logs are the most comprehensive source for troubleshooting access issues in Prisma Access. They record session details including the matching security policy rule, the action, and the reason for denial. This allows administrators to quickly identify if a security policy is blocking access to a private application. Other log types focus on specific security events and do not provide the same level of detail for policy enforcement.

Answer

URL filtering logs

Answer

Data filtering logs

Answer

Threat logs

Question 12

A Prisma Access administrator is troubleshooting an issue where mobile users intermittently lose access to all applications for a few seconds. The administrator suspects an issue with the GlobalProtect tunnel. Which tool should the administrator use to view the tunnel status and identify flapping?

Accepted Answer

The GlobalProtect app logs on the user's endpoint, looking for tunnel disconnect and reconnect events.. Intermittent loss of all applications for a few seconds suggests the GlobalProtect tunnel is flapping. The GlobalProtect app logs on the endpoint record tunnel state changes, including disconnects and reconnects. These logs provide the necessary detail to confirm flapping and identify patterns, such as timeouts or network changes. Other tools lack the per-user tunnel state history.

Answer

The Prisma Access system logs, filtering for GlobalProtect gateway events.

Answer

The Prisma Access dashboard's GlobalProtect status page, checking the number of connected users.

Answer

The traffic logs, filtering for denied sessions from the mobile user's IP address.

Question 13

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 14

An organization notices that mobile users connecting to Prisma Access from a specific country are experiencing high latency and frequent disconnections. The administrator wants to check the regional Prisma Access node performance and status. Which feature in Panorama provides regional status and cloud infrastructure metrics?

Accepted Answer

Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users.. Panorama > Cloud Services > Status > Locations / Remote Networks / Mobile Users provides regional status and cloud infrastructure metrics for Prisma Access. This feature shows the health, performance, and status of Prisma Access nodes across different regions, allowing administrators to identify latency or disconnection issues tied to a specific location. It is the centralized monitoring point for regional infrastructure health.

Answer

Policies > QoS > Bandwidth Management.

Answer

Device > High Availability.

Answer

Monitor > Traffic > GlobalProtect Analytics.

Question 15

An administrator is troubleshooting a Prisma Access Remote Networks deployment where branch users experience slow throughput to SaaS applications. The IPsec tunnel to Prisma Access is up, but performance is degraded. The administrator suspects that traffic is not being forwarded to the optimal Service Connection. Which action should the administrator take to verify that Prisma Access is selecting the correct egress point for the branch?

Accepted Answer

Examine the traffic logs for the session and check the egress interface field. Traffic logs are the primary tool for verifying egress selection in Prisma Access. The egress interface field in the traffic log indicates the Service Connection used for a given session. For Remote Networks, administrators can filter logs by source IP and destination to see whether traffic egresses through the intended Service Connection, confirming optimal routing.

Answer

Check the GlobalProtect gateway selection logs on the portal

Answer

Review the IPsec tunnel statistics on the branch firewall

Answer

Run a traceroute from the branch firewall to the SaaS application

Question 16

An administrator is configuring Prisma Access to secure outbound internet traffic from a remote network site. The administrator wants to ensure that all traffic from the branch is inspected by Prisma Access security services, including threat prevention and URL filtering, before reaching the internet. Which Prisma Access component must be configured to direct branch traffic to the cloud security services?

Accepted Answer

A remote network connection configured with a IPSec tunnel to the Prisma Access regional hub.. A remote network connection is the Prisma Access feature designed to connect branch offices or data centers to the Prisma Access cloud infrastructure. It uses an IPSec tunnel to the regional hub, ensuring that all traffic from the branch is inspected by Prisma Access security services before reaching the internet. This provides consistent enforcement of threat prevention, URL filtering, and other policies for branch users.

Answer

A service connection with a static IP address and BGP peering to the Prisma Access infrastructure.

Answer

A Prisma Access explicit proxy configuration for the branch office web browsers.

Answer

A GlobalProtect portal and gateway configuration for the branch office users.

Question 17

An organization uses SAML authentication with Prisma Access for mobile users. Users report an intermittent 'Authentication Failed' error when trying to establish a GlobalProtect connection. The Identity Provider (IdP) logs show successful authentication, but Prisma Access logs indicate a failure. What is the most likely cause of this discrepancy?

Accepted Answer

Clock skew between the SAML Identity Provider and the Prisma Access service nodes exceeding the allowed tolerance window.. Intermittent SAML authentication failures where the IdP logs success but Prisma Access logs failure are most commonly caused by clock skew between the IdP and Prisma Access service nodes exceeding the allowed tolerance (typically 5 minutes). SAML assertions include timestamps (NotBefore, NotOnOrAfter) that are validated; if the clocks are not synchronized, the assertion may be considered expired or not yet valid.

Answer

The GlobalProtect client software license has expired on Panorama.

Answer

The User-ID agent service on the Panorama management server is stopped.

Answer

WildFire cloud subscription has lapsed.

Question 18

An engineer is troubleshooting BGP routing between a customer data center and Prisma Access over a Service Connection. The data center router is advertising routes, but Prisma Access is not installing them into the routing table. What is the most likely cause?

Accepted Answer

The advertised prefixes overlap with the reserved Prisma Access internal service subnet 10.255.0.0/16. Service Connections require BGP peering, and advertised routes must match supported prefix lengths and be properly configured within the Panorama Service Connection settings.

Answer

The BGP hold timer is set higher than 180 seconds

Answer

BGP authentication type is set to MD5 instead of SHA-256

Answer

The Autonomous System Number (ASN) is a private 4-byte ASN

Question 19

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 20

A company requires that Prisma Access FWaaS inspects all inter-zone traffic between two different remote branch offices connected via Prisma Access. By default, how does Prisma Access handle traffic between two Remote Networks attached to the same service region?

Accepted Answer

Traffic between Remote Networks is dropped by default unless explicitly allowed by security policy and inter-branch routing is enabled.. Prisma Access supports inter-branch routing, allowing traffic between remote networks to be inspected by security policies when inter-branch traffic is enabled.

Answer

Traffic must be backhauled to the corporate data center via a Service Connection before reaching another branch.

Answer

Remote Networks cannot communicate with each other under any circumstance.

Answer

Traffic is automatically bypassed and sent directly over public internet.