SSE-Engineer Multiple Select — 50 Questions

Question 1

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.. To use CIE with Prisma Access, you must connect the directory service via the CIE agent or integration, configure the Authentication Profile in Panorama to point to CIE, and apply group mapping.

Answer

Disable all multi-factor authentication (MFA) requirements on Prisma Access portals.

Answer

Install the GlobalProtect agent directly on all domain controller servers acting as CIE proxies.

Answer

Manually export user CSV files daily and upload them to Panorama using the CLI.

Question 2

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

Accepted Answer

Enable HIP data collection on the GlobalProtect agent settings.. HIP enforcement requires collecting profiles via the GlobalProtect agent and enforcing them in Security rules.

Answer

Configure static ARP entries on the GlobalProtect gateway.

Answer

Deploy WildFire appliance hardware at every branch location.

Answer

Install a local proxy server on every mobile device.

Question 3

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

Accepted Answer

Configure split tunneling to route non-corporate or high-bandwidth web traffic (e.g., video streaming) directly to the internet.. Traffic optimization for mobile users involves split tunneling, optimal gateway selection, and QoS.

Answer

Disable all threat inspection profiles for mobile users to bypass security processing.

Answer

Route all mobile user traffic through a single centralized headquarters datacenter firewall.

Question 4

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

Accepted Answer

Vulnerability Protection profile. WildFire and Vulnerability Protection profiles defend against zero-day exploits and known vulnerabilities.

Answer

Decryption profile assigned directly to the threat engine

Answer

Zone Protection profile

Answer

QoS profile for traffic shaping

Question 5

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Accepted Answer

Configure a Directory Service connector to sync users and groups from Active Directory.. CIE requires directory service integration, cloud tenant setup, and agent or sync configuration.

Answer

Install physical Domain Controllers inside each Prisma Access cloud node.

Answer

Configure BGP peering between CIE and the enterprise DNS servers.

Question 6

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

Accepted Answer

Traffic and Threat logs. Panorama provides traffic, threat, and HIP match logs alongside ACC dashboards for visibility.

Answer

Active Directory replication event logs

Answer

Local hypervisor resource utilization logs

Answer

Switch spanning-tree topology tables

Question 7

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Accepted Answer

Local ISP latency and bandwidth.. Compute locations are chosen based on proximity to users, licensing availability, and the specific traffic type.

Answer

The number of users in the local branch.

Answer

The color of the hardware appliance.

Question 8

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Accepted Answer

Implement dynamic routing protocols (BGP) over the IPsec tunnels to facilitate automatic failover.. Remote network redundancy relies on redundant IPsec tunnels, BGP multipath/failover, and dual edge routers.

Answer

Cluster physical firewalls in an Active-Active HA pair inside the Prisma Access cloud infrastructure.

Answer

Manually update static routes on employee laptops whenever a remote network link fails.

Question 9

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

Accepted Answer

Service health and status of cloud infrastructure and tunnels. Prisma Access Insights provides visibility into service health, license utilization, active user counts, and bandwidth consumption across locations.

Answer

Individual endpoint user Windows registry configurations

Answer

Local branch switch port VLAN configurations

Question 10

An engineer is troubleshooting a routing issue where a remote network branch connected to Prisma Access cannot reach another remote network branch (branch-to-branch routing). Which THREE configuration items must be verified to ensure successful branch-to-branch traffic flow? (Choose three)

Accepted Answer

Verify that Security Policy rules permit traffic between the respective branch zones. Branch-to-branch routing in Prisma Access requires explicit configuration, including enabling branch-to-branch traffic in Panorama, ensuring proper security policies permit the traffic, and correct route advertisement.

Answer

Verify that local branch DHCP lease times are set to 8 hours

Answer

Check that all mobile user clients have disabled split tunneling

Question 11

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

Accepted Answer

Source and destination security zones. Prisma Access security policies support standard PAN-OS match criteria including applications, users, zones, and regions.

Answer

Local physical switch port numbers on the cloud node

Answer

Hardware motherboard serial numbers of client machines

Question 12

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

Accepted Answer

Verify that the peer public IP address configured in Panorama matches the public IP of the branch office router.. Troubleshooting IPsec tunnels in Prisma Access involves verifying pre-shared keys or certificates, checking public IP settings, confirming correct Phase 1/Phase 2 proposal settings, and examining system logs via Prisma Access Insights.

Answer

Modify the GlobalProtect client configuration to force internal DNS resolution.

Answer

Reboot the Cloud Identity Engine container to clear stale routing cache entries.

Question 13

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Accepted Answer

Using source/destination address objects or tags.. Security policies require zones and address objects (or user groups) to identify traffic uniquely.

Answer

Enabling SSL inspection on all traffic.

Answer

Defining the physical port number.

Answer

Configuring the GlobalProtect client version.

Question 14

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. HIP requires the agent to be enabled, the objects to be defined, and the security policy to reference them.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 15

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Accepted Answer

An identity provider (IdP) integration, such as Azure AD or Okta.. CIE requires an identity source integration and the enablement of the CIE service on the tenant.

Answer

Active Directory Domain Controller installation on Prisma Access.

Answer

Configuring DNS on the local workstation.

Answer

Deploying a hardware firewall at every branch.

Question 16

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

Accepted Answer

URL Filtering with real-time category lookups. Prisma Access provides comprehensive cloud-delivered security services including Threat Prevention, URL Filtering, and WildFire malware analysis natively on SPNs.

Answer

Local enterprise data center physical power failover management

Answer

Physical rack-and-stack server hardware maintenance by the customer

Question 17

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 18

An administrator is configuring Source NAT (SNAT) for Prisma Access Remote Networks. Which TWO reasons explain why SNAT is necessary in certain network designs? (Choose two)

Accepted Answer

To resolve overlapping IP address spaces between multiple branch offices. SNAT is used to prevent IP address overlapping between branch sites and to hide internal network structures when accessing external destinations.

Answer

To authenticate GlobalProtect users against Active Directory

Answer

To replace the requirement for BGP routing over Service Connections

Answer

To assign dynamic IPv6 addresses to individual remote worker laptops

Question 19

When configuring GlobalProtect mobile users in Prisma Access, which THREE settings are typically defined within the GlobalProtect Client Settings configuration? (Choose three)

Accepted Answer

Connect method (e.g., On-Demand, Always-On). GlobalProtect Client Settings define client behavior such as internal DNS servers, gateway preferences, and connection modes.

Answer

Prisma Access Remote Network BGP ASN

Answer

Service Connection public gateway IP address

Question 20

An administrator is troubleshooting a Prisma Access Remote Network environment where BGP routes from the customer CPE are not being learned by Prisma Access. Which THREE configuration elements should be verified? (Choose three)

Accepted Answer

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.. BGP troubleshooting requires verifying peer IP addresses, AS numbers, authentication keys, and network prefix advertisements.

Answer

Verify the WildFire cloud analysis subscription status.

Answer

Check the GlobalProtect portal SSL certificate expiration date.