SSE-Engineer Prisma Access Administration And Operation — 15 Questions

Question 1

An administrator is troubleshooting a HIP (Host Information Profile) check failure for mobile users. Where can the administrator view the collected HIP reports and check compliance status in real-time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor > Logs > HIP Matches. HIP reports and compliance status are viewed in Monitor > Logs > HIP Matches in the Prisma Access/Panorama interface. This log displays the HIP report data collected from endpoints and the result of HIP policy evaluation, allowing real-time troubleshooting of HIP check failures.

Answer

Device > Certificate Management > HIP

Answer

Panorama > Cloud Services > Status > HIP

Answer

GlobalProtect > Gateway > Agent > HIP Objects

Question 2

Where do administrators configure service connections in Prisma Access to connect the cloud security infrastructure to the organization's data center or headquarters?

Accepted Answer

Panorama > Cloud Services > Configuration > Service Connections. Service connections are configured in the Panorama Cloud Services plugin to establish secure tunnels back to corporate datacenters.

Answer

Network > Interfaces > Tunnel

Answer

Policies > QoS > Service Connections

Answer

Device > Cloud Services > GlobalProtect

Question 3

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Accepted Answer

Objects > Decryption > SSL Decryption Profile. SSL decryption profiles in Prisma Access are configured under Objects > Decryption > SSL Decryption Profile, where you can adjust settings such as unsupported cipher suites, unsupported versions, and failure handling. This is the correct location to resolve handshake failures caused by an unsupported cipher suite.

Answer

Panorama > Cloud Services > Global Settings > Decryption

Answer

Device > Certificate Management > SSL Policy

Answer

Policies > Decryption > Settings

Question 4

An organization requires that specific SaaS applications are accessed only by corporate-managed devices that pass a specific HIP check. Which policy type should the administrator configure?

Accepted Answer

Security Policy Rule referencing the HIP Profile. HIP checks are enforced within Security Policy rules by referencing the desired HIP Object or HIP Profile in the rule's criteria.

Answer

Decryption Policy applying inbound SSL decryption

Answer

QoS Policy referencing the HIP Object

Answer

Authentication Policy enforcing GlobalProtect gateway authentication

Question 5

A Prisma Access administrator notices that remote network traffic destined for another remote network (branch-to-branch traffic) is being dropped or failing to establish. What is the required configuration to allow branch-to-branch traffic?

Accepted Answer

Enable 'Branch-to-Branch' routing under Panorama > Cloud Services > Configuration > Remote Networks and create matching security rules.. Branch-to-branch traffic in Prisma Access is disabled by default for security and routing reasons. To enable it, the administrator must turn on the 'Branch-to-Branch' routing option under Panorama > Cloud Services > Configuration > Remote Networks, and then create security rules that explicitly permit traffic between the remote network zones. Without this setting, traffic from one remote network to another is dropped even if security rules exist.

Answer

Configure static routes pointing to the loopback interface on every remote network gateway.

Answer

Enable GlobalProtect Clientless VPN on all remote network gateways.

Answer

Deploy dedicated external hardware firewalls at each branch location.

Question 6

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Accepted Answer

Device > Server Profiles > SAML Identity Provider. In Prisma Access, SAML IdP metadata for mobile users is imported and configured under Device > Server Profiles > SAML Identity Provider. This is where the IdP certificate, metadata URL, and attribute mappings are defined, which are then referenced in the GlobalProtect portal and gateway authentication profiles. The other locations either do not exist or are not used for SAML IdP configuration in this context.

Answer

Network > GlobalProtect > Portal > Authentication

Answer

Panorama > Cloud Services > Authentication > SAML

Answer

Objects > Cloud Identity Engine > SAML

Question 7

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Accepted Answer

Monitor > ACC or the Prisma Access App dashboard. The Monitor > ACC or the Prisma Access App dashboard provides an overview of active mobile users, connection status, and geographical distribution. The App dashboard in Prisma Access specifically aggregates GlobalProtect user data, showing active users, their locations, and connection health. This is the central monitoring pane for mobile user status.

Answer

Policies > Security > Status

Answer

Network > GlobalProtect > Runtime

Answer

Device > Status > Active Users

Question 8

Which action should an administrator take to update the Prisma Access software and plugin versions across the deployment?

Accepted Answer

Panorama > Plugin > Cloud Services > Updates. Panorama manages Prisma Access updates through the Software and Cloud Services plugin update mechanisms.

Answer

Device > Software > Prisma Access

Answer

Policies > Management > Updates

Answer

Monitor > Software Updates > Cloud

Question 9

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Accepted Answer

The internal subnets are not included in the GlobalProtect Agent Split Tunneling 'Include Access Route' list.. When a GlobalProtect mobile user shows Connected but receives an internal IP from the reserve pool, it typically means the user's traffic is not being routed to the internal subnets because those subnets are not included in the split tunneling 'Include Access Route' list. The reserve pool is used when the primary IP pool is exhausted or when the user is not assigned a standard internal IP, and without the correct include routes, internal resources are unreachable.

Answer

The user's Active Directory password has expired in the Cloud Identity Engine.

Answer

The WildFire file size limit was exceeded.

Answer

The HIP check failed due to an outdated operating system patch.

Question 10

An administrator wants to view real-time metrics, node status, and active connection counts for Prisma Access Mobile Users and Remote Networks directly from Panorama. Which tool within Panorama should the administrator access?

Accepted Answer

Prisma Access Insights. Prisma Access Insights provides a centralized dashboard in Panorama for monitoring service health, bandwidth utilization, and active connections.

Answer

GlobalProtect Portal Diagnostics Tool

Answer

Command Center CLI

Answer

Cloud Identity Engine Console

Question 11

An administrator configures Decryption Policies in Prisma Access to inspect inbound traffic destined for internal applications published via Service Connections. Users report that certain internal web applications using custom internal Certificate Authorities (CAs) are failing TLS handshakes. Where should the administrator check and install the enterprise internal CA certificate to resolve this inspection issue?

Accepted Answer

Panorama > Certificate Management > Certificates, and ensure the internal CA is imported and trusted for SSL decryption.. For SSL decryption in Prisma Access, the enterprise internal CA must be imported into Panorama's Certificate Management and marked as a trusted CA for decryption. Prisma Access uses this trust anchor to validate and re-sign certificates for internal applications during inbound inspection. Without the internal CA trusted in Panorama, the forward-proxy trust chain breaks and TLS handshakes fail.

Answer

GlobalProtect Portal > Client Settings > Authentication, and push the CA via client configuration.

Answer

Cloud Identity Engine > Settings > Trusted Roots, and sync the certificate via LDAP.

Answer

Prisma Access Insights > Policies > Decryption, and toggle the 'Bypass Internal CA' switch.

Question 12

When configuring Mobile Users in Prisma Access, an administrator needs to define the regions where GlobalProtect gateway nodes will be instantiated to serve remote workers. Which Panorama menu path is used to configure Mobile Users locations and bandwidth allocations?

Answer

Panorama > Prisma Access > Mobile Users

Answer

Objects > Cloud Identity Engine

Answer

Network > GlobalProtect > Gateways

Answer

Device > Setup > GlobalProtect

Question 13

An administrator is troubleshooting a scenario where remote users connected via Prisma Access Mobile Users cannot access a specific newly added subnet behind a Remote Network location. Which configuration check should the administrator perform first in Panorama?

Accepted Answer

Verify that Security Policy rules permit traffic from the Mobile Users zone to the Remote Networks zone, and that the remote subnet is included in the Remote Network configuration.. When Mobile Users cannot reach a newly added subnet behind a Remote Network, the first check is whether security policy rules permit traffic from the Mobile Users zone to the Remote Networks zone and whether the subnet is included in the Remote Network configuration. This addresses the most common causes: missing policy or missing route advertisement. The Remote Network configuration must include the subnet for it to be reachable.

Answer

Restart the Cloud Identity Engine agent on the domain controller to refresh IP-to-user mappings.

Answer

Reinstall the GlobalProtect agent on all remote user machines to update the gateway list.

Answer

Generate a new API key in Prisma Access Insights to force a routing table recalculation.

Question 14

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Accepted Answer

Create a HIP Object, add it to a HIP Profile, and apply it to a Security Policy rule source criteria.. Host Information Profile (HIP) objects must be defined, added to a HIP Object Profile, and then referenced in a Security Policy rule.

Answer

Configure an App-ID override rule and assign the device certificate to the User-ID agent.

Answer

Enable SSL Forward Proxy and add the device serial number to the GlobalProtect portal whitelist.

Answer

Assign a dynamic address group to the user and create a custom URL filtering category for the SaaS app.

Question 15

When using Cloud Identity Engine (CIE) for authentication, which method allows for the most seamless user experience for mobile users?

Accepted Answer

SAML integration with a cloud identity provider.. SAML with a Cloud Identity Provider is the standard for modern identity integration in Prisma Access.

Answer

RADIUS authentication.

Answer

LDAP without SSL.

Answer

Local database on the firewall.