SSE-Engineer Prisma Access Administration And Operation — 15 Questions

Question 1

When configuring Mobile Users in Prisma Access, an administrator needs to define the regions where GlobalProtect gateway nodes will be instantiated to serve remote workers. Which Panorama menu path is used to configure Mobile Users locations and bandwidth allocations?

Choose an answer to begin — your selection is scored in the full session.

Answer

Panorama > Prisma Access > Mobile Users

Answer

Objects > Cloud Identity Engine

Answer

Network > GlobalProtect > Gateways

Answer

Device > Setup > GlobalProtect

Question 2

An administrator is troubleshooting a HIP (Host Information Profile) check failure for mobile users. Where can the administrator view the collected HIP reports and check compliance status in real-time?

Accepted Answer

Monitor > Logs > HIP Matches. HIP check data and reports for connected mobile users can be inspected via the Panorama operational commands or ACC/Monitor tabs.

Answer

Device > Certificate Management > HIP

Answer

Panorama > Cloud Services > Status > HIP

Answer

GlobalProtect > Gateway > Agent > HIP Objects

Question 3

Where do administrators configure service connections in Prisma Access to connect the cloud security infrastructure to the organization's data center or headquarters?

Accepted Answer

Panorama > Cloud Services > Configuration > Service Connections. Service connections are configured in the Panorama Cloud Services plugin to establish secure tunnels back to corporate datacenters.

Answer

Network > Interfaces > Tunnel

Answer

Policies > QoS > Service Connections

Answer

Device > Cloud Services > GlobalProtect

Question 4

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Accepted Answer

Panorama > Cloud Services > Configuration > Mobile Users > Client Settings. GlobalProtect client settings, including primary and secondary DNS servers assigned to mobile users, are configured within the GlobalProtect Client Settings in Panorama.

Answer

Objects > GlobalProtect > DNS Profile

Answer

Device > Setup > Services > DNS

Answer

Network > GlobalProtect > Gateway > DNS

Question 5

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Accepted Answer

Objects > Decryption > SSL Decryption Profile. SSL Decryption profiles govern cipher suites, minimum TLS versions, and handling of unsupported options.

Answer

Panorama > Cloud Services > Global Settings > Decryption

Answer

Device > Certificate Management > SSL Policy

Answer

Policies > Decryption > Settings

Question 6

An organization requires that specific SaaS applications are accessed only by corporate-managed devices that pass a specific HIP check. Which policy type should the administrator configure?

Accepted Answer

Security Policy Rule referencing the HIP Profile. HIP checks are enforced within Security Policy rules by referencing the desired HIP Object or HIP Profile in the rule's criteria.

Answer

Decryption Policy applying inbound SSL decryption

Answer

QoS Policy referencing the HIP Object

Answer

Authentication Policy enforcing GlobalProtect gateway authentication

Question 7

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks. Prisma Access remote networks and mobile user configurations are managed centrally through Panorama using the Cloud Services plugin.

Answer

Prisma Access App > Traffic Steering > Remote Networks

Answer

Policies > Security > Remote Networks

Answer

Device > Setup > Operations > Remote Networks

Question 8

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Accepted Answer

Configure Cloud Identity Engine (CIE) settings in Panorama to sync directory services.. The Cloud Identity Engine (CIE) acts as the directory sync mechanism to gather user and group mapping information for Prisma Access.

Answer

Configure a User-ID agent on every branch router.

Answer

Install the GlobalProtect agent with local syslog forwarding.

Answer

Enable captive portal authentication on all remote network firewalls.

Question 9

A Prisma Access administrator notices that remote network traffic destined for another remote network (branch-to-branch traffic) is being dropped or failing to establish. What is the required configuration to allow branch-to-branch traffic?

Accepted Answer

Enable 'Branch-to-Branch' routing under Panorama > Cloud Services > Configuration > Remote Networks and create matching security rules.. By default, branch-to-branch traffic in Prisma Access must be explicitly allowed in the Prisma Access traffic steering and security policy configurations.

Answer

Configure static routes pointing to the loopback interface on every remote network gateway.

Answer

Enable GlobalProtect Clientless VPN on all remote network gateways.

Answer

Deploy dedicated external hardware firewalls at each branch location.

Question 10

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Accepted Answer

Device > Server Profiles > SAML Identity Provider. SAML identity provider server profiles are configured in Panorama under Device or Server Profiles before being assigned to GlobalProtect authentication profiles.

Answer

Network > GlobalProtect > Portal > Authentication

Answer

Panorama > Cloud Services > Authentication > SAML

Answer

Objects > Cloud Identity Engine > SAML

Question 11

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 12

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Accepted Answer

Monitor > ACC or the Prisma Access App dashboard. The Prisma Access monitoring app and Panorama's ACC provide real-time dashboards for mobile user connectivity.

Answer

Policies > Security > Status

Answer

Network > GlobalProtect > Runtime

Answer

Device > Status > Active Users

Question 13

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Accepted Answer

Antivirus and Anti-Spyware profiles. Antivirus and Anti-Spyware profiles inspect traffic passing through security rules for known malware and command-and-control signatures.

Answer

Decryption profile and URL filtering profile only

Answer

QoS Profile and Zone Protection profile

Answer

HIP Profile and WildFire analysis profile

Question 14

Which action should an administrator take to update the Prisma Access software and plugin versions across the deployment?

Accepted Answer

Panorama > Plugin > Cloud Services > Updates. Panorama manages Prisma Access updates through the Software and Cloud Services plugin update mechanisms.

Answer

Device > Software > Prisma Access

Answer

Policies > Management > Updates

Answer

Monitor > Software Updates > Cloud

Question 15

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Accepted Answer

The internal subnets are not included in the GlobalProtect Agent Split Tunneling 'Include Access Route' list.. Split tunneling configurations or missing network includes in the GlobalProtect agent configuration prevent traffic from routing correctly to internal networks.

Answer

The user's Active Directory password has expired in the Cloud Identity Engine.

Answer

The WildFire file size limit was exceeded.

Answer

The HIP check failed due to an outdated operating system patch.