SSE-Engineer Prisma Access Administration And Operation — All Questions With Answers

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Question 10easymultiple choice

An administrator wants to view real-time metrics, node status, and active connection counts for Prisma Access Mobile Users and Remote Networks directly from Panorama. Which tool within Panorama should the administrator access?

Question 11hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator configures Decryption Policies in Prisma Access to inspect inbound traffic destined for internal applications published via Service Connections. Users report that certain internal web applications using custom internal Certificate Authorities (CAs) are failing TLS handshakes. Where should the administrator check and install the enterprise internal CA certificate to resolve this inspection issue?

Question 12easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

When configuring Mobile Users in Prisma Access, an administrator needs to define the regions where GlobalProtect gateway nodes will be instantiated to serve remote workers. Which Panorama menu path is used to configure Mobile Users locations and bandwidth allocations?

Question 13mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a scenario where remote users connected via Prisma Access Mobile Users cannot access a specific newly added subnet behind a Remote Network location. Which configuration check should the administrator perform first in Panorama?

Question 14mediummultiple choice

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Question 15mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

When using Cloud Identity Engine (CIE) for authentication, which method allows for the most seamless user experience for mobile users?

Question 16hardmulti select

Read the full Prisma Access Administration And Operation explanation →

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Question 17easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access administrator must add a new remote network site in the Americas region and needs the branch firewall to establish the IPSec tunnel to the closest Prisma Access service connection. Which Prisma Access component must the branch firewall's IKE gateway peer address resolve to?

Question 18hardmultiple choice

An administrator needs to ensure that Security policy rules in Prisma Access apply consistently to both mobile users and remote networks. The administrator creates a rule with the source zone set to Trust and the destination zone set to Untrust. Mobile user traffic is being evaluated by the rule, but remote network traffic is not. Which action should the administrator take to correct the zone configuration?

Question 19mediummultiple choice

An administrator deploys Prisma Access with a Service Connection to an on-premises data center. Branch users connected through a Remote Network must reach an internal application server at 10.20.30.40/32, which is advertised from the data center over BGP. Traffic is reaching the service connection but the return path fails. Which Prisma Access configuration is required so that Prisma Access advertises the Remote Network summary route back to the data center BGP peer?

Question 20mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is deploying a new Prisma Access instance and needs to onboard a Remote Network site. The ISP has provided a single public IP address for the branch firewall. The administrator must configure the IPSec tunnel to Prisma Access using that address. Which TWO settings are required on the branch firewall to establish the tunnel? (Choose two.)

Question 21mediummultiple choice

An administrator is troubleshooting a Prisma Access deployment where mobile users in the branch office report that traffic to a newly deployed SaaS application is being blocked. The administrator has verified that the Security policy rule allowing the application is in place and that the user is authenticated. The administrator wants to determine whether the traffic is being processed by the correct Prisma Access node for that region. Which Prisma Access component should the administrator check to confirm the mobile user's assigned gateway?

Question 22hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator configures an Explicit Proxy in Prisma Access for a branch office. Users report that HTTP traffic is proxied correctly, but HTTPS sites fail with certificate errors. The administrator has installed the Forward Trust certificate on the endpoints. Which action resolves the HTTPS failures while keeping decryption enforcement intact?

Question 23hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to enforce Security policy based on user group membership for mobile users. The administrator wants to ensure that group-based rules are evaluated correctly. Which two actions must be completed to enable this functionality? (Choose two.)

Question 24hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring a Prisma Access remote network for a new branch office. The branch has two internet links and requires high availability. The administrator wants to ensure that if one link fails, traffic automatically fails over to the other. Which TWO configuration steps are required to achieve this? (Choose two.)

Question 25hardmultiple choice

A security engineer is configuring Security policy rules in Prisma Access for Mobile Users. The organization requires that traffic to known malicious domains be blocked based on DNS queries before a connection is established, and that users be shown a response page when blocked. Which Prisma Access feature should be used to meet this requirement?

Question 26mediummulti select

An administrator is troubleshooting a Prisma Access deployment where mobile users cannot reach a newly added internal application. The administrator wants to verify that the correct components are in place for the traffic to be routed and inspected. Which TWO items must be configured for mobile user traffic destined to an internal application to be forwarded through a Service Connection? (Choose two.)

Question 27hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring a Prisma Access deployment with multiple service connections to two different data centers. The security team wants to ensure that if one service connection fails, traffic from remote networks can still reach critical applications in the other data center. The administrator enables ECMP on the remote networks. Which TWO additional actions must be taken to ensure seamless failover and optimal routing? (Choose two.)

Question 28hardmulti select

An administrator is deploying Prisma Access for a large enterprise with multiple remote networks and mobile users. The administrator needs to ensure that all traffic is inspected by Prisma Access security services and that logging is centralized for compliance. Which TWO actions must the administrator take to ensure that logs from all Prisma Access components are forwarded to an external SIEM? (Choose two.)

Question 29mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to forward logs and alerts to an external SIEM. The security team requires that all traffic logs, threat logs, and system logs be sent to the SIEM in near real-time. Which TWO actions must the administrator take to meet this requirement? (Choose two.)

Question 30easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to give a security analyst read-only access to Prisma Access logs and dashboards without allowing configuration changes. Which role should be assigned in the Prisma Access tenant?

Question 31easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is setting up Prisma Access for the first time and needs to activate the service. The administrator has already configured the Prisma Access infrastructure in Panorama. Which step must be completed to make the Prisma Access service operational for mobile users?

Question 32hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is enabling Prisma Access for a new region and must ensure that mobile users in that region are terminated at a nearby Prisma Access location for optimal latency. The administrator has already onboarded the region and activated the infrastructure. Which setting determines which Prisma Access location a mobile user connects to?

Question 33mediummultiple choice

An administrator is troubleshooting a Prisma Access Remote Network deployment where branch users report intermittent access failures. The administrator suspects that a specific Service Connection is flapping. Which CLI command on the Prisma Access service connection VM should be used to verify the current status of the IPsec tunnels and confirm whether they are established?

Question 34mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Question 35easymultiple choice

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Question 36easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Question 37hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Question 38mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Question 39easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

Question 40mediummultiple choice

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

Question 41hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Question 42mediummulti select

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

Question 43mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

Question 44mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Question 45hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Question 46mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

Question 47hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

Question 48hardmulti select

Read the full Prisma Access Administration And Operation explanation →

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Question 49mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

Question 50mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

Question 51hardmultiple choice

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Question 52mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

Question 53hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Question 54hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

Question 55mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

Question 56hardmulti select

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

Question 57easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which component in Prisma Access is responsible for performing decryption, content inspection, and threat prevention for mobile users?

Question 58mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

When configuring a Remote Network (RN) connection to an on-premises data center, which parameter is required to ensure proper routing of internal traffic via the IPSec tunnel?

Question 59hardmultiple choice

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

Question 60easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

Question 61hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Question 62mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Question 63easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

Question 64mediummulti select

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Question 65mediummulti select

Read the full Prisma Access Administration And Operation explanation →

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Question 66hardmulti select

Read the full Prisma Access Administration And Operation explanation →

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Question 67easymulti select

Read the full Prisma Access Administration And Operation explanation →

Which TWO configuration steps are required to allow internet access for Remote Network users?

Question 68mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator notices that Prisma Access mobile users in the EMEA region are being assigned IP addresses from the 10.20.0.0/16 pool, which overlaps with an internal subnet at 10.20.10.0/24 that users must reach. What should the administrator do in the Prisma Access mobile user configuration to avoid the conflict?

Question 69hardmulti select

An administrator is onboarding a new remote network in Prisma Access and wants to verify that the tunnel is healthy after configuration. Which two status indicators should the administrator check in the Prisma Access status view to confirm the remote network tunnel is up? (Choose two.)

Question 70mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has deployed Prisma Access with a single service connection to an on-premises data center. Branch users at a remote network report that traffic to an internal application hosted behind the data center firewall is being dropped, even though Security policy allows it. The administrator confirms the remote network tunnel is up and the service connection is green. Which configuration element should the administrator verify to allow the branch-to-data-center traffic to traverse the Prisma Access infrastructure?

Question 71mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

Question 72hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to give a security operations analyst read-only access to Prisma Access logs and reports without allowing any configuration changes. Which Prisma Access administrative role should the administrator assign in the identity provider or Panorama?

Question 73mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has deployed Prisma Access with a single Service Connection to an on-premises data center. Branch users at a Remote Network site report intermittent access to internal applications, while internet-bound traffic works reliably. The administrator suspects the Service Connection is the cause. Which action should the administrator take to confirm whether the Service Connection is the source of the problem?

Question 74mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator notices that Remote Network (branch) traffic to SaaS applications is being backhauled through the corporate data center instead of breaking out locally at the Prisma Access node. The administrator wants branch traffic destined to trusted SaaS applications to egress directly from the Prisma Access service connection. Which Prisma Access capability should be used to accomplish this?

Question 75hardmultiple choice

An administrator is deploying Prisma Access for a new Remote Network site that requires access to both the internet and internal applications. The administrator has already configured the Remote Network and Service Connection. Users report that internet access works, but internal application access fails. The administrator confirms that the Service Connection BGP session is established and advertising routes. Which configuration should the administrator verify next on the Remote Network?

Question 76hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access administrator needs to publish an internal web application to Mobile Users through a Private Application. The application uses a hostname that is not resolvable by public DNS. The administrator wants Mobile Users' browsers to reach the app using its internal FQDN without exposing the app to the internet. What must be configured to achieve this?

Question 77mediummultiple choice

An administrator has deployed Prisma Access for a branch office remote network that must reach a SaaS application through a service connection. After committing the configuration, users report that traffic is being dropped at the remote network firewall with the message 'no matching service connection found.' The administrator verifies that the service connection is up and the SaaS application is in the correct region. What is the most likely cause?

Question 78easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the Prisma Access license and notices that the organization has purchased the Prisma Access for Networks license but not the Prisma Access for Users license. Which functionality is available with this license?

Question 79mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to enforce security policy for Mobile Users. The administrator wants to ensure that traffic from Mobile Users is inspected for threats and that users are identified by their corporate credentials. Which TWO components must be configured to achieve this? (Choose two.)

Question 80hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security engineer is troubleshooting why a Prisma Access mobile user's traffic to a specific external website is being allowed despite a security policy rule that should block it. The rule is configured with a source user of 'domain\jdoe' and a destination of 'any', and the action is deny. The user is authenticated via GlobalProtect with User-ID enabled. What is the most likely reason the rule is not matching?

Question 81easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the Prisma Access deployment and notices that a Remote Network site has been offline for several hours. The administrator wants to quickly identify whether the issue is related to the IPsec tunnel or to the underlying ISP connectivity. Which Prisma Access dashboard should the administrator use to view the tunnel status and related alerts?

Question 82mediummultiple choice

An administrator is deploying a new Prisma Access tenant for a company with branch offices in North America and Europe. The security team requires that all branch traffic egress through a Prisma Access location in the same region as the branch to minimize latency, while still allowing failover to another region during an outage. Which Prisma Access configuration should the administrator implement?

Question 83easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to verify that a newly configured remote network in Prisma Access is operational and passing traffic. Which status indicator in the Prisma Access dashboard should the administrator check first to confirm the IPSec tunnel is established?

Question 84mediummultiple choice

An administrator has deployed Prisma Access with a single Remote Network SPN at a branch office in Frankfurt. Users complain that after a failover of the primary ISP link, all traffic to SaaS applications is being forced through the backup link even though the primary link is healthy again. The administrator wants Prisma Access to automatically restore the preferred path without manual intervention. Which feature should be configured?

Question 85mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a Prisma Access issue where mobile users are unable to access a newly deployed internal web application. The application is hosted in the data center and is reachable from the service connection. Security policy allows the traffic. Which log source should the administrator check first to determine whether the traffic is reaching the service connection?

Question 86hardmulti select

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

Question 87mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has configured a Service Connection in Prisma Access with BGP to advertise internal routes. After a configuration change, internal users can no longer reach resources in a specific subnet. The administrator verifies that the BGP session is established and that the subnet is advertised from the on-premises router. Which action should the administrator take to ensure that Prisma Access accepts and uses the advertised route?

Question 88hardmultiple choice

A security administrator notices that Prisma Access is not enforcing a URL Filtering profile for traffic from a specific Remote Network. The profile is applied in a security policy rule that matches the Remote Network's source zone. The administrator confirms the rule is present and enabled. What is the most likely cause?

Question 89easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has just finished configuring a new Prisma Access tenant and wants to verify that Mobile Users can connect and that security policy is being applied. The administrator needs a high-level view of connected Mobile Users, their locations, and the applications in use. Which Prisma Access monitoring area should the administrator use?

Question 90easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to give the security team a single dashboard that shows which Prisma Access security policy rules are being triggered most frequently across all mobile users and Remote Networks over the last 30 days. Which Prisma Access reporting capability should the administrator use?

Question 91mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to provide access to a set of internal web applications for mobile users connected through Prisma Access. The applications are hosted in an on-premises data center and must be reachable only by authenticated users, with traffic inspected for threats. Which Prisma Access component should the administrator configure to enable this access?

Question 92hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to secure outbound internet traffic from a remote network site. The administrator wants to ensure that all traffic from the branch is inspected by Prisma Access security services, including threat prevention and URL filtering, before reaching the internet. Which Prisma Access component must be configured to direct branch traffic to the cloud security services?

Question 93hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

Question 94mediummultiple choice

An administrator is deploying a new Prisma Access tenant with a single service connection to an on-premises data center. The security team requires that all traffic from remote network branch offices to the data center be inspected by Prisma Access security policy before reaching internal applications. The administrator configures the remote network and service connection, but branch users report they can reach internal applications directly without any security inspection. What is the most likely cause?

Question 95mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to enforce security policies for mobile users based on the user's department. The administrator wants to ensure that only members of the 'Finance' department can access a sensitive internal application. Which Prisma Access feature should the administrator use to dynamically assign users to a policy group based on their department attribute from the identity provider?

Question 96hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a Prisma Access issue where mobile users in a specific region experience intermittent connectivity drops. The administrator observes that the GlobalProtect agent logs show repeated gateway selection changes. Which action should the administrator take to stabilize the connection?

Question 97mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing Prisma Access logs to investigate a security incident. The administrator needs to identify which user accessed a specific malicious URL. Which log type in Prisma Access provides the user identity along with the URL and action taken?

Question 98mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has configured Prisma Access to forward logs to an external SIEM using a HTTPS log forwarding profile. After a week, the SIEM shows no Prisma Access logs, but the Prisma Access dashboard shows traffic and threats. Which item should the administrator verify first?

Question 99easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security administrator needs to quickly identify which users are consuming the most bandwidth through Prisma Access mobile user connections over the past 24 hours. Which Prisma Access monitoring dashboard or report should the administrator use?

Question 100hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to provide secure internet access for mobile users. The organization requires that all traffic to known malicious domains be blocked, and that SSL decryption be performed for traffic to categories such as 'malware' and 'phishing' to inspect for threats. The administrator enables SSL decryption in the decryption policy for these categories. However, after testing, users can still access some known malicious sites without any block or decryption. What is the most likely reason?

Question 101mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access for a new remote network site. The site has a single ISP link and requires high availability for the IPSec tunnel to Prisma Access. The administrator wants to ensure that if the primary Prisma Access gateway becomes unavailable, the tunnel automatically fails over to a secondary gateway. Which feature should the administrator configure on the remote network device?

Question 102mediummultiple choice

A security administrator at a company using Prisma Access needs to ensure that only corporate-managed Windows devices running Windows 10 version 21H2 or later can access internal applications. The administrator has already configured a HIP profile that checks the OS version and a HIP object for the OS. Which additional component must be configured to enforce this requirement?

Question 103hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a Prisma Access mobile user who cannot access any internal applications. The administrator has verified that the GlobalProtect app shows a connected status and that the user's authentication is successful. Which two actions should the administrator take to identify the cause? (Choose two.)

Question 104hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is deploying Prisma Access for a new remote network site. The site requires access to both the internet and internal applications hosted in an on-premises data center. The administrator has configured a service connection to the data center. Which additional configuration is required to allow remote network users to access internal applications?

Question 1mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a HIP (Host Information Profile) check failure for mobile users. Where can the administrator view the collected HIP reports and check compliance status in real-time?

Question 2easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Where do administrators configure service connections in Prisma Access to connect the cloud security infrastructure to the organization's data center or headquarters?

Question 3hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Question 4mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An organization requires that specific SaaS applications are accessed only by corporate-managed devices that pass a specific HIP check. Which policy type should the administrator configure?

Question 5hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access administrator notices that remote network traffic destined for another remote network (branch-to-branch traffic) is being dropped or failing to establish. What is the required configuration to allow branch-to-branch traffic?

Question 6mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Question 7easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Question 8easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which action should an administrator take to update the Prisma Access software and plugin versions across the deployment?

Question 9hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Question 10easymultiple choice

An administrator wants to view real-time metrics, node status, and active connection counts for Prisma Access Mobile Users and Remote Networks directly from Panorama. Which tool within Panorama should the administrator access?

Question 11hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator configures Decryption Policies in Prisma Access to inspect inbound traffic destined for internal applications published via Service Connections. Users report that certain internal web applications using custom internal Certificate Authorities (CAs) are failing TLS handshakes. Where should the administrator check and install the enterprise internal CA certificate to resolve this inspection issue?

Question 12easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

When configuring Mobile Users in Prisma Access, an administrator needs to define the regions where GlobalProtect gateway nodes will be instantiated to serve remote workers. Which Panorama menu path is used to configure Mobile Users locations and bandwidth allocations?

Question 13mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a scenario where remote users connected via Prisma Access Mobile Users cannot access a specific newly added subnet behind a Remote Network location. Which configuration check should the administrator perform first in Panorama?

Question 14mediummultiple choice

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Question 15mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

When using Cloud Identity Engine (CIE) for authentication, which method allows for the most seamless user experience for mobile users?

Question 16hardmulti select

Read the full Prisma Access Administration And Operation explanation →

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Question 17easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access administrator must add a new remote network site in the Americas region and needs the branch firewall to establish the IPSec tunnel to the closest Prisma Access service connection. Which Prisma Access component must the branch firewall's IKE gateway peer address resolve to?

Question 18hardmultiple choice

An administrator needs to ensure that Security policy rules in Prisma Access apply consistently to both mobile users and remote networks. The administrator creates a rule with the source zone set to Trust and the destination zone set to Untrust. Mobile user traffic is being evaluated by the rule, but remote network traffic is not. Which action should the administrator take to correct the zone configuration?

Question 19mediummultiple choice

An administrator deploys Prisma Access with a Service Connection to an on-premises data center. Branch users connected through a Remote Network must reach an internal application server at 10.20.30.40/32, which is advertised from the data center over BGP. Traffic is reaching the service connection but the return path fails. Which Prisma Access configuration is required so that Prisma Access advertises the Remote Network summary route back to the data center BGP peer?

Question 20mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is deploying a new Prisma Access instance and needs to onboard a Remote Network site. The ISP has provided a single public IP address for the branch firewall. The administrator must configure the IPSec tunnel to Prisma Access using that address. Which TWO settings are required on the branch firewall to establish the tunnel? (Choose two.)

Question 21mediummultiple choice

An administrator is troubleshooting a Prisma Access deployment where mobile users in the branch office report that traffic to a newly deployed SaaS application is being blocked. The administrator has verified that the Security policy rule allowing the application is in place and that the user is authenticated. The administrator wants to determine whether the traffic is being processed by the correct Prisma Access node for that region. Which Prisma Access component should the administrator check to confirm the mobile user's assigned gateway?

Question 22hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator configures an Explicit Proxy in Prisma Access for a branch office. Users report that HTTP traffic is proxied correctly, but HTTPS sites fail with certificate errors. The administrator has installed the Forward Trust certificate on the endpoints. Which action resolves the HTTPS failures while keeping decryption enforcement intact?

Question 23hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to enforce Security policy based on user group membership for mobile users. The administrator wants to ensure that group-based rules are evaluated correctly. Which two actions must be completed to enable this functionality? (Choose two.)

Question 24hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring a Prisma Access remote network for a new branch office. The branch has two internet links and requires high availability. The administrator wants to ensure that if one link fails, traffic automatically fails over to the other. Which TWO configuration steps are required to achieve this? (Choose two.)

Question 25hardmultiple choice

A security engineer is configuring Security policy rules in Prisma Access for Mobile Users. The organization requires that traffic to known malicious domains be blocked based on DNS queries before a connection is established, and that users be shown a response page when blocked. Which Prisma Access feature should be used to meet this requirement?

Question 26mediummulti select

An administrator is troubleshooting a Prisma Access deployment where mobile users cannot reach a newly added internal application. The administrator wants to verify that the correct components are in place for the traffic to be routed and inspected. Which TWO items must be configured for mobile user traffic destined to an internal application to be forwarded through a Service Connection? (Choose two.)

Question 27hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring a Prisma Access deployment with multiple service connections to two different data centers. The security team wants to ensure that if one service connection fails, traffic from remote networks can still reach critical applications in the other data center. The administrator enables ECMP on the remote networks. Which TWO additional actions must be taken to ensure seamless failover and optimal routing? (Choose two.)

Question 28hardmulti select

An administrator is deploying Prisma Access for a large enterprise with multiple remote networks and mobile users. The administrator needs to ensure that all traffic is inspected by Prisma Access security services and that logging is centralized for compliance. Which TWO actions must the administrator take to ensure that logs from all Prisma Access components are forwarded to an external SIEM? (Choose two.)

Question 29mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to forward logs and alerts to an external SIEM. The security team requires that all traffic logs, threat logs, and system logs be sent to the SIEM in near real-time. Which TWO actions must the administrator take to meet this requirement? (Choose two.)

Question 30easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to give a security analyst read-only access to Prisma Access logs and dashboards without allowing configuration changes. Which role should be assigned in the Prisma Access tenant?

Question 31easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is setting up Prisma Access for the first time and needs to activate the service. The administrator has already configured the Prisma Access infrastructure in Panorama. Which step must be completed to make the Prisma Access service operational for mobile users?

Question 32hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is enabling Prisma Access for a new region and must ensure that mobile users in that region are terminated at a nearby Prisma Access location for optimal latency. The administrator has already onboarded the region and activated the infrastructure. Which setting determines which Prisma Access location a mobile user connects to?

Question 33mediummultiple choice

An administrator is troubleshooting a Prisma Access Remote Network deployment where branch users report intermittent access failures. The administrator suspects that a specific Service Connection is flapping. Which CLI command on the Prisma Access service connection VM should be used to verify the current status of the IPsec tunnels and confirm whether they are established?

Question 34mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Question 35easymultiple choice

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Question 36easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Question 37hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Question 38mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Question 39easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

Question 40mediummultiple choice

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

Question 41hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Question 42mediummulti select

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

Question 43mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

Question 44mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Question 45hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Question 46mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring security policies in Prisma Access and wants to ensure comprehensive protection against unknown threats and malware. Which TWO security profile types should be applied to outbound and internet-bound rules? (Choose two)

Question 47hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to optimize mobile user traffic performance and reduce latency in Prisma Access. Which THREE features or configurations can be utilized to achieve this? (Choose three)

Question 48hardmulti select

Read the full Prisma Access Administration And Operation explanation →

When designing high availability and redundancy for Prisma Access Remote Networks, which THREE considerations or practices are essential? (Choose three)

Question 49mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the operational health and logs of Prisma Access. Which TWO monitoring tools or log types are available within Panorama for troubleshooting security events and traffic flows? (Choose two)

Question 50mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Remote Networks in Prisma Access for a branch office using Internet Key Exchange Version 2 (IKEv2). During the configuration in Panorama, which component must be deployed on the branch office router to ensure proper IPsec tunnel establishment with the Prisma Access Service Connections and Remote Networks nodes?

Question 51hardmultiple choice

An enterprise using Prisma Access Mobile Users needs to enforce Host Information Profile (HIP) checks to ensure that endpoints have an active and updated corporate antimalware solution before granting access to internal applications. Which workflow must an administrator complete to successfully enforce this requirement?

Question 52mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An organization is migrating its identity provider integration to the Cloud Identity Engine (CIE) to support Prisma Access authentication and User-ID. When configuring the connection between CIE and the enterprise Active Directory, which component is required on-premises to sync directory objects securely without opening inbound firewall ports?

Question 53hardmulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring User-ID and authentication for Prisma Access using the Cloud Identity Engine (CIE). Which TWO actions must be performed to ensure successful authentication and group-based policy enforcement? (Choose two)

Question 54hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

You are troubleshooting a Mobile User connectivity issue where users cannot access internal resources. The Cloud Identity Engine (CIE) shows the user as authenticated, but the Security Policy log shows the traffic is dropped with 'policy-deny'. What is the most likely cause?

Question 55mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the status of Remote Networks in Prisma Access and notices that an IPsec tunnel has failed to establish. Which THREE diagnostic steps or verifications should the administrator perform in Panorama or Prisma Access Insights? (Choose three)

Question 56hardmulti select

When designing Security and Inspection Policies for Prisma Access, an administrator needs to ensure optimal performance and security coverage. Which THREE best practices should the administrator follow when implementing Security Policy rules in Panorama for Prisma Access? (Choose three)

Question 57easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which component in Prisma Access is responsible for performing decryption, content inspection, and threat prevention for mobile users?

Question 58mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

When configuring a Remote Network (RN) connection to an on-premises data center, which parameter is required to ensure proper routing of internal traffic via the IPSec tunnel?

Question 59hardmultiple choice

You are deploying Prisma Access and need to ensure that traffic from mobile users accessing the internet is inspected by a specific set of security profiles. Where should these profiles be applied?

Question 60easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

What is the primary function of the GlobalProtect Portal in a Prisma Access deployment?

Question 61hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Question 62mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Question 63easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

Question 64mediummulti select

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Question 65mediummulti select

Read the full Prisma Access Administration And Operation explanation →

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Question 66hardmulti select

Read the full Prisma Access Administration And Operation explanation →

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Question 67easymulti select

Read the full Prisma Access Administration And Operation explanation →

Which TWO configuration steps are required to allow internet access for Remote Network users?

Question 68mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator notices that Prisma Access mobile users in the EMEA region are being assigned IP addresses from the 10.20.0.0/16 pool, which overlaps with an internal subnet at 10.20.10.0/24 that users must reach. What should the administrator do in the Prisma Access mobile user configuration to avoid the conflict?

Question 69hardmulti select

An administrator is onboarding a new remote network in Prisma Access and wants to verify that the tunnel is healthy after configuration. Which two status indicators should the administrator check in the Prisma Access status view to confirm the remote network tunnel is up? (Choose two.)

Question 70mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has deployed Prisma Access with a single service connection to an on-premises data center. Branch users at a remote network report that traffic to an internal application hosted behind the data center firewall is being dropped, even though Security policy allows it. The administrator confirms the remote network tunnel is up and the service connection is green. Which configuration element should the administrator verify to allow the branch-to-data-center traffic to traverse the Prisma Access infrastructure?

Question 71mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

Question 72hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to give a security operations analyst read-only access to Prisma Access logs and reports without allowing any configuration changes. Which Prisma Access administrative role should the administrator assign in the identity provider or Panorama?

Question 73mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has deployed Prisma Access with a single Service Connection to an on-premises data center. Branch users at a Remote Network site report intermittent access to internal applications, while internet-bound traffic works reliably. The administrator suspects the Service Connection is the cause. Which action should the administrator take to confirm whether the Service Connection is the source of the problem?

Question 74mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator notices that Remote Network (branch) traffic to SaaS applications is being backhauled through the corporate data center instead of breaking out locally at the Prisma Access node. The administrator wants branch traffic destined to trusted SaaS applications to egress directly from the Prisma Access service connection. Which Prisma Access capability should be used to accomplish this?

Question 75hardmultiple choice

An administrator is deploying Prisma Access for a new Remote Network site that requires access to both the internet and internal applications. The administrator has already configured the Remote Network and Service Connection. Users report that internet access works, but internal application access fails. The administrator confirms that the Service Connection BGP session is established and advertising routes. Which configuration should the administrator verify next on the Remote Network?

Question 76hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A Prisma Access administrator needs to publish an internal web application to Mobile Users through a Private Application. The application uses a hostname that is not resolvable by public DNS. The administrator wants Mobile Users' browsers to reach the app using its internal FQDN without exposing the app to the internet. What must be configured to achieve this?

Question 77mediummultiple choice

An administrator has deployed Prisma Access for a branch office remote network that must reach a SaaS application through a service connection. After committing the configuration, users report that traffic is being dropped at the remote network firewall with the message 'no matching service connection found.' The administrator verifies that the service connection is up and the SaaS application is in the correct region. What is the most likely cause?

Question 78easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the Prisma Access license and notices that the organization has purchased the Prisma Access for Networks license but not the Prisma Access for Users license. Which functionality is available with this license?

Question 79mediummulti select

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to enforce security policy for Mobile Users. The administrator wants to ensure that traffic from Mobile Users is inspected for threats and that users are identified by their corporate credentials. Which TWO components must be configured to achieve this? (Choose two.)

Question 80hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security engineer is troubleshooting why a Prisma Access mobile user's traffic to a specific external website is being allowed despite a security policy rule that should block it. The rule is configured with a source user of 'domain\jdoe' and a destination of 'any', and the action is deny. The user is authenticated via GlobalProtect with User-ID enabled. What is the most likely reason the rule is not matching?

Question 81easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing the Prisma Access deployment and notices that a Remote Network site has been offline for several hours. The administrator wants to quickly identify whether the issue is related to the IPsec tunnel or to the underlying ISP connectivity. Which Prisma Access dashboard should the administrator use to view the tunnel status and related alerts?

Question 82mediummultiple choice

An administrator is deploying a new Prisma Access tenant for a company with branch offices in North America and Europe. The security team requires that all branch traffic egress through a Prisma Access location in the same region as the branch to minimize latency, while still allowing failover to another region during an outage. Which Prisma Access configuration should the administrator implement?

Question 83easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to verify that a newly configured remote network in Prisma Access is operational and passing traffic. Which status indicator in the Prisma Access dashboard should the administrator check first to confirm the IPSec tunnel is established?

Question 84mediummultiple choice

An administrator has deployed Prisma Access with a single Remote Network SPN at a branch office in Frankfurt. Users complain that after a failover of the primary ISP link, all traffic to SaaS applications is being forced through the backup link even though the primary link is healthy again. The administrator wants Prisma Access to automatically restore the preferred path without manual intervention. Which feature should be configured?

Question 85mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a Prisma Access issue where mobile users are unable to access a newly deployed internal web application. The application is hosted in the data center and is reachable from the service connection. Security policy allows the traffic. Which log source should the administrator check first to determine whether the traffic is reaching the service connection?

Question 86hardmulti select

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

Question 87mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has configured a Service Connection in Prisma Access with BGP to advertise internal routes. After a configuration change, internal users can no longer reach resources in a specific subnet. The administrator verifies that the BGP session is established and that the subnet is advertised from the on-premises router. Which action should the administrator take to ensure that Prisma Access accepts and uses the advertised route?

Question 88hardmultiple choice

A security administrator notices that Prisma Access is not enforcing a URL Filtering profile for traffic from a specific Remote Network. The profile is applied in a security policy rule that matches the Remote Network's source zone. The administrator confirms the rule is present and enabled. What is the most likely cause?

Question 89easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has just finished configuring a new Prisma Access tenant and wants to verify that Mobile Users can connect and that security policy is being applied. The administrator needs a high-level view of connected Mobile Users, their locations, and the applications in use. Which Prisma Access monitoring area should the administrator use?

Question 90easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to give the security team a single dashboard that shows which Prisma Access security policy rules are being triggered most frequently across all mobile users and Remote Networks over the last 30 days. Which Prisma Access reporting capability should the administrator use?

Question 91mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator needs to provide access to a set of internal web applications for mobile users connected through Prisma Access. The applications are hosted in an on-premises data center and must be reachable only by authenticated users, with traffic inspected for threats. Which Prisma Access component should the administrator configure to enable this access?

Question 92hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to secure outbound internet traffic from a remote network site. The administrator wants to ensure that all traffic from the branch is inspected by Prisma Access security services, including threat prevention and URL filtering, before reaching the internet. Which Prisma Access component must be configured to direct branch traffic to the cloud security services?

Question 93hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring a Prisma Access Service Connection for a data center that hosts both production and development workloads. The security team requires that mobile users accessing development subnets be inspected by a different security policy than those accessing production subnets, without deploying separate Service Connections. Which approach should the administrator take?

Question 94mediummultiple choice

An administrator is deploying a new Prisma Access tenant with a single service connection to an on-premises data center. The security team requires that all traffic from remote network branch offices to the data center be inspected by Prisma Access security policy before reaching internal applications. The administrator configures the remote network and service connection, but branch users report they can reach internal applications directly without any security inspection. What is the most likely cause?

Question 95mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to enforce security policies for mobile users based on the user's department. The administrator wants to ensure that only members of the 'Finance' department can access a sensitive internal application. Which Prisma Access feature should the administrator use to dynamically assign users to a policy group based on their department attribute from the identity provider?

Question 96hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is troubleshooting a Prisma Access issue where mobile users in a specific region experience intermittent connectivity drops. The administrator observes that the GlobalProtect agent logs show repeated gateway selection changes. Which action should the administrator take to stabilize the connection?

Question 97mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is reviewing Prisma Access logs to investigate a security incident. The administrator needs to identify which user accessed a specific malicious URL. Which log type in Prisma Access provides the user identity along with the URL and action taken?

Question 98mediummultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator has configured Prisma Access to forward logs to an external SIEM using a HTTPS log forwarding profile. After a week, the SIEM shows no Prisma Access logs, but the Prisma Access dashboard shows traffic and threats. Which item should the administrator verify first?

Question 99easymultiple choice

Read the full Prisma Access Administration And Operation explanation →

A security administrator needs to quickly identify which users are consuming the most bandwidth through Prisma Access mobile user connections over the past 24 hours. Which Prisma Access monitoring dashboard or report should the administrator use?

Question 100hardmultiple choice

Read the full Prisma Access Administration And Operation explanation →

An administrator is configuring Prisma Access to provide secure internet access for mobile users. The organization requires that all traffic to known malicious domains be blocked, and that SSL decryption be performed for traffic to categories such as 'malware' and 'phishing' to inspect for threats. The administrator enables SSL decryption in the decryption policy for these categories. However, after testing, users can still access some known malicious sites without any block or decryption. What is the most likely reason?

Question 101mediummultiple choice