SSE-Engineer Prisma Access Administration And Operation Practice Test 2 — 15 Questions

Question 1

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. Option A is correct because a HIP Profile only takes effect when it is referenced in the Security Policy rule's Source HIP Profile field, which is what actually enforces the HIP-based match condition on traffic. Option B is correct because the GlobalProtect portal must have HIP data collection enabled so that endpoints report their host information, which is then evaluated against HIP Objects and Profiles. Option D is correct because HIP Objects and HIP Profiles must first be defined in the Panorama object library (or firewall) before they can be pushed to managed firewalls and referenced in policy. Option C is not required, since a single GlobalProtect gateway can serve users at different security levels; HIP enforcement is done through policy, not by creating separate gateways. Option E is not required, as the on-premises User-ID agent maps IP addresses to users and is unrelated to collecting or enforcing HIP data.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 2

A Prisma Access administrator must add a new remote network site in the Americas region and needs the branch firewall to establish the IPSec tunnel to the closest Prisma Access service connection. Which Prisma Access component must the branch firewall's IKE gateway peer address resolve to?

Accepted Answer

The Prisma Access service connection IP address assigned to the remote network in the Panorama template stack.. Remote network tunnels terminate on the service connection IP that Prisma Access assigns for the region where the remote network is onboarded. The branch firewall's IKE gateway must reference that address so the tunnel lands on the correct service connection, where routing, security policy, and decryption for branch traffic are enforced.

Answer

The Cortex Data Lake ingestion endpoint for the region where the branch is located.

Answer

The public IP of the Panorama management server that orchestrates the Prisma Access tenant.

Answer

The Prisma Access mobile user portal FQDN that GlobalProtect clients use for authentication.

Question 3

An administrator needs to ensure that Security policy rules in Prisma Access apply consistently to both mobile users and remote networks. The administrator creates a rule with the source zone set to Trust and the destination zone set to Untrust. Mobile user traffic is being evaluated by the rule, but remote network traffic is not. Which action should the administrator take to correct the zone configuration?

Accepted Answer

Use the 'any' zone in the source and destination fields so the rule matches both mobile user and remote network traffic.. Prisma Access uses distinct zones for mobile users and remote networks, so a rule matching the Trust zone may only apply to one traffic type. To enforce a single rule across both, the administrator should use the 'any' zone or a shared zone construct. This allows the rule to match traffic from either component without duplicating policy, ensuring consistent enforcement.

Answer

Recreate the rule under the Remote Networks policy tab instead of the Mobile Users policy tab.

Answer

Enable the 'Apply to Remote Networks' checkbox in the Security policy rule settings.

Answer

Change the source zone to the mobile user zone and add a separate rule for the remote network zone.

Question 4

An administrator deploys Prisma Access with a Service Connection to an on-premises data center. Branch users connected through a Remote Network must reach an internal application server at 10.20.30.40/32, which is advertised from the data center over BGP. Traffic is reaching the service connection but the return path fails. Which Prisma Access configuration is required so that Prisma Access advertises the Remote Network summary route back to the data center BGP peer?

Accepted Answer

Enable 'Advertise to Service Connections' under the Remote Network configuration and specify the summary route.. Route exchange between a Remote Network and a Service Connection happens over BGP. For the data center to reach branch users, Prisma Access must originate the branch summary prefix toward the service connection peer. Enabling advertisement on the Remote Network and specifying the summary route accomplishes this, restoring bidirectional connectivity.

Answer

Enable 'Return Path Symmetry' in the Service Connection settings to force replies through the same tunnel.

Answer

Configure a static route on the Remote Network pointing to the data center subnet and redistribute it into OSPF.

Answer

Add a Policy-Based Forwarding rule on the mobile user security policy to redirect internal traffic to the service connection.

Question 5

An administrator is deploying a new Prisma Access instance and needs to onboard a Remote Network site. The ISP has provided a single public IP address for the branch firewall. The administrator must configure the IPSec tunnel to Prisma Access using that address. Which TWO settings are required on the branch firewall to establish the tunnel? (Choose two.)

Accepted Answer

Configure the IKE gateway with the Prisma Access Remote Network IPSec termination point as the peer address.. Establishing an IPSec tunnel from a branch firewall to a Prisma Access Remote Network requires the branch to know the peer address of the Prisma Access termination point and to authenticate with the credential issued during onboarding. Configuring the IKE gateway with the correct peer IP and the matching pre-shared key or certificate enables Phase 1 to complete, after which the tunnel and routing can be established.

Answer

Enable NAT-Traversal on the IKE gateway only if the branch is behind a device performing NAT.

Answer

Configure a loopback interface with the Prisma Access internal IP and use it as the local IKE identity.

Answer

Configure the tunnel interface with a /24 subnet matching the Prisma Access Service Connection subnet.

Question 6

An administrator is troubleshooting a Prisma Access deployment where mobile users in the branch office report that traffic to a newly deployed SaaS application is being blocked. The administrator has verified that the Security policy rule allowing the application is in place and that the user is authenticated. The administrator wants to determine whether the traffic is being processed by the correct Prisma Access node for that region. Which Prisma Access component should the administrator check to confirm the mobile user's assigned gateway?

Accepted Answer

The GlobalProtect app logs on the endpoint, which show the connected gateway and portal FQDN.. The GlobalProtect app logs on the endpoint are the definitive source for confirming which Prisma Access gateway a mobile user is connected to. These logs record the gateway FQDN and connection details, enabling the administrator to verify the correct regional node and correlate with policy enforcement. Other tools provide aggregate or indirect information and are less precise for this troubleshooting task.

Answer

The Mobile Users—GlobalProtect logs in the Prisma Access monitoring interface, filtered by the user's IP address.

Answer

The Prisma Access service connection status in the Panorama dashboard, which lists all service connections and their associated regions.

Answer

The Prisma Access network topology map, which shows the geographic distribution of all mobile users and their connected regions.

Question 7

An administrator configures an Explicit Proxy in Prisma Access for a branch office. Users report that HTTP traffic is proxied correctly, but HTTPS sites fail with certificate errors. The administrator has installed the Forward Trust certificate on the endpoints. Which action resolves the HTTPS failures while keeping decryption enforcement intact?

Accepted Answer

Import the Forward Trust CA certificate into the endpoint trust store and ensure the decryption policy uses that same certificate for forward proxy.. HTTPS decryption through an explicit proxy relies on the endpoint trusting the Forward Trust CA that signs the generated certificates. When endpoints do not trust that CA, browsers raise certificate errors even though decryption is working as designed. Importing the Forward Trust CA into the endpoint trust store restores trust and keeps inspection enforced.

Answer

Add the internal HTTPS sites to the SSL Decryption Exclude list so they bypass inspection.

Answer

Disable SSL decryption for the HTTPS traffic in the decryption policy so the proxy can pass traffic without inspecting it.

Answer

Change the explicit proxy listening port from 8080 to 443 so HTTPS traffic is not intercepted by the proxy.

Question 8

An administrator is configuring Prisma Access to enforce Security policy based on user group membership for mobile users. The administrator wants to ensure that group-based rules are evaluated correctly. Which two actions must be completed to enable this functionality? (Choose two.)

Accepted Answer

Configure User-ID agents to map users to groups.. To enforce group-based Security policy for mobile users in Prisma Access, the administrator must ensure that user-to-group mappings are available. This requires configuring User-ID agents and integrating Prisma Access with Cloud Identity Engine or an on-premises User-ID agent. These actions provide the group data that Security policy rules use to match traffic. Without them, group-based rules cannot be evaluated correctly.

Answer

Enable the 'Group Mapping' setting in the GlobalProtect portal configuration.

Answer

Configure a SAML identity provider for user authentication.

Answer

Create a Security policy rule with the source user group as a match criterion.

Question 9

An administrator is configuring a Prisma Access remote network for a new branch office. The branch has two internet links and requires high availability. The administrator wants to ensure that if one link fails, traffic automatically fails over to the other. Which TWO configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Configure tunnel monitoring on the branch firewall to detect link failures and trigger failover.. High availability for a Prisma Access remote network requires redundant IPSec tunnels over separate internet links and a mechanism to detect failures and fail over. Configuring two tunnels with different public IPs provides the redundancy, and tunnel monitoring on the branch firewall enables automatic failover when a link fails. These two steps together ensure continuous connectivity without manual intervention.

Answer

Enable 'Active/Active' mode in the remote network configuration so both tunnels are used simultaneously.

Answer

Assign a higher priority to the primary tunnel in the Prisma Access service connection configuration.

Answer

Enable BGP between the branch firewall and Prisma Access to dynamically route traffic over the available tunnels.

Question 10

A security engineer is configuring Security policy rules in Prisma Access for Mobile Users. The organization requires that traffic to known malicious domains be blocked based on DNS queries before a connection is established, and that users be shown a response page when blocked. Which Prisma Access feature should be used to meet this requirement?

Accepted Answer

Enable DNS Security in a Security policy rule with a sinkhole action for malicious domains.. DNS Security inspects DNS queries and can block or sinkhole requests to known malicious domains, preventing the client from ever connecting. Using a sinkhole action in a Security policy rule redirects the user to a response page, which satisfies the requirement to block based on DNS queries and to notify the user. This provides earlier protection than URL or file-based inspection.

Answer

Configure a WildFire analysis profile that blocks sessions to malicious domains.

Answer

Create a Decryption policy that blocks SSL traffic to malicious domains.

Answer

Configure a URL Filtering profile with a block action for malicious categories in a Security policy rule.

Question 11

An administrator is troubleshooting a Prisma Access deployment where mobile users cannot reach a newly added internal application. The administrator wants to verify that the correct components are in place for the traffic to be routed and inspected. Which TWO items must be configured for mobile user traffic destined to an internal application to be forwarded through a Service Connection? (Choose two.)

Accepted Answer

A security policy rule that permits the mobile user zone to the internal application and includes the service connection as the egress path.. Mobile user traffic reaches internal applications through a Service Connection when the on-premises router advertises the application subnet over BGP and a security policy permits the traffic with the service connection as egress. Together these provide the route and the permission needed for private forwarding.

Answer

A GlobalProtect portal agent configuration that lists the internal application subnet in the split tunnel include list.

Answer

A NAT policy on the service connection that translates the mobile user source address to the data center subnet.

Answer

An SD-WAN policy that prefers the service connection over the internet for the internal application prefix.

Question 12

An administrator is configuring a Prisma Access deployment with multiple service connections to two different data centers. The security team wants to ensure that if one service connection fails, traffic from remote networks can still reach critical applications in the other data center. The administrator enables ECMP on the remote networks. Which TWO additional actions must be taken to ensure seamless failover and optimal routing? (Choose two.)

Accepted Answer

Ensure that both service connections are associated with the same remote network.. To achieve seamless failover and load balancing across multiple service connections in Prisma Access, the remote network must be associated with both service connections, and the routes to the data center subnets must have equal metrics so that ECMP can install multiple next-hops. This allows traffic to be distributed and ensures that if one service connection fails, the other remains available without manual intervention.

Answer

Enable BGP on the remote network and configure it to advertise the data center subnets.

Answer

Configure a static route on each remote network for the data center subnets pointing to the primary service connection.

Answer

Set the same priority for both service connections in the Prisma Access configuration.

Question 13

An administrator is deploying Prisma Access for a large enterprise with multiple remote networks and mobile users. The administrator needs to ensure that all traffic is inspected by Prisma Access security services and that logging is centralized for compliance. Which TWO actions must the administrator take to ensure that logs from all Prisma Access components are forwarded to an external SIEM? (Choose two.)

Accepted Answer

Configure the Prisma Access infrastructure to send logs to an external syslog server via the Panorama log forwarding settings.. To forward Prisma Access logs to an external SIEM, the administrator must configure a log forwarding profile and attach it to Security policy rules, ensuring that logs from those rules are sent externally. Additionally, configuring Panorama log forwarding settings to an external syslog server ensures that all logs from Prisma Access components are forwarded. Together, these actions provide centralized logging for compliance.

Answer

Use the Prisma Access API to pull logs periodically and push them to the SIEM.

Answer

Enable the Prisma Access logging service and set the retention period to 90 days.

Answer

Deploy a dedicated log collector in each remote network site to aggregate logs locally.

Question 14

An administrator is configuring Prisma Access to forward logs and alerts to an external SIEM. The security team requires that all traffic logs, threat logs, and system logs be sent to the SIEM in near real-time. Which TWO actions must the administrator take to meet this requirement? (Choose two.)

Accepted Answer

Configure a Log Forwarding profile in Prisma Access and attach it to security policy rules to forward traffic and threat logs.. To forward logs to an external SIEM, Prisma Access requires both a log forwarding destination and a log forwarding profile attached to security rules. The destination defines where logs are sent, while the profile selects which log types are forwarded. Together, they enable near real-time delivery of traffic, threat, and system logs to the SIEM.

Answer

Create a Service Connection to the SIEM to allow logs to traverse the internal network.

Answer

Enable Cortex Data Lake integration and rely on it to automatically push all logs to the SIEM without additional configuration.

Answer

Configure a Decryption policy to ensure all logs are decrypted before forwarding to the SIEM.

Question 15

An administrator needs to give a security analyst read-only access to Prisma Access logs and dashboards without allowing configuration changes. Which role should be assigned in the Prisma Access tenant?

Accepted Answer

Read-Only Administrator. For monitoring and investigation without configuration rights, the Read-Only Administrator role is appropriate. It provides visibility into logs, dashboards, and settings while preventing commits or policy edits, aligning with least privilege for an analyst who only needs to observe.

Answer

Logs and Reports Administrator

Answer

Superuser

Answer

Auditor