SSE-Engineer Prisma Access Administration And Operation Practice Test 3 — 15 Questions

Question 1

An administrator is setting up Prisma Access for the first time and needs to activate the service. The administrator has already configured the Prisma Access infrastructure in Panorama. Which step must be completed to make the Prisma Access service operational for mobile users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activate the Prisma Access license and commit the configuration.. Activating the Prisma Access license and committing the configuration is the essential step that provisions the cloud infrastructure and makes the service operational. This action allocates the necessary resources in the Prisma Access cloud, enabling the deployment of mobile users and remote networks. Without activation, other configurations such as portal and gateway cannot be deployed, and the service remains inactive.

Answer

Deploy a GlobalProtect portal and gateway in the Prisma Access cloud.

Answer

Configure a service connection to the Prisma Access infrastructure.

Answer

Set up a remote network connection for each branch office.

Question 2

An administrator is enabling Prisma Access for a new region and must ensure that mobile users in that region are terminated at a nearby Prisma Access location for optimal latency. The administrator has already onboarded the region and activated the infrastructure. Which setting determines which Prisma Access location a mobile user connects to?

Accepted Answer

The source region detection that maps the user's public IP to the nearest activated Prisma Access location.. Prisma Access determines the terminating location by mapping the user's source public IP to a geographic region and directing them to the nearest activated location. This automatic selection provides low latency without per-user or per-gateway manual configuration once the region is onboarded and activated.

Answer

The GlobalProtect portal's list of preferred gateways, ordered by geographic proximity.

Answer

A DNS-based steering record that resolves the gateway hostname to the closest Prisma Access data center.

Answer

The mobile user region assignment on the GlobalProtect app, which maps the user to a Prisma Access location.

Question 3

An administrator is troubleshooting a Prisma Access Remote Network deployment where branch users report intermittent access failures. The administrator suspects that a specific Service Connection is flapping. Which CLI command on the Prisma Access service connection VM should be used to verify the current status of the IPsec tunnels and confirm whether they are established?

Accepted Answer

show vpn tunnel status. The correct command to verify IPsec tunnel status on the Prisma Access service connection VM is 'show vpn ipsec-sa'. This command displays the active IPsec security associations, including tunnel state, peer addresses, and encryption details. It helps confirm whether the tunnels are established and passing traffic. Other commands like 'show vpn ike-sa' show Phase 1 status but not the full tunnel status. Fabricated commands do not exist and would not provide any output.

Answer

show vpn ipsec-sa

Answer

show vpn ike-sa

Answer

show service-connection tunnel status

Question 4

An administrator needs to ensure that mobile users connecting via Prisma Access resolve internal domain names using the corporate DNS servers rather than public resolvers. Where is this configured?

Accepted Answer

Panorama > Cloud Services > Configuration > Mobile Users > Client Settings. Mobile user DNS settings for Prisma Access are configured under Panorama > Cloud Services > Configuration > Mobile Users > Client Settings, where the admin specifies the DNS servers (corporate internal resolvers) that GlobalProtect clients should use. This is the cloud-managed location for mobile user client configuration, including DNS, split tunnel, and other agent settings.

Answer

Objects > GlobalProtect > DNS Profile

Answer

Device > Setup > Services > DNS

Answer

Network > GlobalProtect > Gateway > DNS

Question 5

An administrator needs to configure remote networks in Prisma Access to connect branch locations. Where is this configuration primarily managed within the Prisma Access architecture?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks. Prisma Access remote networks and mobile user configurations are managed centrally through Panorama using the Cloud Services plugin.

Answer

Prisma Access App > Traffic Steering > Remote Networks

Answer

Policies > Security > Remote Networks

Answer

Device > Setup > Operations > Remote Networks

Question 6

A network administrator wants to enable User-ID for mobile users connecting via GlobalProtect in Prisma Access. Which component should be configured to map users to IP addresses when using the Cloud Identity Engine?

Accepted Answer

Configure Cloud Identity Engine (CIE) settings in Panorama to sync directory services.. Cloud Identity Engine (CIE) is Palo Alto's cloud-hosted directory service that syncs user identity from on-prem AD, Microsoft Entra ID, or other directories and feeds that mapping to Prisma Access. Configuring CIE in Panorama is the supported way to provide User-ID mappings for GlobalProtect mobile users without deploying on-prem User-ID agents. CIE then distributes IP-to-user mappings to the Prisma Access compute nodes.

Answer

Configure a User-ID agent on every branch router.

Answer

Install the GlobalProtect agent with local syslog forwarding.

Answer

Enable captive portal authentication on all remote network firewalls.

Question 7

A security engineer needs to configure a Security policy rule in Prisma Access that targets users belonging to a specific Active Directory group synced via the Cloud Identity Engine. How should the source user be specified in the Security rule?

Accepted Answer

In the Source User field, add the fully qualified group name provided by CIE.. When using CIE or User-ID, security rules reference group objects directly using the format domain\group or the discovered group name.

Answer

In the Source Device field, select the Cloud Identity Engine connector object.

Answer

In the IP/Netmask field, enter the subnet assigned by the CIE connector.

Answer

In the Destination field, specify the LDAP server IP address.

Question 8

An administrator wants to inspect outbound web traffic from mobile users for malware and spyware using Prisma Access. Which security profile type must be attached to the Security policy rule?

Accepted Answer

Antivirus and Anti-Spyware profiles. To inspect outbound web traffic for malware and spyware, the Security policy rule must have Antivirus and Anti-Spyware security profiles attached. These profiles perform content inspection for malicious files and spyware signatures on allowed traffic, which is required for Prisma Access to detect and block those threats.

Answer

Decryption profile and URL filtering profile only

Answer

QoS Profile and Zone Protection profile

Answer

HIP Profile and WildFire analysis profile

Question 9

Which tool provides end-to-end visibility into Prisma Access performance, user experience metrics, and digital experience monitoring (DEM)?

Accepted Answer

Prisma Access ADEM (Autonomous Digital Experience Management). Prisma Access ADEM (Autonomous Digital Experience Management) is the dedicated module that provides end-to-end visibility into Prisma Access performance, including user experience metrics, hop-by-hop path analysis, and digital experience monitoring. It correlates network, endpoint, and application telemetry to surface real-time and historical experience scores for users, apps, and locations. This is precisely the DEM capability described in the question.

Answer

WildFire Portal reporting

Answer

Panorama Packet Capture utility

Answer

GlobalProtect Syslog Analyzer

Question 10

An administrator needs to configure secure access for remote networks using dynamic routing (BGP). Where are the BGP peer parameters, local AS number, and peer AS configured in Prisma Access?

Accepted Answer

Panorama > Cloud Services > Configuration > Remote Networks > [Select Network] > BGP. BGP settings for remote networks are configured within the Remote Network definition in the Panorama Cloud Services plugin.

Answer

Objects > Remote Networks > BGP Profile

Answer

Network > Virtual Routers > BGP

Answer

Device > Setup > Routing > BGP

Question 11

An administrator is troubleshooting connectivity issues for a remote network connected to Prisma Access via IPsec VPN. Which TWO checks should be performed to verify tunnel health and status? (Choose two)

Accepted Answer

Check the IPsec tunnel status under Panorama > Cloud Services > Status > Remote Networks.. Option B is correct because Panorama's Cloud Services status page (Panorama > Cloud Services > Status > Remote Networks) is the authoritative place to view the IPsec tunnel state for a remote network, showing whether the tunnel is up/down and its IKE/IPsec status. Option E is correct because an IPsec VPN tunnel only establishes when both peers agree on matching IKE phase 1 and phase 2 parameters, including encryption and authentication algorithms, DH group, and lifetime, so verifying these cryptographic and phase settings on both the Prisma Access side and the customer edge router is essential for tunnel health. Option A is not relevant because GlobalProtect client runtime logs pertain to mobile user connectivity, not a site-to-site IPsec remote network tunnel. Option C is not relevant because DNS resolver settings affect name resolution, not IPsec tunnel establishment or status. Option D is not applicable because a physical cable test from a Prisma Access cloud node to a carrier router is not a supported or practical troubleshooting step in the Prisma Access cloud environment.

Answer

Inspect the GlobalProtect client runtime logs on the mobile user's laptop.

Answer

Check the DNS resolver settings in the local device setup tab.

Answer

Run a physical cable test from the Prisma Access cloud node to the carrier router.

Question 12

When configuring Security policy rules in Prisma Access, which THREE types of criteria can be used to control traffic traversing the cloud infrastructure? (Choose three)

Accepted Answer

Source and destination security zones. In Prisma Access Security policy rules, traffic is matched using the same rich criteria as PAN-OS, including source and destination security zones (Option A), which represent the trust/zone context of the source and destination of the flow (e.g., trust, untrust, and Prisma Access-specific zones like remote networks or mobile users) and are fundamental match conditions for policy enforcement. Option C is correct because App-ID identifies applications regardless of port/protocol, allowing rules to permit or deny traffic based on the actual application (e.g., salesforce, ssl, web-browsing), which is a core Prisma Access policy criterion. Option E is correct because User-ID and Cloud Identity Engine (CIE) provide user and group identity mapping, enabling identity-based rules (e.g., matching specific AD groups or users) for mobile users and remote networks. The unmarked options do not belong: local physical switch port numbers on the cloud node (Option B) are not exposed as policy match criteria in Prisma Access, and hardware motherboard serial numbers of client machines (Option D) are not used by Security policy rules to control traffic.

Answer

Local physical switch port numbers on the cloud node

Answer

Hardware motherboard serial numbers of client machines

Question 13

An administrator wants to ensure that mobile users comply with security posture policies before accessing corporate applications. Which TWO elements are required to enforce HIP (Host Information Profile) checking? (Choose two)

Accepted Answer

Enable HIP data collection on the GlobalProtect agent settings.. Option A is correct because HIP enforcement begins with the GlobalProtect agent collecting host information; enabling HIP data collection in the agent settings (Config > GlobalProtect > Agent > HIP Data Collection) allows the endpoint to gather and submit HIP data to the gateway. Option C is correct because collecting HIP data alone does nothing unless a Security policy rule references a HIP Object or HIP Profile in its Source HIP field, which is what actually enforces the posture requirement before granting access to corporate applications. Option B is incorrect because static ARP entries are a Layer 2 addressing mechanism unrelated to host posture assessment. Option D is incorrect because WildFire is a cloud-based malware analysis service, not a requirement for HIP checking. Option E is incorrect because HIP checking uses the GlobalProtect agent's built-in data collection, not a locally installed proxy server.

Answer

Configure static ARP entries on the GlobalProtect gateway.

Answer

Deploy WildFire appliance hardware at every branch location.

Answer

Install a local proxy server on every mobile device.

Question 14

An administrator is configuring Mobile Users in Prisma Access and needs to set up user authentication. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)

Accepted Answer

LDAP directory authentication. Option D (LDAP directory authentication) is correct because Prisma Access GlobalProtect natively supports LDAP as an authentication profile, allowing mobile users to be validated against on-premises or cloud directory servers such as Active Directory or OpenLDAP. Option E (SAML 2.0 identity provider integration) is correct because Prisma Access GlobalProtect supports SAML 2.0 for single sign-on, redirecting users to an IdP like Okta, Microsoft Entra ID, or PingID for authentication. Option A is incorrect because Prisma Access cloud nodes do not maintain a local user database for GlobalProtect authentication; local authentication is not a supported native method in the cloud infrastructure. Option B is incorrect because WPA3 Enterprise 802.1X is a wireless LAN authentication standard, not a GlobalProtect mobile user authentication method. Option C is incorrect because IPsec pre-shared keys are used for tunnel or peer authentication, not for authenticating individual GlobalProtect mobile users.

Answer

Local database accounts stored on the individual Prisma Access cloud nodes

Answer

WPA3 Enterprise 802.1X enterprise tunneling

Answer

IPsec Pre-Shared Key user authentication

Question 15

An administrator is setting up the Cloud Identity Engine (CIE) to support user mapping and authentication for Prisma Access. Which THREE components or steps are required for a successful CIE deployment? (Choose three)

Accepted Answer

Configure a Directory Service connector to sync users and groups from Active Directory.. Option A is correct because CIE requires a Directory Service connector (e.g., a Cloud Identity Engine Directory Sync/Connector) to pull users and groups from Active Directory or another LDAP source so identity data is available for policy. Option B is correct because after syncing directories, the administrator must configure authentication settings and map user attributes (such as UPN, email, or group attributes) in CIE so Prisma Access can resolve users to the right identity and group context. Option D is correct because the CIE tenant must be linked/associated with the Prisma Access or Panorama instance so that user mapping and authentication data can be consumed by Prisma Access for policy enforcement. Option C is not required because CIE is a cloud service and does not need physical Domain Controllers installed inside each Prisma Access cloud node; directory data is synced from existing on-premises or cloud directories. Option E is not required because BGP peering to enterprise DNS servers is unrelated to CIE user mapping and authentication; CIE does not use BGP for identity synchronization.

Answer

Install physical Domain Controllers inside each Prisma Access cloud node.

Answer

Configure BGP peering between CIE and the enterprise DNS servers.