SSE-Engineer Prisma Access Administration And Operation Practice Test 5 — 15 Questions

Question 1

A user is experiencing 'Gateway not found' errors. Which troubleshooting step is most effective for verifying if the GlobalProtect Gateway is reachable?

Accepted Answer

Performing an nslookup on the portal-provided gateway FQDN.. The 'nslookup' or 'ping' of the FQDN assigned to the gateway is the standard way to verify resolution and connectivity.

Answer

Verifying the IPSec tunnel status in Panorama.

Answer

Checking the User-ID Agent logs on-premises.

Answer

Restarting the Cloud Identity Engine service.

Question 2

Which object type should be used to restrict access to a specific internal application for Remote Network users while ensuring the policy is scalable?

Accepted Answer

Address objects or Address Groups.. Address objects or Address Groups allow for efficient grouping and reuse in security policies.

Answer

URL filtering category.

Answer

Service objects based on port numbers only.

Answer

Interface-based rules.

Question 3

What is the benefit of using Prisma Access for Remote Networks instead of traditional site-to-site VPNs?

Accepted Answer

It provides centralized, unified security policy management and inspection.. Prisma Access simplifies management and provides consistent security policy enforcement across all locations.

Answer

It allows local traffic to bypass security inspection entirely.

Answer

It eliminates the need for internet connectivity at the branch.

Answer

It removes the need for any internal firewalls.

Question 4

Which TWO of the following are prerequisites for setting up Cloud Identity Engine (CIE) with Prisma Access?

Accepted Answer

An identity provider (IdP) integration, such as Azure AD or Okta.. Option C is correct because Cloud Identity Engine (CIE) requires an external identity provider integration — such as Microsoft Entra ID, Okta, or another SAML/SCIM-capable IdP — to synchronize user and group directory data into CIE for policy enforcement in Prisma Access. Option E is correct because the CIE service itself must be enabled/activated within the Prisma Access tenant (via the hub or the CIE portal) before directory sync and identity-based policies can be configured. Option A is incorrect because CIE is a cloud service that ingests directory data from a supported IdP or on-premises directory sync agent; it does not require an Active Directory Domain Controller to be installed on Prisma Access infrastructure. Option B is incorrect because DNS configuration on a local workstation is a general client-side requirement, not a prerequisite for provisioning CIE with Prisma Access. Option D is incorrect because CIE is a cloud-delivered identity service and does not require deploying a hardware firewall at every branch.

Answer

Active Directory Domain Controller installation on Prisma Access.

Answer

Configuring DNS on the local workstation.

Answer

Deploying a hardware firewall at every branch.

Question 5

When managing Security Policies in Prisma Access, which TWO components are essential to ensure that policies are correctly applied to traffic?

Accepted Answer

Using source/destination address objects or tags.. In Prisma Access security policy rules, traffic matching is driven by zone-based evaluation, so option E (defining source and destination zones) is essential because the firewall uses the source and destination security zones to determine which policy rule applies to a given flow. Option A (using source/destination address objects or tags) is also essential because address objects, address groups, and tags (including dynamic tags via VM-Series or User-ID/GlobalProtect context) provide the granular match criteria that identify which specific hosts, subnets, or user groups a rule governs. Together, zones plus address objects/tags form the core match criteria that ensure a policy is correctly applied to the intended traffic. Option B is not required because SSL inspection is a security profile/decryption setting, not a prerequisite for policy matching, and it is not applied to all traffic by default. Option C is incorrect because Prisma Access policies are zone-based, not physical-port-based, since the underlying infrastructure is abstracted in the cloud. Option D is incorrect because the GlobalProtect client version is an endpoint/app configuration concern, not a policy match criterion for applying security rules.

Answer

Enabling SSL inspection on all traffic.

Answer

Defining the physical port number.

Answer

Configuring the GlobalProtect client version.

Question 6

Which THREE factors influence the selection of a Compute Location in a Prisma Access deployment?

Accepted Answer

Local ISP latency and bandwidth.. Compute locations are chosen based on proximity to users, licensing availability, and the specific traffic type.

Answer

The number of users in the local branch.

Answer

The color of the hardware appliance.

Question 7

Which TWO configuration steps are required to allow internet access for Remote Network users?

Accepted Answer

Enable Internet Access in the Remote Network configuration.. Option A is correct because enabling Internet Access in the Remote Network configuration is the explicit setting that turns on internet-bound traffic handling for that remote network, allowing the firewall to route and NAT remote users' traffic to the internet. Option E is correct because, once internet access is enabled, a Security Policy permitting traffic from the Remote Network zone to the Internet zone is required to actually allow the sessions through the firewall's policy engine. Options B, C, and D are not required: a local proxy server is not needed for basic internet access, static IP addresses on mobile devices are unnecessary since DHCP or dynamic addressing works, and an IPSec tunnel to a third-party ISP is unrelated to enabling internet access for remote network users.

Answer

Install a local proxy server.

Answer

Assign a static IP address to every mobile device.

Answer

Configure an IPSec tunnel to a third-party ISP.

Question 8

An administrator notices that Prisma Access mobile users in the EMEA region are being assigned IP addresses from the 10.20.0.0/16 pool, which overlaps with an internal subnet at 10.20.10.0/24 that users must reach. What should the administrator do in the Prisma Access mobile user configuration to avoid the conflict?

Accepted Answer

Change the mobile user IP pool to a non-overlapping range and commit the Prisma Access configuration.. Mobile user IP pools in Prisma Access must be unique and must not overlap with internal subnets that clients must reach. The reliable fix is to reassign the mobile user pool to a non-overlapping range so the client address space and the internal address space remain distinct, then commit the change to the Prisma Access tenant.

Answer

Add a static route on the internal network pointing 10.20.0.0/16 to the Prisma Access service connection.

Answer

Configure a NAT policy on Prisma Access to translate the mobile user pool to a different range.

Answer

Enable split tunneling so that 10.20.10.0/24 is excluded from the GlobalProtect tunnel.

Question 9

An administrator is onboarding a new remote network in Prisma Access and wants to verify that the tunnel is healthy after configuration. Which two status indicators should the administrator check in the Prisma Access status view to confirm the remote network tunnel is up? (Choose two.)

Accepted Answer

The IPSec tunnel status showing connected for the specific remote network site.. To confirm a remote network tunnel is healthy, the administrator should verify that the IPSec tunnel state is connected and, when dynamic routing is configured, that the BGP peering session is established. Together these confirm the data plane is up and internal routes are being exchanged between the branch and Prisma Access.

Answer

The Cortex Data Lake license consumption for the tenant.

Answer

The number of decryption policy hits on the service connection.

Answer

The GlobalProtect agent version reported by mobile users in the region.

Question 10

An administrator has deployed Prisma Access with a single service connection to an on-premises data center. Branch users at a remote network report that traffic to an internal application hosted behind the data center firewall is being dropped, even though Security policy allows it. The administrator confirms the remote network tunnel is up and the service connection is green. Which configuration element should the administrator verify to allow the branch-to-data-center traffic to traverse the Prisma Access infrastructure?

Accepted Answer

The Service Connection's advertised routes and the remote network's route table to ensure the data center prefix is reachable.. Branch-to-data-center traffic in Prisma Access depends on the service connection advertising the on-premises prefixes and the remote network learning them. If the data center prefix is not present in the remote network's route table, Prisma Access has no path and drops the traffic. The correct troubleshooting step is to verify route advertisement and the remote network route table, not portal agent settings or decryption policy, which apply to different traffic types.

Answer

The decryption policy on the remote network firewall to ensure the application traffic is not being blocked by SSL inspection.

Answer

The Remote Network's static route for the data center subnet pointing to the service connection.

Answer

The GlobalProtect portal agent configuration to confirm the branch users are assigned the correct internal DNS suffix.

Question 11

A security team wants to ensure that all traffic from mobile users to sanctioned SaaS applications is inspected for data patterns while traffic to unsanctioned applications is blocked. Which Prisma Access policy type should the administrator configure to enforce this per-application control?

Accepted Answer

A SaaS security policy rule that identifies the application and applies the allow or block action.. SaaS security policies are the Prisma Access mechanism for identifying SaaS applications and enforcing sanctioned versus unsanctioned behavior. They allow the administrator to permit and inspect approved SaaS applications for data patterns while blocking unsanctioned ones, which matches the team's requirement precisely.

Answer

A decryption policy that decrypts all SSL traffic to SaaS applications.

Answer

A URL filtering profile that categorizes SaaS domains and applies block or allow actions.

Answer

A security policy rule using application filters for all web-browsing traffic.

Question 12

An administrator needs to give a security operations analyst read-only access to Prisma Access logs and reports without allowing any configuration changes. Which Prisma Access administrative role should the administrator assign in the identity provider or Panorama?

Accepted Answer

A role that grants read-only access to Prisma Access logs and reports but no configuration permissions.. The administrator should assign a role that provides read-only access to Prisma Access logs and reports without configuration permissions. This follows least privilege, letting the analyst perform monitoring and reporting duties while preventing changes to policies, objects, or tenant settings.

Answer

A device administrator role scoped only to the firewall devices in the tenant.

Answer

An auditor role that can modify audit logs and retention settings for the tenant.

Answer

A superuser role that allows full configuration and monitoring access to the Prisma Access tenant.

Question 13

An administrator has deployed Prisma Access with a single Service Connection to an on-premises data center. Branch users at a Remote Network site report intermittent access to internal applications, while internet-bound traffic works reliably. The administrator suspects the Service Connection is the cause. Which action should the administrator take to confirm whether the Service Connection is the source of the problem?

Accepted Answer

Review the Service Connection status in Prisma Access Insights and verify the IPsec tunnel state and BGP session status for the affected Service Connection.. Service Connection health is visible in Prisma Access Insights, which reports tunnel and BGP status. Intermittent internal application access with working internet traffic strongly suggests a routing or tunnel problem on the Service Connection. Checking tunnel state and BGP session status directly validates whether the Service Connection is failing.

Answer

Verify the decryption policy applied to the Remote Network to ensure internal application traffic is not being dropped due to certificate errors.

Answer

Check the GlobalProtect app logs on the branch user endpoints to identify whether authentication failures are causing the intermittent access.

Answer

Run a packet capture on the Prisma Access mobile user portal to inspect traffic between the branch and the data center.

Question 14

An administrator notices that Remote Network (branch) traffic to SaaS applications is being backhauled through the corporate data center instead of breaking out locally at the Prisma Access node. The administrator wants branch traffic destined to trusted SaaS applications to egress directly from the Prisma Access service connection. Which Prisma Access capability should be used to accomplish this?

Accepted Answer

Enable Local Breakout on the Remote Network and use an Application filter in a Security policy rule to allow trusted SaaS traffic directly to the internet.. Local Breakout on a Remote Network lets selected traffic leave the branch directly to the internet instead of traversing the Service Connection to the corporate data center. Pairing it with an Application filter in a Security policy rule ensures only trusted SaaS applications are broken out, keeping other traffic on the backhauled path. This delivers the lowest-latency path for SaaS while preserving centralized inspection for general traffic.

Answer

Configure a Service Connection with a static route to the SaaS provider.

Answer

Configure a GlobalProtect portal agent configuration to force all branch traffic through the mobile users' preferred gateway.

Answer

Create a Decryption policy that exempts SaaS traffic from inspection so it bypasses the Service Connection.

Question 15

An administrator is deploying Prisma Access for a new Remote Network site that requires access to both the internet and internal applications. The administrator has already configured the Remote Network and Service Connection. Users report that internet access works, but internal application access fails. The administrator confirms that the Service Connection BGP session is established and advertising routes. Which configuration should the administrator verify next on the Remote Network?

Accepted Answer

The Remote Network's static routes and the associated route table entries that direct internal subnet traffic toward the Service Connection tunnel.. Remote Networks rely on static routes to direct traffic to the Service Connection for internal subnets. Even with an established BGP session on the Service Connection, missing or incorrect static routes on the Remote Network will prevent internal application access. Verifying these routes is the correct next step.

Answer

The decryption profile applied to the Remote Network to confirm that internal application certificates are trusted.

Answer

The GlobalProtect portal configuration to ensure the Remote Network users are assigned the correct internal DNS servers.

Answer

The HIP profile assigned to Remote Network users to ensure they meet internal access requirements.