SSE-Engineer Prisma Access Administration And Operation Practice Test 6 — 15 Questions

Question 1

A Prisma Access administrator needs to publish an internal web application to Mobile Users through a Private Application. The application uses a hostname that is not resolvable by public DNS. The administrator wants Mobile Users' browsers to reach the app using its internal FQDN without exposing the app to the internet. What must be configured to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the internal FQDN to the Private Application definition and configure the DNS server used by Mobile Users to resolve it, typically through the GlobalProtect app's DNS settings or a split-DNS configuration.. Private Applications rely on the client being able to resolve the internal FQDN so it can direct the connection into the Prisma Access tunnel. Since public DNS cannot resolve internal names, the administrator must define the Private Application with that FQDN and ensure Mobile Users use a DNS resolver that can resolve it, commonly via the GlobalProtect app's DNS settings or split-DNS. This keeps the application private while allowing normal browser access by name.

Answer

Publish the application through a Service Connection with a NAT rule translating the internal FQDN to the public IP.

Answer

Create a DNS Security policy that rewrites the internal FQDN to the Private Application's tunnel IP address.

Answer

Enable Local Breakout for the Mobile User tunnel so the internal FQDN resolves through the local ISP DNS.

Question 2

An administrator has deployed Prisma Access for a branch office remote network that must reach a SaaS application through a service connection. After committing the configuration, users report that traffic is being dropped at the remote network firewall with the message 'no matching service connection found.' The administrator verifies that the service connection is up and the SaaS application is in the correct region. What is the most likely cause?

Accepted Answer

The service connection is not associated with the remote network in the Prisma Access configuration, so return traffic cannot be matched to the correct tunnel.. A remote network must be explicitly associated with one or more service connections in Prisma Access for traffic to be routed through them. The error message 'no matching service connection found' indicates that the cloud infrastructure could not find a service connection configured for that remote network. The administrator should verify and add the correct service connection association in the remote network settings, then commit the change.

Answer

The IPSec tunnel between the remote network and Prisma Access is using IKEv1, which does not support service connection routing.

Answer

The SaaS application's IP addresses are not included in the remote network's static routes, so Prisma Access cannot forward the traffic.

Answer

The remote network's traffic is not being routed to the service connection because the associated security policy rule does not include the correct destination zone.

Question 3

An administrator is reviewing the Prisma Access license and notices that the organization has purchased the Prisma Access for Networks license but not the Prisma Access for Users license. Which functionality is available with this license?

Accepted Answer

Remote network connectivity for branch offices.. The Prisma Access for Networks license specifically enables remote network connectivity for branch offices. It does not include mobile user entitlements, which require the Prisma Access for Users license. Organizations needing both must purchase both licenses. Understanding license entitlements is essential for planning and troubleshooting Prisma Access deployments.

Answer

Mobile user connectivity via GlobalProtect.

Answer

Cloud Identity Engine integration for user authentication.

Answer

Both mobile user and remote network connectivity.

Question 4

An administrator is configuring Prisma Access to enforce security policy for Mobile Users. The administrator wants to ensure that traffic from Mobile Users is inspected for threats and that users are identified by their corporate credentials. Which TWO components must be configured to achieve this? (Choose two.)

Accepted Answer

Configure User-ID and authentication profiles so that Mobile Users are mapped to corporate identities.. To enforce security policy for Mobile Users with threat inspection and corporate user identification, a GlobalProtect portal and gateway are required to authenticate users and apply policy. User-ID and authentication profiles are also required to map users to corporate identities. Together, these components enable user-based policy and threat inspection.

Answer

Configure a decryption policy to inspect all Mobile User traffic for threats.

Answer

Configure a Remote Network to route Mobile User traffic through the corporate data center.

Answer

Configure a Service Connection to provide access to internal resources for Mobile Users.

Question 5

A security engineer is troubleshooting why a Prisma Access mobile user's traffic to a specific external website is being allowed despite a security policy rule that should block it. The rule is configured with a source user of 'domain\jdoe' and a destination of 'any', and the action is deny. The user is authenticated via GlobalProtect with User-ID enabled. What is the most likely reason the rule is not matching?

Accepted Answer

The security policy rule is placed after a more general allow rule that matches the traffic first.. Security policy rules in Prisma Access are evaluated in order, and the first matching rule determines the action. If a broad allow rule appears above the specific deny rule, the traffic will be allowed and the deny rule will not be evaluated. The engineer should reorder the rules so that the more specific deny rule is above any general allow rules that could match the same traffic.

Answer

The destination 'any' in the security policy rule does not include external websites because Prisma Access treats external zones separately.

Answer

User-ID mapping for the user is not available because the GlobalProtect agent is not sending the domain username in the correct format.

Answer

The deny action is not supported for rules with a source user criterion in Prisma Access.

Question 6

An administrator is reviewing the Prisma Access deployment and notices that a Remote Network site has been offline for several hours. The administrator wants to quickly identify whether the issue is related to the IPsec tunnel or to the underlying ISP connectivity. Which Prisma Access dashboard should the administrator use to view the tunnel status and related alerts?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the dashboard that aggregates Remote Network health, including IPsec tunnel status and alerts. It allows administrators to quickly determine whether a site outage is due to tunnel failure or ISP problems. The other options relate to different functions and would not provide the needed information.

Answer

GlobalProtect app logs

Answer

Decryption logs

Answer

Threat logs in the Prisma Access portal

Question 7

An administrator is deploying a new Prisma Access tenant for a company with branch offices in North America and Europe. The security team requires that all branch traffic egress through a Prisma Access location in the same region as the branch to minimize latency, while still allowing failover to another region during an outage. Which Prisma Access configuration should the administrator implement?

Accepted Answer

Configure a Remote Network for each branch and assign a primary and secondary Prisma Access location based on region, then enable traffic steering to prefer the primary location.. Remote Networks in Prisma Access can be assigned to specific locations, and the platform supports a primary and secondary location for redundancy. Choosing locations by region keeps branch traffic local to reduce latency, while the secondary location provides failover during an outage. This combination directly satisfies both the regional egress and resilience requirements.

Answer

Deploy Prisma Access in a single region and use GlobalProtect mobile user licenses for branch offices to connect to that region.

Answer

Configure Service Connections in each region and attach all Remote Networks to every Service Connection to allow any-to-any routing.

Answer

Create a single Remote Network for all branches and route all traffic through the Prisma Access location closest to the corporate headquarters.

Question 8

An administrator needs to verify that a newly configured remote network in Prisma Access is operational and passing traffic. Which status indicator in the Prisma Access dashboard should the administrator check first to confirm the IPSec tunnel is established?

Accepted Answer

The 'Remote Networks' status under the Health section, which shows tunnel status and connectivity.. The Prisma Access Health dashboard provides a consolidated view of remote network status, including whether the IPSec tunnel is established and passing traffic. Checking the Remote Networks status there gives the administrator immediate confirmation of tunnel health. Other sections like Service Connections or Mobile Users relate to different connection types and would not show remote network tunnel status.

Answer

The 'Logs' section under Monitor, which shows traffic and system logs for all components.

Answer

The 'Service Connections' status under the Health section, which shows connectivity to data centers.

Answer

The 'Mobile Users' status under the Health section, which shows GlobalProtect connections.

Question 9

An administrator has deployed Prisma Access with a single Remote Network SPN at a branch office in Frankfurt. Users complain that after a failover of the primary ISP link, all traffic to SaaS applications is being forced through the backup link even though the primary link is healthy again. The administrator wants Prisma Access to automatically restore the preferred path without manual intervention. Which feature should be configured?

Accepted Answer

Path quality monitoring with failback on the Remote Network. Prisma Access Remote Networks support path quality monitoring and failback so that when the preferred ISP link becomes healthy again, traffic is automatically returned to it. This removes the need for manual tunnel flapping or administrator intervention and matches the scenario where traffic remained pinned to the backup link after the primary recovered.

Answer

Quality of Service (QoS) profiles on the IPSec tunnel

Answer

ECMP load balancing across both ISP links

Answer

BGP local preference tuning on the CPE router

Question 10

An administrator is troubleshooting a Prisma Access issue where mobile users are unable to access a newly deployed internal web application. The application is hosted in the data center and is reachable from the service connection. Security policy allows the traffic. Which log source should the administrator check first to determine whether the traffic is reaching the service connection?

Accepted Answer

Traffic logs in the Prisma Access monitoring interface filtered by the application and service connection.. To determine whether mobile user traffic reached the service connection, the administrator should examine traffic logs in the Prisma Access monitoring interface. These logs show session details, including whether traffic was allowed or denied and the path it took. Filtering by application and service connection narrows the focus to the relevant flow, providing the necessary insight to troubleshoot the access issue.

Answer

System logs on the Prisma Access portal.

Answer

GlobalProtect app logs on the mobile user endpoint.

Answer

IKE gateway logs on the remote network firewall.

Question 11

An administrator is troubleshooting a Prisma Access deployment where mobile users in the London region report intermittent inability to reach internal applications published through a Service Connection. The administrator suspects that the Service Connection is not advertising the correct routes to the Remote Network SPN. Which TWO items should the administrator verify on the Service Connection configuration? (Choose two.)

Accepted Answer

The BGP or static route redistribution settings that control which prefixes are advertised to Prisma Access. Reachability of internal applications through a Service Connection depends on the routes Prisma Access knows about. Administrators must confirm the static or summarized routes listed on the Service Connection and the redistribution settings that determine which prefixes are advertised. Missing or filtered routes cause intermittent or partial reachability, which matches the reported behavior.

Answer

The SSL decryption profile applied to the Service Connection

Answer

The IKEv2 pre-shared key used by the Service Connection tunnel

Answer

The GlobalProtect portal agent configuration for the London region

Question 12

An administrator has configured a Service Connection in Prisma Access with BGP to advertise internal routes. After a configuration change, internal users can no longer reach resources in a specific subnet. The administrator verifies that the BGP session is established and that the subnet is advertised from the on-premises router. Which action should the administrator take to ensure that Prisma Access accepts and uses the advertised route?

Accepted Answer

Verify that the Service Connection's BGP configuration includes the correct import/export rules and that the subnet is not filtered out.. BGP import/export rules on the Service Connection determine which routes Prisma Access accepts. Even with an established session and advertisement from the on-premises router, a filtering rule can prevent the subnet from being installed. Verifying these rules ensures the route is accepted and used for internal traffic.

Answer

Modify the security policy to allow traffic to the specific subnet.

Answer

Restart the IPsec tunnel to force a BGP session re-establishment and route refresh.

Answer

Configure a static route on the Service Connection for the missing subnet.

Question 13

A security administrator notices that Prisma Access is not enforcing a URL Filtering profile for traffic from a specific Remote Network. The profile is applied in a security policy rule that matches the Remote Network's source zone. The administrator confirms the rule is present and enabled. What is the most likely cause?

Accepted Answer

A higher-priority security rule above the intended rule is matching the traffic and allowing it without a URL Filtering profile.. Prisma Access security rules are processed in order, and the first matching rule determines the action and profiles applied. If a preceding rule allows the traffic without URL Filtering, the later rule with the profile is never evaluated. Checking rule order and hit counts is essential when a profile appears not to be enforced.

Answer

The URL Filtering profile is not attached to the security rule, but instead only referenced in a Decryption policy.

Answer

The Remote Network's source zone is not included in the security rule, so the rule is being skipped.

Answer

URL Filtering requires a Decryption policy to inspect HTTPS traffic, and without decryption the profile cannot enforce any categories.

Question 14

An administrator has just finished configuring a new Prisma Access tenant and wants to verify that Mobile Users can connect and that security policy is being applied. The administrator needs a high-level view of connected Mobile Users, their locations, and the applications in use. Which Prisma Access monitoring area should the administrator use?

Accepted Answer

The Prisma Access Insights application, which provides dashboards for Mobile Users, Remote Networks, and health metrics.. Prisma Access Insights aggregates telemetry across the service and provides dashboards specifically for Mobile Users, including connection status, location, and application usage. It is the intended tool for obtaining a high-level operational view after onboarding, allowing the administrator to confirm that users are connecting and that policy is being enforced without inspecting individual logs.

Answer

The firewall's System logs in the Strata Cloud Manager, which show configuration changes and commit history.

Answer

The Threat logs in the Strata Cloud Manager, which list security events and blocked sessions.

Answer

The CLI on each Prisma Access compute node, using show commands to display active sessions.

Question 15

An administrator needs to give the security team a single dashboard that shows which Prisma Access security policy rules are being triggered most frequently across all mobile users and Remote Networks over the last 30 days. Which Prisma Access reporting capability should the administrator use?

Accepted Answer

The predefined Security policy rule usage report in the Prisma Access reporting interface. Prisma Access provides predefined reports that aggregate security policy rule usage over time, including which rules are triggered most often. This gives the security team a consolidated dashboard covering mobile users and Remote Networks for the requested 30-day window, which is exactly what the scenario requires.

Answer

The Threat log filtered by policy name

Answer

The Policy Optimizer in the Prisma Access monitoring interface

Answer

The System log filtered by configuration commits