SSE-Engineer Prisma Access Administration And Operation — Timed 10 Questions

Question 1

An administrator is troubleshooting a HIP (Host Information Profile) check failure for mobile users. Where can the administrator view the collected HIP reports and check compliance status in real-time?

10 minute time limit — choose an answer to begin.

Accepted Answer

Monitor > Logs > HIP Matches. HIP reports and compliance status are viewed in Monitor > Logs > HIP Matches in the Prisma Access/Panorama interface. This log displays the HIP report data collected from endpoints and the result of HIP policy evaluation, allowing real-time troubleshooting of HIP check failures.

Answer

Device > Certificate Management > HIP

Answer

Panorama > Cloud Services > Status > HIP

Answer

GlobalProtect > Gateway > Agent > HIP Objects

Question 2

Where do administrators configure service connections in Prisma Access to connect the cloud security infrastructure to the organization's data center or headquarters?

Accepted Answer

Panorama > Cloud Services > Configuration > Service Connections. Service connections are configured in the Panorama Cloud Services plugin to establish secure tunnels back to corporate datacenters.

Answer

Network > Interfaces > Tunnel

Answer

Policies > QoS > Service Connections

Answer

Device > Cloud Services > GlobalProtect

Question 3

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Accepted Answer

Objects > Decryption > SSL Decryption Profile. SSL decryption profiles in Prisma Access are configured under Objects > Decryption > SSL Decryption Profile, where you can adjust settings such as unsupported cipher suites, unsupported versions, and failure handling. This is the correct location to resolve handshake failures caused by an unsupported cipher suite.

Answer

Panorama > Cloud Services > Global Settings > Decryption

Answer

Device > Certificate Management > SSL Policy

Answer

Policies > Decryption > Settings

Question 4

An organization requires that specific SaaS applications are accessed only by corporate-managed devices that pass a specific HIP check. Which policy type should the administrator configure?

Accepted Answer

Security Policy Rule referencing the HIP Profile. HIP checks are enforced within Security Policy rules by referencing the desired HIP Object or HIP Profile in the rule's criteria.

Answer

Decryption Policy applying inbound SSL decryption

Answer

QoS Policy referencing the HIP Object

Answer

Authentication Policy enforcing GlobalProtect gateway authentication

Question 5

A Prisma Access administrator notices that remote network traffic destined for another remote network (branch-to-branch traffic) is being dropped or failing to establish. What is the required configuration to allow branch-to-branch traffic?

Accepted Answer

Enable 'Branch-to-Branch' routing under Panorama > Cloud Services > Configuration > Remote Networks and create matching security rules.. Branch-to-branch traffic in Prisma Access is disabled by default for security and routing reasons. To enable it, the administrator must turn on the 'Branch-to-Branch' routing option under Panorama > Cloud Services > Configuration > Remote Networks, and then create security rules that explicitly permit traffic between the remote network zones. Without this setting, traffic from one remote network to another is dropped even if security rules exist.

Answer

Configure static routes pointing to the loopback interface on every remote network gateway.

Answer

Enable GlobalProtect Clientless VPN on all remote network gateways.

Answer

Deploy dedicated external hardware firewalls at each branch location.

Question 6

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Accepted Answer

Device > Server Profiles > SAML Identity Provider. In Prisma Access, SAML IdP metadata for mobile users is imported and configured under Device > Server Profiles > SAML Identity Provider. This is where the IdP certificate, metadata URL, and attribute mappings are defined, which are then referenced in the GlobalProtect portal and gateway authentication profiles. The other locations either do not exist or are not used for SAML IdP configuration in this context.

Answer

Network > GlobalProtect > Portal > Authentication

Answer

Panorama > Cloud Services > Authentication > SAML

Answer

Objects > Cloud Identity Engine > SAML

Question 7

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Accepted Answer

Monitor > ACC or the Prisma Access App dashboard. The Monitor > ACC or the Prisma Access App dashboard provides an overview of active mobile users, connection status, and geographical distribution. The App dashboard in Prisma Access specifically aggregates GlobalProtect user data, showing active users, their locations, and connection health. This is the central monitoring pane for mobile user status.

Answer

Policies > Security > Status

Answer

Network > GlobalProtect > Runtime

Answer

Device > Status > Active Users

Question 8

Which action should an administrator take to update the Prisma Access software and plugin versions across the deployment?

Accepted Answer

Panorama > Plugin > Cloud Services > Updates. Panorama manages Prisma Access updates through the Software and Cloud Services plugin update mechanisms.

Answer

Device > Software > Prisma Access

Answer

Policies > Management > Updates

Answer

Monitor > Software Updates > Cloud

Question 9

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Accepted Answer

The internal subnets are not included in the GlobalProtect Agent Split Tunneling 'Include Access Route' list.. When a GlobalProtect mobile user shows Connected but receives an internal IP from the reserve pool, it typically means the user's traffic is not being routed to the internal subnets because those subnets are not included in the split tunneling 'Include Access Route' list. The reserve pool is used when the primary IP pool is exhausted or when the user is not assigned a standard internal IP, and without the correct include routes, internal resources are unreachable.

Answer

The user's Active Directory password has expired in the Cloud Identity Engine.

Answer

The WildFire file size limit was exceeded.

Answer

The HIP check failed due to an outdated operating system patch.

Question 10

An administrator wants to view real-time metrics, node status, and active connection counts for Prisma Access Mobile Users and Remote Networks directly from Panorama. Which tool within Panorama should the administrator access?

Accepted Answer

Prisma Access Insights. Prisma Access Insights provides a centralized dashboard in Panorama for monitoring service health, bandwidth utilization, and active connections.

Answer

GlobalProtect Portal Diagnostics Tool

Answer

Command Center CLI

Answer

Cloud Identity Engine Console