SSE-Engineer Prisma Access Administration And Operation — Timed 50 Questions

Question 1

An administrator is troubleshooting a HIP (Host Information Profile) check failure for mobile users. Where can the administrator view the collected HIP reports and check compliance status in real-time?

50 minute time limit — choose an answer to begin.

Accepted Answer

Monitor > Logs > HIP Matches. HIP reports and compliance status are viewed in Monitor > Logs > HIP Matches in the Prisma Access/Panorama interface. This log displays the HIP report data collected from endpoints and the result of HIP policy evaluation, allowing real-time troubleshooting of HIP check failures.

Answer

Device > Certificate Management > HIP

Answer

Panorama > Cloud Services > Status > HIP

Answer

GlobalProtect > Gateway > Agent > HIP Objects

Question 2

Where do administrators configure service connections in Prisma Access to connect the cloud security infrastructure to the organization's data center or headquarters?

Accepted Answer

Panorama > Cloud Services > Configuration > Service Connections. Service connections are configured in the Panorama Cloud Services plugin to establish secure tunnels back to corporate datacenters.

Answer

Network > Interfaces > Tunnel

Answer

Policies > QoS > Service Connections

Answer

Device > Cloud Services > GlobalProtect

Question 3

An administrator notices that specific applications identified via App-ID are failing decryption inspection in Prisma Access because the server uses an unsupported cipher suite. Where can the administrator adjust the SSL decryption profile to resolve handshake failures?

Accepted Answer

Objects > Decryption > SSL Decryption Profile. SSL decryption profiles in Prisma Access are configured under Objects > Decryption > SSL Decryption Profile, where you can adjust settings such as unsupported cipher suites, unsupported versions, and failure handling. This is the correct location to resolve handshake failures caused by an unsupported cipher suite.

Answer

Panorama > Cloud Services > Global Settings > Decryption

Answer

Device > Certificate Management > SSL Policy

Answer

Policies > Decryption > Settings

Question 4

An organization requires that specific SaaS applications are accessed only by corporate-managed devices that pass a specific HIP check. Which policy type should the administrator configure?

Accepted Answer

Security Policy Rule referencing the HIP Profile. HIP checks are enforced within Security Policy rules by referencing the desired HIP Object or HIP Profile in the rule's criteria.

Answer

Decryption Policy applying inbound SSL decryption

Answer

QoS Policy referencing the HIP Object

Answer

Authentication Policy enforcing GlobalProtect gateway authentication

Question 5

A Prisma Access administrator notices that remote network traffic destined for another remote network (branch-to-branch traffic) is being dropped or failing to establish. What is the required configuration to allow branch-to-branch traffic?

Accepted Answer

Enable 'Branch-to-Branch' routing under Panorama > Cloud Services > Configuration > Remote Networks and create matching security rules.. Branch-to-branch traffic in Prisma Access is disabled by default for security and routing reasons. To enable it, the administrator must turn on the 'Branch-to-Branch' routing option under Panorama > Cloud Services > Configuration > Remote Networks, and then create security rules that explicitly permit traffic between the remote network zones. Without this setting, traffic from one remote network to another is dropped even if security rules exist.

Answer

Configure static routes pointing to the loopback interface on every remote network gateway.

Answer

Enable GlobalProtect Clientless VPN on all remote network gateways.

Answer

Deploy dedicated external hardware firewalls at each branch location.

Question 6

An administrator wants to configure authentication for mobile users using SAML 2.0 with Prisma Access. Where is the identity provider (IdP) metadata imported and configured?

Accepted Answer

Device > Server Profiles > SAML Identity Provider. In Prisma Access, SAML IdP metadata for mobile users is imported and configured under Device > Server Profiles > SAML Identity Provider. This is where the IdP certificate, metadata URL, and attribute mappings are defined, which are then referenced in the GlobalProtect portal and gateway authentication profiles. The other locations either do not exist or are not used for SAML IdP configuration in this context.

Answer

Network > GlobalProtect > Portal > Authentication

Answer

Panorama > Cloud Services > Authentication > SAML

Answer

Objects > Cloud Identity Engine > SAML

Question 7

Which pane in the Prisma Access monitoring interface provides an overview of active mobile users, connection status, and geographical distribution?

Accepted Answer

Monitor > ACC or the Prisma Access App dashboard. The Monitor > ACC or the Prisma Access App dashboard provides an overview of active mobile users, connection status, and geographical distribution. The App dashboard in Prisma Access specifically aggregates GlobalProtect user data, showing active users, their locations, and connection health. This is the central monitoring pane for mobile user status.

Answer

Policies > Security > Status

Answer

Network > GlobalProtect > Runtime

Answer

Device > Status > Active Users

Question 8

Which action should an administrator take to update the Prisma Access software and plugin versions across the deployment?

Accepted Answer

Panorama > Plugin > Cloud Services > Updates. Panorama manages Prisma Access updates through the Software and Cloud Services plugin update mechanisms.

Answer

Device > Software > Prisma Access

Answer

Policies > Management > Updates

Answer

Monitor > Software Updates > Cloud

Question 9

A Prisma Access mobile user reports that they cannot access internal resources, and the GlobalProtect app status shows 'Connected' but with an internal IP address assigned from the reserve pool. What is the most likely cause of routing failure?

Accepted Answer

The internal subnets are not included in the GlobalProtect Agent Split Tunneling 'Include Access Route' list.. When a GlobalProtect mobile user shows Connected but receives an internal IP from the reserve pool, it typically means the user's traffic is not being routed to the internal subnets because those subnets are not included in the split tunneling 'Include Access Route' list. The reserve pool is used when the primary IP pool is exhausted or when the user is not assigned a standard internal IP, and without the correct include routes, internal resources are unreachable.

Answer

The user's Active Directory password has expired in the Cloud Identity Engine.

Answer

The WildFire file size limit was exceeded.

Answer

The HIP check failed due to an outdated operating system patch.

Question 10

An administrator wants to view real-time metrics, node status, and active connection counts for Prisma Access Mobile Users and Remote Networks directly from Panorama. Which tool within Panorama should the administrator access?

Accepted Answer

Prisma Access Insights. Prisma Access Insights provides a centralized dashboard in Panorama for monitoring service health, bandwidth utilization, and active connections.

Answer

GlobalProtect Portal Diagnostics Tool

Answer

Command Center CLI

Answer

Cloud Identity Engine Console

Question 11

An administrator configures Decryption Policies in Prisma Access to inspect inbound traffic destined for internal applications published via Service Connections. Users report that certain internal web applications using custom internal Certificate Authorities (CAs) are failing TLS handshakes. Where should the administrator check and install the enterprise internal CA certificate to resolve this inspection issue?

Accepted Answer

Panorama > Certificate Management > Certificates, and ensure the internal CA is imported and trusted for SSL decryption.. For SSL decryption in Prisma Access, the enterprise internal CA must be imported into Panorama's Certificate Management and marked as a trusted CA for decryption. Prisma Access uses this trust anchor to validate and re-sign certificates for internal applications during inbound inspection. Without the internal CA trusted in Panorama, the forward-proxy trust chain breaks and TLS handshakes fail.

Answer

GlobalProtect Portal > Client Settings > Authentication, and push the CA via client configuration.

Answer

Cloud Identity Engine > Settings > Trusted Roots, and sync the certificate via LDAP.

Answer

Prisma Access Insights > Policies > Decryption, and toggle the 'Bypass Internal CA' switch.

Question 12

When configuring Mobile Users in Prisma Access, an administrator needs to define the regions where GlobalProtect gateway nodes will be instantiated to serve remote workers. Which Panorama menu path is used to configure Mobile Users locations and bandwidth allocations?

Answer

Panorama > Prisma Access > Mobile Users

Answer

Objects > Cloud Identity Engine

Answer

Network > GlobalProtect > Gateways

Answer

Device > Setup > GlobalProtect

Question 13

An administrator is troubleshooting a scenario where remote users connected via Prisma Access Mobile Users cannot access a specific newly added subnet behind a Remote Network location. Which configuration check should the administrator perform first in Panorama?

Accepted Answer

Verify that Security Policy rules permit traffic from the Mobile Users zone to the Remote Networks zone, and that the remote subnet is included in the Remote Network configuration.. When Mobile Users cannot reach a newly added subnet behind a Remote Network, the first check is whether security policy rules permit traffic from the Mobile Users zone to the Remote Networks zone and whether the subnet is included in the Remote Network configuration. This addresses the most common causes: missing policy or missing route advertisement. The Remote Network configuration must include the subnet for it to be reachable.

Answer

Restart the Cloud Identity Engine agent on the domain controller to refresh IP-to-user mappings.

Answer

Reinstall the GlobalProtect agent on all remote user machines to update the gateway list.

Answer

Generate a new API key in Prisma Access Insights to force a routing table recalculation.

Question 14

A network administrator needs to restrict access for remote users to a specific SaaS application based on their device's security posture. Which configuration sequence allows this in Prisma Access?

Accepted Answer

Create a HIP Object, add it to a HIP Profile, and apply it to a Security Policy rule source criteria.. Host Information Profile (HIP) objects must be defined, added to a HIP Object Profile, and then referenced in a Security Policy rule.

Answer

Configure an App-ID override rule and assign the device certificate to the User-ID agent.

Answer

Enable SSL Forward Proxy and add the device serial number to the GlobalProtect portal whitelist.

Answer

Assign a dynamic address group to the user and create a custom URL filtering category for the SaaS app.

Question 15

When using Cloud Identity Engine (CIE) for authentication, which method allows for the most seamless user experience for mobile users?

Accepted Answer

SAML integration with a cloud identity provider.. SAML with a Cloud Identity Provider is the standard for modern identity integration in Prisma Access.

Answer

RADIUS authentication.

Answer

LDAP without SSL.

Answer

Local database on the firewall.

Question 16

Which THREE items must be configured to successfully enforce HIP-based security policies for mobile users?

Accepted Answer

Add the HIP Profile to the Security Policy rule.. Option A is correct because a HIP Profile only takes effect when it is referenced in the Security Policy rule's Source HIP Profile field, which is what actually enforces the HIP-based match condition on traffic. Option B is correct because the GlobalProtect portal must have HIP data collection enabled so that endpoints report their host information, which is then evaluated against HIP Objects and Profiles. Option D is correct because HIP Objects and HIP Profiles must first be defined in the Panorama object library (or firewall) before they can be pushed to managed firewalls and referenced in policy. Option C is not required, since a single GlobalProtect gateway can serve users at different security levels; HIP enforcement is done through policy, not by creating separate gateways. Option E is not required, as the on-premises User-ID agent maps IP addresses to users and is unrelated to collecting or enforcing HIP data.

Answer

Create a separate GlobalProtect gateway for each security level.

Answer

Install an on-premises User-ID agent.

Question 17

A Prisma Access administrator must add a new remote network site in the Americas region and needs the branch firewall to establish the IPSec tunnel to the closest Prisma Access service connection. Which Prisma Access component must the branch firewall's IKE gateway peer address resolve to?

Accepted Answer

The Prisma Access service connection IP address assigned to the remote network in the Panorama template stack.. Remote network tunnels terminate on the service connection IP that Prisma Access assigns for the region where the remote network is onboarded. The branch firewall's IKE gateway must reference that address so the tunnel lands on the correct service connection, where routing, security policy, and decryption for branch traffic are enforced.

Answer

The Cortex Data Lake ingestion endpoint for the region where the branch is located.

Answer

The public IP of the Panorama management server that orchestrates the Prisma Access tenant.

Answer

The Prisma Access mobile user portal FQDN that GlobalProtect clients use for authentication.

Question 18

An administrator needs to ensure that Security policy rules in Prisma Access apply consistently to both mobile users and remote networks. The administrator creates a rule with the source zone set to Trust and the destination zone set to Untrust. Mobile user traffic is being evaluated by the rule, but remote network traffic is not. Which action should the administrator take to correct the zone configuration?

Accepted Answer

Use the 'any' zone in the source and destination fields so the rule matches both mobile user and remote network traffic.. Prisma Access uses distinct zones for mobile users and remote networks, so a rule matching the Trust zone may only apply to one traffic type. To enforce a single rule across both, the administrator should use the 'any' zone or a shared zone construct. This allows the rule to match traffic from either component without duplicating policy, ensuring consistent enforcement.

Answer

Recreate the rule under the Remote Networks policy tab instead of the Mobile Users policy tab.

Answer

Enable the 'Apply to Remote Networks' checkbox in the Security policy rule settings.

Answer

Change the source zone to the mobile user zone and add a separate rule for the remote network zone.

Question 19

An administrator deploys Prisma Access with a Service Connection to an on-premises data center. Branch users connected through a Remote Network must reach an internal application server at 10.20.30.40/32, which is advertised from the data center over BGP. Traffic is reaching the service connection but the return path fails. Which Prisma Access configuration is required so that Prisma Access advertises the Remote Network summary route back to the data center BGP peer?

Accepted Answer

Enable 'Advertise to Service Connections' under the Remote Network configuration and specify the summary route.. Route exchange between a Remote Network and a Service Connection happens over BGP. For the data center to reach branch users, Prisma Access must originate the branch summary prefix toward the service connection peer. Enabling advertisement on the Remote Network and specifying the summary route accomplishes this, restoring bidirectional connectivity.

Answer

Enable 'Return Path Symmetry' in the Service Connection settings to force replies through the same tunnel.

Answer

Configure a static route on the Remote Network pointing to the data center subnet and redistribute it into OSPF.

Answer

Add a Policy-Based Forwarding rule on the mobile user security policy to redirect internal traffic to the service connection.

Question 20

An administrator is deploying a new Prisma Access instance and needs to onboard a Remote Network site. The ISP has provided a single public IP address for the branch firewall. The administrator must configure the IPSec tunnel to Prisma Access using that address. Which TWO settings are required on the branch firewall to establish the tunnel? (Choose two.)

Accepted Answer

Configure the IKE gateway with the Prisma Access Remote Network IPSec termination point as the peer address.. Establishing an IPSec tunnel from a branch firewall to a Prisma Access Remote Network requires the branch to know the peer address of the Prisma Access termination point and to authenticate with the credential issued during onboarding. Configuring the IKE gateway with the correct peer IP and the matching pre-shared key or certificate enables Phase 1 to complete, after which the tunnel and routing can be established.

Answer

Enable NAT-Traversal on the IKE gateway only if the branch is behind a device performing NAT.

Answer

Configure a loopback interface with the Prisma Access internal IP and use it as the local IKE identity.

Answer

Configure the tunnel interface with a /24 subnet matching the Prisma Access Service Connection subnet.