SSE-Engineer Prisma Access Planning And Deployment — 15 Questions

Question 1

An enterprise is planning a Prisma Access Remote Networks deployment with overlapping RFC 1918 IP address spaces across several acquired branch offices. Which Prisma Access feature must the architect implement to successfully route traffic without changing the local branch IP schemes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Source NAT (SNAT) configured for Remote Networks traffic. When multiple branch offices use overlapping RFC 1918 address ranges (e.g., 192.168.1.0/24 in two locations), Prisma Access cannot route traffic correctly because the destination prefixes are ambiguous. Source NAT (SNAT) rewrites the source IP of traffic originating from Remote Networks to a unique, non-overlapping address before it enters the Prisma Access fabric, allowing the service to distinguish and route traffic from each branch without requiring the enterprise to re-IP its branches. This is the documented Prisma Access approach for overlapping subnets in Remote Networks deployments.

Answer

Destination NAT rules on the Service Connections

Answer

GRE tunneling with static default routes

Answer

BGP AS-Path Prepending across all branch tunnels

Question 2

An engineer is troubleshooting BGP routing between a customer data center and Prisma Access over a Service Connection. The data center router is advertising routes, but Prisma Access is not installing them into the routing table. What is the most likely cause?

Accepted Answer

The advertised prefixes overlap with the reserved Prisma Access internal service subnet 10.255.0.0/16. Service Connections require BGP peering, and advertised routes must match supported prefix lengths and be properly configured within the Panorama Service Connection settings.

Answer

The BGP hold timer is set higher than 180 seconds

Answer

BGP authentication type is set to MD5 instead of SHA-256

Answer

The Autonomous System Number (ASN) is a private 4-byte ASN

Question 3

An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?

Accepted Answer

By establishing multiple tunnels terminating on separate SPNs and using BGP multi-path or local preference for failover. Prisma Access supports redundant IPSec tunnels from branch routers, utilizing BGP to manage path selection and failover between the tunnels.

Answer

By utilizing VRRP across the cloud public IP addresses

Answer

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Answer

By configuring LACP bonding directly across the cloud IPSec endpoints

Question 4

An enterprise is configuring Prisma Access for users who travel frequently and require consistent security enforcement regardless of their location. Which GlobalProtect feature ensures that users cannot disable or bypass the VPN protection?

Accepted Answer

Enforced Mode. Enforced mode in GlobalProtect prevents users from disconnecting or disabling the VPN client.

Answer

Always-On VPN with Disconnect Lockout

Answer

Clientless VPN Portal redirection

Answer

GlobalProtect App Lockdown Policy

Question 5

When deploying Prisma Access, which component acts as the central management plane to push security policies, configurations, and software updates to all cloud-managed SPNs?

Accepted Answer

Panorama. Panorama acts as the central management plane for Prisma Access.

Answer

GlobalProtect Portal

Answer

AWS Transit Gateway Manager

Answer

Prisma Access Cloud Controller

Question 6

An administrator is planning a Prisma Access deployment and needs to configure Service Connections to connect the enterprise data center to the cloud. Which TWO requirements must be met for a successful BGP peering session over a Service Connection? (Choose two)

Accepted Answer

Ensure the advertised BGP routes do not overlap with Prisma Access internal reserved subnets. Option C is correct because Prisma Access reserves specific internal subnets for its own infrastructure, and any BGP routes advertised over the Service Connection that overlap these reserved ranges will be rejected or cause routing conflicts, so the administrator must ensure advertised routes do not overlap them. Option E is correct because each Service Connection requires a unique Local ASN configured in the Panorama Service Connection settings so that BGP peering with the Prisma Access cloud can be established without ASN conflicts with other Service Connections or the customer's environment. Option A is incorrect because Service Connections are established from an IPSec-capable device (physical or virtual) on the customer side to Prisma Access, and no Palo Alto Networks hardware firewall must be deployed inside the AWS VPC for BGP peering. Option B is incorrect because LACP active-active bonding applies to link aggregation on physical interfaces, not to Service Connection tunnel interfaces, which use IPSec tunnels and BGP rather than LACP. Option D is incorrect because BGP peering is required for dynamic route exchange over a Service Connection, so static default routing alone without any routing protocol does not satisfy the requirement.

Answer

Deploy a physical hardware firewall inside the AWS cloud VPC

Answer

Configure LACP active-active bonding on the Service Connection tunnel interfaces

Answer

Enable static default routing without configuring any routing protocols

Question 7

When configuring GlobalProtect mobile users in Prisma Access, which THREE settings are typically defined within the GlobalProtect Client Settings configuration? (Choose three)

Accepted Answer

Connect method (e.g., On-Demand, Always-On). Option A (Connect method, e.g., On-Demand, Always-On) is correct because the GlobalProtect Client Settings (agent settings) in Prisma Access define the connect method that governs how the agent establishes the tunnel, such as On-Demand, Always-On, or User-Logon. Option B (GlobalProtect Gateway preference list) is correct because Client Settings specify the gateway preference list (including manual or internal/external gateway ordering) that tells the agent which Prisma Access gateways to connect to and in what priority. Option D (Internal DNS server IP addresses) is correct because Client Settings include the DNS configuration, such as internal DNS server IP addresses, that the agent pushes to the endpoint for resolving internal resources. Option C (Prisma Access Remote Network BGP ASN) is not part of Client Settings; BGP ASN is configured on Remote Networks/Service Connections for routing, not on the GlobalProtect agent. Option E (Service Connection public gateway IP address) is not a Client Settings item; Service Connection public IPs are part of the Prisma Access infrastructure/Service Connection configuration, not the GlobalProtect client settings.

Answer

Prisma Access Remote Network BGP ASN

Answer

Service Connection public gateway IP address

Question 8

An administrator is configuring Source NAT (SNAT) for Prisma Access Remote Networks. Which TWO reasons explain why SNAT is necessary in certain network designs? (Choose two)

Accepted Answer

To resolve overlapping IP address spaces between multiple branch offices. SNAT is used to prevent IP address overlapping between branch sites and to hide internal network structures when accessing external destinations.

Answer

To authenticate GlobalProtect users against Active Directory

Answer

To replace the requirement for BGP routing over Service Connections

Answer

To assign dynamic IPv6 addresses to individual remote worker laptops

Question 9

An engineer is troubleshooting a routing issue where a remote network branch connected to Prisma Access cannot reach another remote network branch (branch-to-branch routing). Which THREE configuration items must be verified to ensure successful branch-to-branch traffic flow? (Choose three)

Accepted Answer

Verify that Security Policy rules permit traffic between the respective branch zones. Branch-to-branch routing in Prisma Access requires explicit configuration, including enabling branch-to-branch traffic in Panorama, ensuring proper security policies permit the traffic, and correct route advertisement.

Answer

Verify that local branch DHCP lease times are set to 8 hours

Answer

Check that all mobile user clients have disabled split tunneling

Question 10

A network engineer is deploying Prisma Access for a new remote network location. The ISP provides a single public IP address. The engineer must ensure that all outbound traffic from the branch uses a specific public IP that is different from the ISP-assigned address, and that return traffic is correctly routed back through the IPSec tunnel. Which Prisma Access feature should be configured to meet these requirements?

Accepted Answer

Static IP address assignment for the remote network. Assigning a static IP address to a remote network in Prisma Access ensures that all outbound traffic uses that specific public IP. This is essential when external services require IP whitelisting or when the ISP-assigned IP is not suitable. The static IP is configured on the remote network's IPSec tunnel, and return traffic is automatically routed back through the tunnel.

Answer

Destination NAT (DNAT) on the remote network

Answer

Policy-Based Forwarding (PBF) with a dedicated egress IP

Answer

Source NAT (SNAT) on the remote network

Question 11

A network engineer is provisioning a new Prisma Access Remote Network location and needs to ensure that the IPSec tunnel to the service connection uses the strongest available encryption. The engineer selects AES-256-GCM as the encryption algorithm in the IPSec profile. Which additional parameter must be configured to complete the IPSec profile with this algorithm?

Accepted Answer

Leave the authentication algorithm unset because AES-256-GCM provides both encryption and authentication.. AES-256-GCM is an authenticated encryption algorithm that provides both confidentiality and integrity. When configuring an IPSec profile in Prisma Access, selecting a GCM cipher means the authentication algorithm field must be left unset. This ensures the profile is valid and the tunnel can negotiate correctly. The other options either add unnecessary parameters or misunderstand the nature of GCM.

Answer

Specify a Diffie-Hellman group for perfect forward secrecy.

Answer

Select SHA-512 as the authentication algorithm to complement AES-256-GCM.

Answer

Configure a separate authentication algorithm because GCM provides encryption only.

Question 12

A security team is planning to deploy Prisma Access for remote users and needs to ensure that User-ID is properly configured to enforce policies based on user identity. Which TWO configurations are required to enable User-ID for GlobalProtect users? (Choose two.)

Accepted Answer

Enable User-ID in the GlobalProtect portal configuration.. To enable User-ID for GlobalProtect users, you must enable User-ID in the GlobalProtect portal configuration and ensure the GlobalProtect agent sends user information. These two steps allow Prisma Access to map IP addresses to usernames and enforce identity-based policies. Other options like client certificates or LDAP integration are for authentication, not User-ID mapping.

Answer

Configure GlobalProtect to use client certificates for authentication.

Answer

Set up LDAP integration for user authentication.

Answer

Configure a User-ID agent on the Prisma Access side.

Question 13

A security engineer is planning a new Prisma Access deployment for a large enterprise with 50,000 mobile users. The engineer must choose the appropriate license type to support both remote user connectivity and the ability to route traffic to internal resources via a service connection. Which license model should be selected?

Accepted Answer

Prisma Access for Users plus Service Connection. Prisma Access for Users secures mobile users, while the Service Connection license enables access to internal resources. Together, they meet the requirement of supporting 50,000 mobile users and routing traffic to internal resources. Other licensing options either lack service connection capability or do not include remote user licensing, making them unsuitable for this deployment.

Answer

Prisma Access for Networks

Answer

Prisma Access for Networks plus Remote User add-on

Answer

Prisma Access for Users

Question 14

An administrator is planning a Prisma Access deployment with a service connection to a data center. The data center uses a BGP autonomous system number (ASN) of 65001. The administrator wants to ensure that Prisma Access prefers the service connection over the remote network connection for traffic destined to the data center. Which BGP attribute should be manipulated to achieve this?

Accepted Answer

Local Preference. Local Preference is the BGP attribute used to influence outbound path selection within an autonomous system. By assigning a higher local preference to routes learned from the service connection, Prisma Access will prefer that path over the remote network connection for traffic to the data center. This ensures that traffic takes the intended path.

Answer

Weight

Answer

AS Path

Answer

Multi-Exit Discriminator (MED)

Question 15

An engineer is planning a Prisma Access deployment for a new Remote Network location. The location must support BGP routing with the corporate data center over a Service Connection. The data center uses the 10.10.0.0/16 network and the Remote Network site uses 192.168.1.0/24. Which configuration element is required to enable BGP peering between the Remote Network and Prisma Access?

Accepted Answer

Define a BGP peer group and assign the Remote Network as a peer in the Prisma Access configuration.. BGP peering in Prisma Access requires defining a peer group and adding the Remote Network as a peer. This enables dynamic route exchange, allowing the data center's 10.10.0.0/16 network to be advertised and the Remote Network's 192.168.1.0/24 to be known. Static routes, OSPF, or RIP do not satisfy the BGP requirement and would fail to establish the needed dynamic routing.

Answer

Create a VPN tunnel and configure RIP version 2 for route exchange.

Answer

Configure a static route on the Remote Network firewall pointing to Prisma Access.

Answer

Enable OSPF on the Service Connection to redistribute routes into BGP.