SSE-Engineer Prisma Access Planning And Deployment — 15 Questions

Question 1

An engineer is troubleshooting BGP routing between a customer data center and Prisma Access over a Service Connection. The data center router is advertising routes, but Prisma Access is not installing them into the routing table. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The advertised prefixes overlap with the reserved Prisma Access internal service subnet 10.255.0.0/16. Service Connections require BGP peering, and advertised routes must match supported prefix lengths and be properly configured within the Panorama Service Connection settings.

Answer

The BGP hold timer is set higher than 180 seconds

Answer

BGP authentication type is set to MD5 instead of SHA-256

Answer

The Autonomous System Number (ASN) is a private 4-byte ASN

Question 2

An enterprise is configuring Prisma Access for users who travel frequently and require consistent security enforcement regardless of their location. Which GlobalProtect feature ensures that users cannot disable or bypass the VPN protection?

Accepted Answer

Enforced Mode. Enforced mode in GlobalProtect prevents users from disconnecting or disabling the VPN client.

Answer

Always-On VPN with Disconnect Lockout

Answer

Clientless VPN Portal redirection

Answer

GlobalProtect App Lockdown Policy

Question 3

An enterprise is planning a Prisma Access Remote Networks deployment with overlapping RFC 1918 IP address spaces across several acquired branch offices. Which Prisma Access feature must the architect implement to successfully route traffic without changing the local branch IP schemes?

Accepted Answer

Source NAT (SNAT) configured for Remote Networks traffic. Source NAT (SNAT) or Network Address Translation mechanisms must be used to handle overlapping IP spaces when connecting multiple remote networks to Prisma Access.

Answer

Destination NAT rules on the Service Connections

Answer

GRE tunneling with static default routes

Answer

BGP AS-Path Prepending across all branch tunnels

Question 4

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

Accepted Answer

Automatic IP address allocation managed by Prisma Access. Prisma Access automatically manages and allocates dynamic IP pools for mobile users via Panorama.

Answer

Static IP assignment per user via Active Directory attributes

Answer

Static IP assignment via local DHCP server in each branch office

Answer

Manual entry by users upon connection

Question 5

During the initial deployment of Prisma Access for remote networks, an administrator needs to define the bandwidth allocation for a specific compute location. Which tool is used to manage and push this bandwidth allocation?

Accepted Answer

Panorama. Panorama is the centralized management tool used to configure and push Prisma Access settings, including bandwidth allocation for remote networks and mobile users.

Answer

Prisma SD-WAN Cloud Controller

Answer

Prisma Access Plugin for AWS Console

Answer

GlobalProtect Portal standalone web GUI

Question 6

An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?

Accepted Answer

GlobalProtect Split Tunneling based on Access Routes and Domains. Prisma Access allows Split Tunneling based on domains or destinations so that specific traffic (like video streaming or trusted SaaS) bypasses the VPN tunnel.

Answer

Explicit Proxy PAC file routing

Answer

SD-WAN Traffic Steering Policies

Answer

SSL Decryption Exclusion Objects

Question 7

An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?

Accepted Answer

Multiple Security Processing Nodes (SPNs) distributed across multiple geographic regions. Remote Networks and Mobile Users require Security Processing Nodes (SPNs) deployed across multiple compute locations globally to ensure traffic is processed closest to the user, minimizing latency.

Answer

A dedicated hardware Panorama appliance in each branch office

Answer

Prisma SD-WAN appliances at every remote user laptop

Answer

A single centralized Prisma Access parent node in the headquarters region

Question 8

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

Accepted Answer

Service Connection. A Service Connection is used to connect enterprise headquarters or data centers to Prisma Access.

Answer

Prisma SD-WAN Hub Integration

Answer

GlobalProtect Gateway Connection

Answer

Remote Network Connection

Question 9

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

Accepted Answer

In the Panorama GlobalProtect Client Settings configuration under Network Settings. DNS server IPs for remote users are configured in the GlobalProtect client configuration within Panorama under Cloud Services > Configuration > Users > GlobalProtect.

Answer

In the Prisma SD-WAN DNS proxy forwarding table

Answer

Directly on the remote user local machine registry

Answer

In the cloud Managed Security Services Provider (MSSP) portal

Question 10

Which administrative role or tool is primarily used to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the cloud-managed dashboard used to monitor health, status, and analytics of the Prisma Access deployment.

Answer

Prisma Cloud Compute Console

Answer

WildFire portal

Answer

Cortex XDR incident management console

Question 11

An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?

Accepted Answer

By establishing multiple tunnels terminating on separate SPNs and using BGP multi-path or local preference for failover. Prisma Access supports redundant IPSec tunnels from branch routers, utilizing BGP to manage path selection and failover between the tunnels.

Answer

By utilizing VRRP across the cloud public IP addresses

Answer

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Answer

By configuring LACP bonding directly across the cloud IPSec endpoints

Question 12

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 13

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Accepted Answer

In the GlobalProtect Portal configuration under Authentication. SAML authentication for mobile users is configured and referenced within the GlobalProtect Portal external authentication settings.

Answer

In the Panorama Log Forwarding profile

Answer

In the Prisma Access Remote Network BGP peer settings

Answer

In the Service Connection QoS profile

Question 14

When deploying Prisma Access, which component acts as the central management plane to push security policies, configurations, and software updates to all cloud-managed SPNs?

Accepted Answer

Panorama. Panorama acts as the central management plane for Prisma Access.

Answer

GlobalProtect Portal

Answer

AWS Transit Gateway Manager

Answer

Prisma Access Cloud Controller

Question 15

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

Accepted Answer

Prisma Access plugin. The Prisma Access plugin is required on Panorama to configure and manage Prisma Access infrastructure.

Answer

SD-WAN plugin

Answer

VM-Series plugin

Answer

Cortex Data Lake plugin