An enterprise is planning a Prisma Access Remote Networks deployment with overlapping RFC 1918 IP address spaces across several acquired branch offices. Which Prisma Access feature must the architect implement to successfully route traffic without changing the local branch IP schemes?
An engineer is troubleshooting BGP routing between a customer data center and Prisma Access over a Service Connection. The data center router is advertising routes, but Prisma Access is not installing them into the routing table. What is the most likely cause?
An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?
An enterprise is configuring Prisma Access for users who travel frequently and require consistent security enforcement regardless of their location. Which GlobalProtect feature ensures that users cannot disable or bypass the VPN protection?
When deploying Prisma Access, which component acts as the central management plane to push security policies, configurations, and software updates to all cloud-managed SPNs?
An administrator is planning a Prisma Access deployment and needs to configure Service Connections to connect the enterprise data center to the cloud. Which TWO requirements must be met for a successful BGP peering session over a Service Connection? (Choose two)
When configuring GlobalProtect mobile users in Prisma Access, which THREE settings are typically defined within the GlobalProtect Client Settings configuration? (Choose three)
An administrator is configuring Source NAT (SNAT) for Prisma Access Remote Networks. Which TWO reasons explain why SNAT is necessary in certain network designs? (Choose two)
An engineer is troubleshooting a routing issue where a remote network branch connected to Prisma Access cannot reach another remote network branch (branch-to-branch routing). Which THREE configuration items must be verified to ensure successful branch-to-branch traffic flow? (Choose three)
A network engineer is deploying Prisma Access for a new remote network location. The ISP provides a single public IP address. The engineer must ensure that all outbound traffic from the branch uses a specific public IP that is different from the ISP-assigned address, and that return traffic is correctly routed back through the IPSec tunnel. Which Prisma Access feature should be configured to meet these requirements?
A network engineer is provisioning a new Prisma Access Remote Network location and needs to ensure that the IPSec tunnel to the service connection uses the strongest available encryption. The engineer selects AES-256-GCM as the encryption algorithm in the IPSec profile. Which additional parameter must be configured to complete the IPSec profile with this algorithm?
A security team is planning to deploy Prisma Access for remote users and needs to ensure that User-ID is properly configured to enforce policies based on user identity. Which TWO configurations are required to enable User-ID for GlobalProtect users? (Choose two.)
A security engineer is planning a new Prisma Access deployment for a large enterprise with 50,000 mobile users. The engineer must choose the appropriate license type to support both remote user connectivity and the ability to route traffic to internal resources via a service connection. Which license model should be selected?
An administrator is planning a Prisma Access deployment with a service connection to a data center. The data center uses a BGP autonomous system number (ASN) of 65001. The administrator wants to ensure that Prisma Access prefers the service connection over the remote network connection for traffic destined to the data center. Which BGP attribute should be manipulated to achieve this?
An engineer is planning a Prisma Access deployment for a new Remote Network location. The location must support BGP routing with the corporate data center over a Service Connection. The data center uses the 10.10.0.0/16 network and the Remote Network site uses 192.168.1.0/24. Which configuration element is required to enable BGP peering between the Remote Network and Prisma Access?
An engineer is preparing a Prisma Access Service Connection over an AWS Transit Gateway. The customer requires that the IPSec tunnel to Prisma Access uses a /30 point-to-point subnet and that traffic from on-premises is routed symmetrically. Which configuration must the engineer verify on the Prisma Access side before adding the Service Connection?
An architect is planning a Prisma Access deployment that will use a Service Connection to provide access to internal applications. The customer requires that traffic from Remote Networks to the data center be inspected by Prisma Access security policies before reaching the internal servers. Which component must be configured to ensure that traffic is steered through the Prisma Access security processing nodes?
An engineer is planning a Prisma Access deployment with a Service Connection to a data center. The data center uses a BGP AS number of 65001, and the engineer wants to ensure that Prisma Access prefers the Service Connection over the Remote Network VPN for traffic destined to the data center. Which BGP configuration should be applied?
An administrator is deploying Prisma Access and needs to ensure that all traffic from remote networks is inspected by the security processing nodes. The administrator has configured the remote network and service connection. Which additional step is required to enable traffic inspection?
A security engineer is deploying Prisma Access for a large enterprise with multiple Remote Networks. The organization requires that all traffic from Remote Networks to the internet be inspected by Prisma Access security services, while traffic to the data center must bypass inspection and go directly over the Service Connection. Which Prisma Access component is responsible for enforcing this traffic steering policy?
An administrator is planning a Prisma Access deployment and needs to choose the appropriate license to enable advanced threat prevention features such as WildFire and DNS Security. Which license bundle should be selected?
An engineer is deploying Prisma Access for a new remote network location and must choose the correct license type to support a 2 Gbps IPSec tunnel and advanced security services. Which Prisma Access license model should be selected?
An architect is designing a Prisma Access deployment that includes both Mobile Users and Remote Networks. The organization requires that all traffic from Remote Networks is inspected by security policies, and that Mobile Users can access internal applications hosted in a data center connected via a Service Connection. Which two configurations are required to meet these requirements? (Choose two.)
An administrator is deploying Prisma Access for the first time and needs to activate the service. Which step is required before Prisma Access can be configured and used?
A network architect is designing a Prisma Access deployment with multiple remote network locations. The architect must ensure that if one remote network location fails, traffic automatically fails over to another location without manual intervention. Which feature should be configured to achieve this?
An administrator is setting up a new Prisma Access deployment and needs to ensure that Remote Network locations can resolve internal corporate domain names. The corporate DNS servers are located in the data center and are reachable via the Service Connection. Which configuration should the administrator implement to achieve this?
An architect is designing a Prisma Access deployment for a large enterprise with multiple remote networks and mobile users. The architect needs to ensure that traffic from remote networks to the internet is inspected by Prisma Access security services, while traffic between remote networks is not inspected to reduce latency. Which Prisma Access feature should be configured to achieve this?
A security engineer is planning a Prisma Access deployment for a company that requires all internet-bound traffic from remote users to be inspected by Prisma Access. The company also wants to ensure that traffic to internal applications goes through a Service Connection to the data center. Which Prisma Access feature should be configured to direct traffic appropriately?
A network engineer is configuring a Service Connection in Prisma Access to connect to a customer's data center. The engineer needs to ensure that traffic from Prisma Access to the data center is routed through the Service Connection and not the internet. Which configuration is required on the Prisma Access side?
An architect is planning a Prisma Access deployment for a company that requires high availability for its Remote Network locations. The company has two data centers and wants to ensure that if one IPSec tunnel fails, traffic automatically fails over to the other. The architect must configure the Remote Network with redundant tunnels. Which TWO actions must be taken to achieve this? (Choose two.)
A security engineer is planning the deployment of Prisma Access Service Connections to connect branch offices to Prisma Access. Which TWO components are required to establish a Service Connection? (Choose two.)
A security engineer is configuring a Service Connection in Prisma Access to connect a data center to the service. The engineer needs to ensure that the Service Connection supports dynamic routing and failover. Which two routing protocols can be used on the Service Connection to achieve this? (Choose two.)
A security engineer is configuring a Prisma Access Service Connection to connect a branch office to a corporate data center. The engineer needs to ensure that traffic from the branch to the data center is inspected by Prisma Access security policies. The branch uses a single IPSec tunnel to Prisma Access, and the data center is connected via a Service Connection. Which configuration is required to allow traffic to flow from the branch to the data center through Prisma Access?
An engineer is designing a Prisma Access deployment with multiple Remote Networks and Service Connections. The organization requires that traffic between Remote Networks and the data center be encrypted and that the data center routes be dynamically learned. Which two configuration steps are necessary to achieve this? (Choose two.)
A security engineer is planning a Prisma Access deployment for a company that has a single data center and wants to provide secure internet access for remote users. The company requires that all user traffic to the internet be inspected by Prisma Access, but traffic to internal applications hosted in the data center should not traverse the Prisma Access infrastructure. Which component should the engineer configure to meet these requirements?
A network engineer is planning a Prisma Access deployment with a Service Connection to a data center. The data center uses a BGP autonomous system number (ASN) of 65001, and the engineer wants to advertise specific subnets to Prisma Access. The engineer also needs to ensure that traffic from Prisma Access to the data center is routed correctly. Which configuration should the engineer use on the Prisma Access side to establish BGP peering?
When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?
During the initial deployment of Prisma Access for remote networks, an administrator needs to define the bandwidth allocation for a specific compute location. Which tool is used to manage and push this bandwidth allocation?
An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?
An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?
An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?
A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?
Which administrative role or tool is primarily used to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions?
An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?
An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?
An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?
An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?
An architect is designing a high-availability Remote Network location for Prisma Access. Which TWO methods can be used to ensure redundancy for branch office traffic connecting to Prisma Access? (Choose two)
An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)
An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)
When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)
A security engineer is deploying Prisma Access and needs to ensure that explicit proxy traffic from remote users is inspected. Which component must be configured in the Prisma Access infrastructure to handle explicit proxy traffic?
An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?
An engineer is planning the initial deployment of Prisma Access for an organization that wants to avoid routing internal traffic through the corporate data center for internet-bound traffic. Which deployment component must be configured to allow mobile users to connect directly to Prisma Access and access the internet without backhauling through headquarters?
An administrator is deploying a new Prisma Access Remote Network location and needs to ensure that traffic from the branch is inspected by security policies before reaching the internet. Which configuration step is required to direct traffic to Prisma Access for inspection?
An engineer is deploying Prisma Access for the first time and needs to onboard the infrastructure using the Prisma Access Cloud Management portal. The organization requires that all configuration changes be validated before being pushed to production. Which built-in workflow should the engineer use to meet this requirement?
A security engineer is planning a Prisma Access deployment for a company with offices in North America and Europe. The company wants to ensure that users in each region connect to the nearest Prisma Access location to minimize latency. Which Prisma Access component should the engineer configure to achieve this?
An engineer is configuring Prisma Access for a remote network location that uses an IPSec tunnel to connect to the Prisma Access infrastructure. The engineer needs to ensure that the tunnel is highly available and can fail over to a secondary ISP if the primary ISP fails. Which two actions should the engineer take to achieve this? (Choose two.)
A security engineer is deploying Prisma Access for mobile users and needs to ensure that all traffic from the GlobalProtect app is inspected by the security processing nodes, including traffic destined for the internet. Which setting must be configured in the Prisma Access mobile user configuration?
An administrator is deploying Prisma Access and needs to ensure that remote users can access internal applications hosted in a data center. The data center is connected to Prisma Access via a service connection. The administrator wants to avoid exposing internal IP addresses to the internet. Which Prisma Access component should be used to securely route traffic from remote users to the data center?
An administrator is configuring a Remote Network in Prisma Access to connect a branch office. The branch office has a single ISP link and requires high availability. The administrator wants to ensure that if the primary IPSec tunnel fails, traffic automatically switches to a secondary tunnel. Which Prisma Access feature should be configured to achieve this?
An administrator is planning a Prisma Access deployment for a new branch office. The branch has a single ISP connection and requires high availability for Remote Network connectivity. Which Prisma Access feature should the administrator use to provide redundancy?
An engineer is deploying a new Prisma Access tenant for a multinational company. The security team requires that all remote user traffic be inspected by a dedicated set of Security Processing Nodes located in the same region as the users, to minimize latency. The company has offices in North America, Europe, and Asia. Which deployment model should the engineer choose to meet this requirement?
A network architect is designing a Prisma Access deployment for a company with multiple remote networks. The company requires that traffic from remote networks to the internet be inspected by Prisma Access, but they also want to minimize latency for cloud applications. Which feature should be enabled to optimize routing for cloud applications?
An administrator is planning to deploy Prisma Access for a company with a single data center and multiple branch offices. The administrator needs to ensure that branch office traffic to the internet is secured by Prisma Access, while traffic to the data center is routed directly. Which Prisma Access component must be deployed to connect the branch offices to Prisma Access?
An architect is planning a Prisma Access deployment with a Service Connection to a data center. The data center advertises a default route (0.0.0.0/0) to Prisma Access over BGP. The architect wants to ensure that internet-bound traffic from Remote Networks is inspected by Prisma Access and not sent back to the data center. Which configuration should be applied to prevent the default route from being used for internet traffic?
An architect is planning a Prisma Access deployment for a large enterprise with multiple Remote Network locations. The architect must ensure that the deployment meets the requirements for high availability and scalability. Which TWO factors should the architect consider when designing the Remote Network locations? (Choose two.)
An architect is designing a Prisma Access deployment for a company with offices in North America and Europe. The company wants to minimize latency for users accessing SaaS applications. Which Prisma Access feature should be leveraged to achieve this?
An administrator is configuring Prisma Access for remote users and needs to ensure that split tunneling is used for specific applications. Which Prisma Access component is responsible for enforcing split tunneling policies?
An administrator is configuring Prisma Access for the first time and needs to onboard the Prisma Access infrastructure. Which step must be completed before configuring Remote Networks and Service Connections?
An administrator is setting up a new Prisma Access deployment and needs to ensure that the initial configuration is applied correctly. The administrator has already activated the Prisma Access license and is now in the Prisma Access configuration workflow. Which step must be completed first before configuring Remote Networks and Service Connections?
A network architect is planning a Prisma Access deployment for a company with a large remote workforce. The company wants to ensure that remote users can access both internet and internal applications securely. The architect decides to use Prisma Access for both internet and private application access. Which component must be configured to allow remote users to access internal applications hosted in the corporate data center?
An engineer is designing a Prisma Access deployment for a company that requires that all traffic from remote users be inspected by the same security policy stack regardless of the user's location. The company has offices in North America, Europe, and Asia. The engineer must ensure that the security policy is enforced consistently and that users always connect to the closest Prisma Access compute location. Which configuration should the engineer use to achieve this?
An administrator is planning a Prisma Access deployment for a small company with 10 remote users. The company does not have any data centers or branch offices. The administrator wants to ensure that the remote users are protected by Prisma Access security policies. What is the minimum configuration required?
An architect is planning a Prisma Access deployment for a multinational company with offices in North America, Europe, and Asia. The company requires that all internet-bound traffic from branch offices be inspected by Prisma Access, and that traffic to internal applications be routed through a Service Connection to a data center in Europe. The architect must minimize latency for internet-bound traffic while ensuring that internal traffic goes through the data center. Which design should the architect use?