SSE-Engineer Prisma Access Planning And Deployment Practice Test 2 — 15 Questions

Question 1

An engineer is preparing a Prisma Access Service Connection over an AWS Transit Gateway. The customer requires that the IPSec tunnel to Prisma Access uses a /30 point-to-point subnet and that traffic from on-premises is routed symmetrically. Which configuration must the engineer verify on the Prisma Access side before adding the Service Connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Service Connection must have a unique Autonomous System Number (ASN) that does not conflict with the customer's ASN, and BGP peering must be established over the tunnel.. Service Connections in Prisma Access use BGP for dynamic routing. The engineer must ensure that the ASN used by Prisma Access does not conflict with the customer's ASN and that BGP peering is successfully established over the IPSec tunnel. This ensures that routes from the customer's network are advertised into Prisma Access and vice versa, enabling symmetric traffic flow. Without correct BGP configuration, the Service Connection will not function properly.

Answer

The Service Connection must use a /29 subnet to accommodate the Transit Gateway's requirement for a minimum of five IP addresses.

Answer

The Service Connection must be configured with a static route pointing to the on-premises network via the Transit Gateway.

Answer

The Service Connection must be configured with OSPF area 0 to exchange routes with the Transit Gateway.

Question 2

An architect is planning a Prisma Access deployment that will use a Service Connection to provide access to internal applications. The customer requires that traffic from Remote Networks to the data center be inspected by Prisma Access security policies before reaching the internal servers. Which component must be configured to ensure that traffic is steered through the Prisma Access security processing nodes?

Accepted Answer

Ensure that the Service Connection is associated with the correct security zone and that security policies are applied to that zone.. To ensure traffic from Remote Networks to internal applications is inspected, the Service Connection must be associated with a security zone, and security policies must be applied to that zone. Prisma Access security processing nodes enforce policies based on zones. Without proper zone assignment and policy configuration, traffic may bypass inspection. The other options either misunderstand the architecture or reference non-existent features.

Answer

Enable 'Traffic Stealing' on the Service Connection to redirect traffic to the security processing nodes.

Answer

Configure the Service Connection with the 'Security Inspection' option enabled.

Answer

Configure a static route on the Remote Network firewall pointing to the Prisma Access service IP.

Question 3

An engineer is planning a Prisma Access deployment with a Service Connection to a data center. The data center uses a BGP AS number of 65001, and the engineer wants to ensure that Prisma Access prefers the Service Connection over the Remote Network VPN for traffic destined to the data center. Which BGP configuration should be applied?

Accepted Answer

Advertise the data center routes with a lower MED value over the Service Connection.. The correct answer is to advertise the data center routes with a lower MED value over the Service Connection. MED is used to influence inbound traffic from an external autonomous system. By setting a lower MED, Prisma Access will prefer the Service Connection path for traffic destined to the data center, ensuring that the desired path is used.

Answer

Advertise the data center routes with a higher local preference over the Service Connection.

Answer

Advertise the data center routes with a higher AS path length over the Service Connection.

Answer

Advertise the data center routes with a lower weight over the Service Connection.

Question 4

An administrator is deploying Prisma Access and needs to ensure that all traffic from remote networks is inspected by the security processing nodes. The administrator has configured the remote network and service connection. Which additional step is required to enable traffic inspection?

Accepted Answer

Configure the remote network to use a static route pointing to the Prisma Access tunnel interface.. To enable traffic inspection, the remote network must route traffic to Prisma Access via the IPSec tunnel. Configuring a static route to the tunnel interface ensures that traffic is sent to Prisma Access, where security processing nodes inspect it. Without this routing, traffic would bypass Prisma Access and not be inspected.

Answer

Create a security policy rule that allows traffic from the remote network to the internet.

Answer

Assign a security zone to the remote network tunnel interface.

Answer

Enable SSL decryption on the remote network firewall.

Question 5

A security engineer is deploying Prisma Access for a large enterprise with multiple Remote Networks. The organization requires that all traffic from Remote Networks to the internet be inspected by Prisma Access security services, while traffic to the data center must bypass inspection and go directly over the Service Connection. Which Prisma Access component is responsible for enforcing this traffic steering policy?

Accepted Answer

The Security Processing Node (SPN). The Security Processing Node (SPN) is the component that applies security policies and determines whether traffic is inspected or bypassed. In this scenario, the SPN inspects internet-bound traffic from Remote Networks while allowing data center traffic to bypass inspection and use the Service Connection. The SPN is where the security enforcement happens, based on the configured policies.

Answer

The Prisma Access Insights portal

Answer

The Remote Network's local firewall

Answer

The Service Connection

Question 6

An administrator is planning a Prisma Access deployment and needs to choose the appropriate license to enable advanced threat prevention features such as WildFire and DNS Security. Which license bundle should be selected?

Accepted Answer

Prisma Access Advanced Threat Prevention. The Prisma Access Advanced Threat Prevention license bundle is specifically designed to enable advanced threat prevention features, including WildFire and DNS Security. Other licenses like Enterprise or Business Premium may include some features, but the Advanced Threat Prevention license is the direct choice for these capabilities. Cloud Management is a management tool, not a security license.

Answer

Prisma Access Cloud Management

Answer

Prisma Access Enterprise

Answer

Prisma Access Business Premium

Question 7

An engineer is deploying Prisma Access for a new remote network location and must choose the correct license type to support a 2 Gbps IPSec tunnel and advanced security services. Which Prisma Access license model should be selected?

Accepted Answer

Prisma Access Enterprise Edition. Prisma Access Enterprise Edition is the only license model that supports high-throughput remote network connections and includes advanced security services. The Business Edition is limited in bandwidth and features, while add-on licenses and Cloud Managed Edition do not provide the necessary base capabilities. Therefore, Enterprise Edition is required to meet the 2 Gbps and advanced security requirements.

Answer

Prisma Access Add-on License for Advanced Threat Prevention

Answer

Prisma Access Business Edition

Answer

Prisma Access Cloud Managed Edition

Question 8

An architect is designing a Prisma Access deployment that includes both Mobile Users and Remote Networks. The organization requires that all traffic from Remote Networks is inspected by security policies, and that Mobile Users can access internal applications hosted in a data center connected via a Service Connection. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Configure Remote Networks with a default route pointing to the Prisma Access tunnel to force all traffic through inspection.. The two required configurations are: a Service Connection to the data center with advertised routes, and Remote Networks with a default route to the Prisma Access tunnel. The Service Connection enables Mobile Users to reach internal applications, while the default route on Remote Networks ensures all traffic is inspected by Prisma Access. Together, these meet the stated requirements.

Answer

Configure a Remote Network with a static route to the data center via the Service Connection.

Answer

Enable split tunneling on Mobile Users to send only corporate traffic through the tunnel.

Answer

Configure Mobile Users with a Service Connection to the data center.

Question 9

An administrator is deploying Prisma Access for the first time and needs to activate the service. Which step is required before Prisma Access can be configured and used?

Accepted Answer

Activate Prisma Access from the Palo Alto Networks hub.. Activating Prisma Access from the Palo Alto Networks hub is the required first step. This process links the purchased license to a tenant and enables the service. Only after activation can you configure Service Connections, Remote Networks, and security policies. The other options are either prerequisites or subsequent configuration steps that depend on activation.

Answer

Install the Prisma Access plugin on Panorama.

Answer

Configure a Service Connection in Panorama.

Answer

Register the Prisma Access license on the Palo Alto Networks Customer Support Portal.

Question 10

A network architect is designing a Prisma Access deployment with multiple remote network locations. The architect must ensure that if one remote network location fails, traffic automatically fails over to another location without manual intervention. Which feature should be configured to achieve this?

Accepted Answer

Use dynamic routing with BGP and configure the remote network locations to advertise routes with different BGP attributes to influence path selection.. Automatic failover between remote network locations is achieved through dynamic routing with BGP. By configuring BGP attributes, the network can influence path selection and ensure that if one location fails, traffic is rerouted to another location without manual intervention. This provides seamless redundancy and high availability.

Answer

Enable Prisma Access redundancy by configuring multiple IPSec tunnels from each remote network to different Prisma Access locations.

Answer

Set up Prisma Access in a active-active configuration with a load balancer.

Answer

Configure BGP with multiple remote network locations advertising the same routes.

Question 11

An administrator is setting up a new Prisma Access deployment and needs to ensure that Remote Network locations can resolve internal corporate domain names. The corporate DNS servers are located in the data center and are reachable via the Service Connection. Which configuration should the administrator implement to achieve this?

Accepted Answer

Enable DNS proxy on Prisma Access and configure it to forward queries to the corporate DNS servers.. To resolve internal corporate domain names, Prisma Access must forward DNS queries to the corporate DNS servers. The DNS proxy feature in Prisma Access accomplishes this by intercepting DNS requests from Remote Networks and forwarding them over the Service Connection to the internal DNS servers. This ensures that internal domains are resolved correctly without requiring manual static entries or public DNS.

Answer

Configure the Remote Network's DNS settings to point to the corporate DNS servers' IP addresses.

Answer

Create a static DNS entry on the Remote Network firewall for each internal domain.

Answer

Configure the Remote Network to use public DNS servers for all queries.

Question 12

An architect is designing a Prisma Access deployment for a large enterprise with multiple remote networks and mobile users. The architect needs to ensure that traffic from remote networks to the internet is inspected by Prisma Access security services, while traffic between remote networks is not inspected to reduce latency. Which Prisma Access feature should be configured to achieve this?

Accepted Answer

Policy-Based Forwarding (PBF). Policy-Based Forwarding (PBF) enables you to define policies that route traffic based on criteria such as source, destination, and application. By configuring PBF, you can direct internet-bound traffic from remote networks through Prisma Access for security inspection, while allowing traffic between remote networks to bypass inspection, reducing latency and optimizing performance.

Answer

Quality of Service (QoS) profiles

Answer

Security Processing Node (SPN) affinity

Answer

Traffic Steering

Question 13

A security engineer is planning a Prisma Access deployment for a company that requires all internet-bound traffic from remote users to be inspected by Prisma Access. The company also wants to ensure that traffic to internal applications goes through a Service Connection to the data center. Which Prisma Access feature should be configured to direct traffic appropriately?

Accepted Answer

GlobalProtect with default route. To ensure all internet-bound traffic is inspected and internal traffic goes through a Service Connection, the GlobalProtect client should be configured with a default route (0.0.0.0/0) to force all traffic through Prisma Access. Prisma Access then applies security policies and routes traffic appropriately. Split tunneling would bypass inspection, PBF is for internal forwarding decisions, and Explicit Proxy only handles web traffic.

Answer

Policy-Based Forwarding

Answer

Explicit Proxy

Answer

Split tunneling

Question 14

A network engineer is configuring a Service Connection in Prisma Access to connect to a customer's data center. The engineer needs to ensure that traffic from Prisma Access to the data center is routed through the Service Connection and not the internet. Which configuration is required on the Prisma Access side?

Accepted Answer

Configure BGP on the Service Connection and advertise the data center subnets from the customer's router to Prisma Access.. Service Connections in Prisma Access require BGP for dynamic routing. The customer's router must advertise the data center subnets to Prisma Access over BGP. Prisma Access will then use these routes to direct traffic through the Service Connection. Static routes and OSPF are not supported. This ensures that traffic destined for the data center is routed correctly and not sent over the internet.

Answer

Enable OSPF on the Service Connection and configure the data center subnets as OSPF networks.

Answer

Configure a static route on Prisma Access pointing to the Service Connection for the data center subnets.

Answer

Advertise the data center subnets over BGP to Prisma Access and configure a static route on the data center router.

Question 15

An architect is planning a Prisma Access deployment for a company that requires high availability for its Remote Network locations. The company has two data centers and wants to ensure that if one IPSec tunnel fails, traffic automatically fails over to the other. The architect must configure the Remote Network with redundant tunnels. Which TWO actions must be taken to achieve this? (Choose two.)

Accepted Answer

Enable BGP routing on both tunnels and advertise the same routes with different metrics or AS path prepending.. High availability for Remote Networks requires multiple IPSec tunnels to different Prisma Access locations and a dynamic routing protocol like BGP to manage failover. BGP advertises routes over both tunnels and withdraws them upon failure, ensuring traffic uses the remaining tunnel. This combination provides both redundancy and automatic failover.

Answer

Configure the Remote Network to use a single tunnel with ECMP enabled on the customer edge router.

Answer

Use dynamic routing with OSPF over a single IPSec tunnel to detect failures.

Answer

Configure a single IPSec tunnel with multiple proxy IDs to simulate redundancy.