SSE-Engineer Prisma Access Planning And Deployment Practice Test 3 — 15 Questions

Question 1

A security engineer is planning the deployment of Prisma Access Service Connections to connect branch offices to Prisma Access. Which TWO components are required to establish a Service Connection? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A BGP peering configuration between the customer's router and Prisma Access. Service Connections require a dedicated license to enable the private interconnect and BGP peering to exchange routes dynamically. IPSec tunnels are used for Remote Networks, not Service Connections. Panorama plugins and static routes are not required for the connectivity itself. Thus, the license and BGP configuration are the essential components.

Answer

A Panorama plugin for Prisma Access

Answer

A static route pointing to the Prisma Access service IP address

Answer

An IPSec VPN tunnel configured between the branch office and Prisma Access

Question 2

A security engineer is configuring a Service Connection in Prisma Access to connect a data center to the service. The engineer needs to ensure that the Service Connection supports dynamic routing and failover. Which two routing protocols can be used on the Service Connection to achieve this? (Choose two.)

Accepted Answer

BGP. Prisma Access Service Connections support BGP, specifically eBGP, for dynamic routing. BGP allows the exchange of routes between the data center and Prisma Access and supports failover through multiple peers and path attributes. OSPF, RIP, and static routing are not supported or do not meet the dynamic routing requirement. Therefore, BGP and eBGP are the correct choices.

Answer

Static routing

Answer

RIP

Answer

OSPF

Question 3

A security engineer is configuring a Prisma Access Service Connection to connect a branch office to a corporate data center. The engineer needs to ensure that traffic from the branch to the data center is inspected by Prisma Access security policies. The branch uses a single IPSec tunnel to Prisma Access, and the data center is connected via a Service Connection. Which configuration is required to allow traffic to flow from the branch to the data center through Prisma Access?

Accepted Answer

Configure the Service Connection with a static route to the branch subnets, and configure the branch tunnel with a static route to the data center subnets.. Traffic from a branch to a data center through Prisma Access requires routes on both the branch side and the Prisma Access side. The branch needs a route to the data center subnets via the IPSec tunnel, and Prisma Access needs a route to the data center subnets via the Service Connection. The data center must also have a return route to the branch via Prisma Access. Static routes can accomplish this.

Answer

Enable BGP between the branch router and Prisma Access, and between Prisma Access and the data center, to exchange routes dynamically.

Answer

Configure a policy-based VPN on the branch router to selectively send data center traffic through the tunnel.

Answer

Configure a static route on the branch router pointing to the Prisma Access tunnel for the data center subnets.

Question 4

An engineer is designing a Prisma Access deployment with multiple Remote Networks and Service Connections. The organization requires that traffic between Remote Networks and the data center be encrypted and that the data center routes be dynamically learned. Which two configuration steps are necessary to achieve this? (Choose two.)

Accepted Answer

Set up BGP peering between the Remote Network and Prisma Access.. To securely connect Remote Networks to Prisma Access and enable dynamic route learning, an IPSec tunnel must be established between each Remote Network and Prisma Access. Additionally, BGP peering must be configured between the Remote Network and Prisma Access to exchange routes dynamically. This combination ensures encrypted transport and dynamic learning of data center routes, meeting the organization's requirements for security and routing.

Answer

Configure a static route on the Remote Network for the data center subnets.

Answer

Enable OSPF on the Service Connection for route redistribution.

Answer

Establish a dedicated VPN tunnel between each Remote Network and the data center.

Question 5

A security engineer is planning a Prisma Access deployment for a company that has a single data center and wants to provide secure internet access for remote users. The company requires that all user traffic to the internet be inspected by Prisma Access, but traffic to internal applications hosted in the data center should not traverse the Prisma Access infrastructure. Which component should the engineer configure to meet these requirements?

Accepted Answer

Service Connection. A Service Connection establishes a secure tunnel between Prisma Access and the customer's data center, allowing internal traffic to be routed directly without inspection. This satisfies the requirement to inspect only internet-bound traffic while bypassing Prisma Access for internal applications. The other options either route internal traffic through Prisma Access or do not provide the necessary routing control.

Answer

Mobile User license

Answer

Remote Network

Answer

Explicit Proxy

Question 6

A network engineer is planning a Prisma Access deployment with a Service Connection to a data center. The data center uses a BGP autonomous system number (ASN) of 65001, and the engineer wants to advertise specific subnets to Prisma Access. The engineer also needs to ensure that traffic from Prisma Access to the data center is routed correctly. Which configuration should the engineer use on the Prisma Access side to establish BGP peering?

Accepted Answer

Configure a BGP peer with the data center's ASN and specify the data center's IP address as the peer IP.. To establish BGP peering between Prisma Access and a data center, the engineer must configure a BGP peer on Prisma Access with the data center's ASN and the data center's BGP router IP address as the peer IP. This enables dynamic route exchange, allowing Prisma Access to advertise subnets and learn routes from the data center.

Answer

Configure a static route to the data center's subnets and enable BGP on the service connection.

Answer

Configure the data center's ASN as the local ASN on Prisma Access and use the data center's IP as the peer IP.

Answer

Configure a BGP peer with the data center's ASN and use the service connection's tunnel IP as the peer IP.

Question 7

When planning a Prisma Access deployment for Mobile Users, which IP address allocation method is recommended and most commonly used for assigning virtual IP addresses to GlobalProtect clients?

Accepted Answer

Automatic IP address allocation managed by Prisma Access. Prisma Access automatically manages and allocates dynamic IP pools for mobile users via Panorama.

Answer

Static IP assignment per user via Active Directory attributes

Answer

Static IP assignment via local DHCP server in each branch office

Answer

Manual entry by users upon connection

Question 8

During the initial deployment of Prisma Access for remote networks, an administrator needs to define the bandwidth allocation for a specific compute location. Which tool is used to manage and push this bandwidth allocation?

Accepted Answer

Panorama. Bandwidth allocation for a specific compute location in Prisma Access is managed through Panorama, where the Prisma Access plugin exposes the Service Setup and compute location configuration, including the bandwidth (Mbps) assigned to each compute location. Panorama then pushes this allocation to the Prisma Access cloud service, making it the correct management tool.

Answer

Prisma SD-WAN Cloud Controller

Answer

Prisma Access Plugin for AWS Console

Answer

GlobalProtect Portal standalone web GUI

Question 9

An organization requires traffic from remote users to specific SaaS applications to bypass the Prisma Access cloud security processing nodes and go directly to the internet. Which feature should the administrator configure?

Accepted Answer

GlobalProtect Split Tunneling based on Access Routes and Domains. Prisma Access allows Split Tunneling based on domains or destinations so that specific traffic (like video streaming or trusted SaaS) bypasses the VPN tunnel.

Answer

Explicit Proxy PAC file routing

Answer

SD-WAN Traffic Steering Policies

Answer

SSL Decryption Exclusion Objects

Question 10

An architect is designing a Prisma Access deployment for a global enterprise that requires low-latency connectivity for remote workers across North America, Europe, and Asia. Which component should the architect deploy to ensure traffic processing occurs closest to the user's geographical location?

Accepted Answer

Multiple Security Processing Nodes (SPNs) distributed across multiple geographic regions. To ensure traffic processing occurs closest to users across North America, Europe, and Asia, the architect should deploy multiple Security Processing Nodes (SPNs) distributed across those geographic regions. SPNs are the compute nodes that perform security processing, and distributing them reduces latency by handling traffic near the user.

Answer

A dedicated hardware Panorama appliance in each branch office

Answer

Prisma SD-WAN appliances at every remote user laptop

Answer

A single centralized Prisma Access parent node in the headquarters region

Question 11

An administrator needs to configure secure connectivity between a corporate data center and Prisma Access for headquarters-bound traffic. Which type of connection object should be created in Panorama?

Accepted Answer

Service Connection. A Service Connection is used to connect enterprise headquarters or data centers to Prisma Access.

Answer

Prisma SD-WAN Hub Integration

Answer

GlobalProtect Gateway Connection

Answer

Remote Network Connection

Question 12

A network engineer is configuring remote user access in Prisma Access and needs to ensure that internal corporate DNS resolution is utilized when users are connected via the GlobalProtect app. Where must the engineer configure the primary and secondary internal DNS server IP addresses?

Accepted Answer

In the Panorama GlobalProtect Client Settings configuration under Network Settings. In Prisma Access, the internal DNS servers that GlobalProtect clients use for corporate name resolution are defined in the GlobalProtect Client Settings configuration within Panorama, specifically under Network Settings (DNS Server fields). This pushes the primary and secondary DNS server IPs to the GlobalProtect agent so that split-tunnel DNS queries for internal domains are sent to corporate resolvers rather than the local ISP DNS.

Answer

In the Prisma SD-WAN DNS proxy forwarding table

Answer

Directly on the remote user local machine registry

Answer

In the cloud Managed Security Services Provider (MSSP) portal

Question 13

Which administrative role or tool is primarily used to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions?

Accepted Answer

Prisma Access Insights. Prisma Access Insights is the administrative tool specifically designed to monitor the status, health, and aggregate traffic statistics of a Prisma Access deployment across all regions. It provides dashboards, alerts, and analytics for mobile users, remote networks, and service connections. It is the primary monitoring and visibility platform for Prisma Access.

Answer

Prisma Cloud Compute Console

Answer

WildFire portal

Answer

Cortex XDR incident management console

Question 14

An architect is sizing a Prisma Access Remote Network location that experiences heavy video streaming traffic. Which factor is most critical when determining the required bandwidth license for this location?

Accepted Answer

The peak aggregate throughput of all users at the branch location. Remote Network bandwidth must be provisioned based on the peak aggregate throughput expected from all users behind the branch router.

Answer

The total number of IP addresses in the branch local DHCP scope

Answer

The number of active BGP peers configured on the branch router

Answer

The maximum transmission unit (MTU) size configured on the IPSec tunnel

Question 15

An enterprise requires mobile users connecting via Prisma Access to authenticate using an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is this authentication profile referenced in Panorama for mobile users?

Accepted Answer

In the GlobalProtect Portal configuration under Authentication. SAML authentication for mobile users is configured and referenced within the GlobalProtect Portal external authentication settings.

Answer

In the Panorama Log Forwarding profile

Answer

In the Prisma Access Remote Network BGP peer settings

Answer

In the Service Connection QoS profile