SSE-Engineer Prisma Access Planning And Deployment Practice Test 4 — 15 Questions

Question 1

An organization is integrating Prisma Access with their existing Panorama deployment. Which plugin must be installed on Panorama to enable the Prisma Access configuration workflows?

Accepted Answer

Prisma Access plugin. The Prisma Access plugin must be installed on Panorama to enable the Prisma Access configuration workflows, including onboarding, tenant management, and pushing security policy to the Prisma Access cloud infrastructure. Without this plugin, Panorama cannot manage Prisma Access nodes or service connections. It is the required integration component for Panorama-managed Prisma Access deployments.

Answer

SD-WAN plugin

Answer

VM-Series plugin

Answer

Cortex Data Lake plugin

Question 2

An administrator is configuring QoS in Prisma Access for a Remote Network connection. Where must the QoS profile be applied to ensure priority handling for VoIP traffic coming from the branch?

Accepted Answer

On the Remote Network configuration in Panorama under Bandwidth Allocation and QoS. QoS profiles in Prisma Access for remote networks are applied on the Remote Network configuration settings in Panorama under Cloud Services.

Answer

Inside the GlobalProtect Gateway agent configuration profile

Answer

Globally inside the Palo Alto Networks WildFire configuration

Answer

Directly on the customer branch router CLI via MQC

Question 3

Which cloud infrastructure providers host the backend Security Processing Nodes (SPNs) used by Prisma Access?

Accepted Answer

AWS and Google Cloud Platform (GCP). Prisma Access is built on leading hyper-scaler cloud infrastructure, specifically AWS and Google Cloud Platform (GCP).

Answer

Oracle Cloud Infrastructure (OCI) and IBM Cloud

Answer

Microsoft Azure only

Answer

On-premises enterprise datacenters exclusively

Question 4

An architect is designing a high-availability Remote Network location for Prisma Access. Which TWO methods can be used to ensure redundancy for branch office traffic connecting to Prisma Access? (Choose two)

Accepted Answer

Deploy dual branch routers establishing independent IPSec tunnels to Prisma Access. Option A is correct because deploying dual branch routers that each build their own independent IPSec tunnels to Prisma Access provides device-level and path-level redundancy: if one router or its tunnel fails, the second router's tunnel keeps branch traffic flowing to the Prisma Access service. Option C is correct because terminating redundant IPSec tunnels on separate Prisma Access SPNs (Service Processing Nodes) and using BGP path selection lets the branch dynamically prefer a healthy tunnel and fail over to the alternate SPN if one tunnel or node becomes unavailable, achieving both tunnel and PoP/SPN redundancy. The unmarked options do not belong: VRRP (B) is a first-hop redundancy protocol for L2/L3 gateways and cannot be run directly against Prisma Access public cloud gateway IPs, STP (D) is a Layer 2 loop-prevention protocol that has no relevance to routed IPSec tunnel interfaces, and L2TPv3 (E) is a Layer 2 tunneling/ pseudowire technology that is not used for Prisma Access branch redundancy or link aggregation across the cloud service edge.

Answer

Enable VRRP directly across the Prisma Access cloud gateway public IP addresses

Answer

Configure Spanning Tree Protocol (STP) across the IPSec tunnel interfaces

Answer

Use L2TPv3 link aggregation across the cloud service edge

Question 5

An enterprise is implementing Prisma Access and wants to ensure strict security governance. Which THREE capabilities are provided natively by Prisma Access security processing nodes (SPNs)? (Choose three)

Accepted Answer

URL Filtering with real-time category lookups. Prisma Access provides comprehensive cloud-delivered security services including Threat Prevention, URL Filtering, and WildFire malware analysis natively on SPNs.

Answer

Local enterprise data center physical power failover management

Answer

Physical rack-and-stack server hardware maintenance by the customer

Question 6

An administrator is reviewing the status of a Prisma Access deployment using Prisma Access Insights. Which THREE key metrics or insights can be viewed through this tool? (Choose three)

Accepted Answer

Service health and status of cloud infrastructure and tunnels. Prisma Access Insights provides visibility into service health, license utilization, active user counts, and bandwidth consumption across locations.

Answer

Individual endpoint user Windows registry configurations

Answer

Local branch switch port VLAN configurations

Question 7

When designing a multi-region Prisma Access architecture, an architect must consider compute locations and routing preferences. Which THREE factors influence the selection and placement of compute locations? (Choose three)

Accepted Answer

Geographic distribution of remote users and branch offices. Compute location selection is driven by user geographic distribution, regulatory compliance requirements, and proximity to enterprise SaaS or data center locations.

Answer

The physical desk layout of employee cubicles in branch offices

Answer

The local power grid provider utilized by the cloud data center

Question 8

A security engineer is deploying Prisma Access and needs to ensure that explicit proxy traffic from remote users is inspected. Which component must be configured in the Prisma Access infrastructure to handle explicit proxy traffic?

Accepted Answer

Explicit Proxy Service. Explicit proxy traffic requires the Explicit Proxy Service to be configured in Prisma Access. This service listens for proxy requests and applies security policies, ensuring that users who manually set a proxy in their browser still receive inspection. Other components like the GlobalProtect portal or Service Connections serve different purposes and cannot handle explicit proxy traffic.

Answer

Remote Network

Answer

GlobalProtect portal

Answer

Service Connection

Question 9

An administrator is configuring a Service Connection in Prisma Access and wants to ensure that traffic from remote networks to on-premises resources is routed correctly. The on-premises network uses BGP with a private AS number. Which configuration must be applied on the Prisma Access side to establish BGP peering?

Accepted Answer

Enable BGP on the Service Connection and specify the peer AS and peer IP address.. For BGP peering over a Service Connection, you must enable BGP and provide the peer AS and peer IP address. This allows dynamic route exchange with the on-premises router, which uses a private AS number. Prisma Access supports BGP over Service Connections, and this configuration ensures proper routing and failover for traffic destined to on-premises resources.

Answer

Configure a static route to the on-premises network.

Answer

Set up an IPSec tunnel with BGP over it.

Answer

Configure OSPF on the Service Connection.

Question 10

An engineer is planning the initial deployment of Prisma Access for an organization that wants to avoid routing internal traffic through the corporate data center for internet-bound traffic. Which deployment component must be configured to allow mobile users to connect directly to Prisma Access and access the internet without backhauling through headquarters?

Accepted Answer

Mobile Users. The correct answer is Mobile Users because it is the Prisma Access component specifically designed to provide secure, direct connectivity for remote and mobile users. By deploying Mobile Users, organizations can ensure that user traffic to the internet and internal resources is secured and optimized without backhauling through a central data center. This aligns with the goal of avoiding data center routing for internet-bound traffic.

Answer

Remote Networks

Answer

Explicit Proxy

Answer

Service Connections

Question 11

An administrator is deploying a new Prisma Access Remote Network location and needs to ensure that traffic from the branch is inspected by security policies before reaching the internet. Which configuration step is required to direct traffic to Prisma Access for inspection?

Accepted Answer

Configure a static route on the branch router pointing all traffic to the Prisma Access tunnel interface.. The correct answer is to configure a static route on the branch router pointing all traffic to the Prisma Access tunnel interface. This ensures that all internet-bound traffic is directed through the IPSec tunnel to Prisma Access, where security policies are applied. Without this route, traffic might bypass Prisma Access and go directly to the internet, leaving it uninspected.

Answer

Enable split tunneling on the branch router to send only corporate traffic through the tunnel.

Answer

Set up a GRE tunnel to Prisma Access for all traffic.

Answer

Configure policy-based routing to send only HTTP and HTTPS traffic to Prisma Access.

Question 12

An engineer is deploying Prisma Access for the first time and needs to onboard the infrastructure using the Prisma Access Cloud Management portal. The organization requires that all configuration changes be validated before being pushed to production. Which built-in workflow should the engineer use to meet this requirement?

Accepted Answer

Commit validation. In Prisma Access Cloud Management, commit validation is the feature that checks configuration changes for errors before they are applied. It ensures that the intended changes are syntactically correct and do not conflict with existing settings, thereby reducing the risk of misconfiguration. The other options are either for auditing, optimization, or a different management method, and do not provide pre-commit validation.

Answer

Panorama commit

Answer

Configuration audit log

Answer

Policy Optimizer

Question 13

A security engineer is planning a Prisma Access deployment for a company with offices in North America and Europe. The company wants to ensure that users in each region connect to the nearest Prisma Access location to minimize latency. Which Prisma Access component should the engineer configure to achieve this?

Accepted Answer

Mobile Users locations. Mobile Users locations are the regional gateways for remote user traffic. When multiple locations are configured, GlobalProtect clients can automatically connect to the closest one, reducing latency. This is the intended design for global user distribution. Remote Network locations, Service Connections, and Explicit Proxy serve different purposes and do not provide automatic geographic redirection for mobile users.

Answer

Explicit Proxy

Answer

Remote Network locations

Answer

Service Connections

Question 14

An engineer is configuring Prisma Access for a remote network location that uses an IPSec tunnel to connect to the Prisma Access infrastructure. The engineer needs to ensure that the tunnel is highly available and can fail over to a secondary ISP if the primary ISP fails. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Configure two IPSec tunnels to the same Prisma Access location using different ISPs.. To achieve high availability for a remote network with IPSec tunnels, you must configure two tunnels using different ISPs and enable BGP on both. This allows dynamic failover if one ISP fails. BGP ensures that routes are withdrawn and traffic is rerouted over the remaining tunnel, maintaining connectivity.

Answer

Use a single ISP with a backup link that is not actively used.

Answer

Configure the remote network to use a dynamic IP address for the IPSec tunnel.

Answer

Configure a single IPSec tunnel with multiple proxy IDs for redundancy.

Question 15

A security engineer is deploying Prisma Access for mobile users and needs to ensure that all traffic from the GlobalProtect app is inspected by the security processing nodes, including traffic destined for the internet. Which setting must be configured in the Prisma Access mobile user configuration?

Accepted Answer

The tunnel must be configured to include all traffic (0.0.0.0/0) and split tunneling disabled.. To inspect all traffic from mobile users, including internet-bound traffic, the GlobalProtect tunnel must be configured to include all traffic (0.0.0.0/0) and split tunneling must be disabled. This ensures that no traffic bypasses the security processing nodes. The other options do not achieve full traffic inspection; they either allow bypass or address different aspects of the configuration.

Answer

Split tunneling must be enabled to allow direct internet access.

Answer

The 'No Direct Access to Local Network' option must be enabled.

Answer

The 'Enforce GlobalProtect for Network Access' option must be enabled.