SSE-Engineer Prisma Access Planning And Deployment Practice Test 5 — 15 Questions

Question 1

An administrator is deploying Prisma Access and needs to ensure that remote users can access internal applications hosted in a data center. The data center is connected to Prisma Access via a service connection. The administrator wants to avoid exposing internal IP addresses to the internet. Which Prisma Access component should be used to securely route traffic from remote users to the data center?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service Connection. A Service Connection in Prisma Access provides a secure, private link between the Prisma Access infrastructure and the customer's data center. This allows remote users to access internal applications without exposing them to the internet. It is the correct component for securely routing traffic from remote users to the data center.

Answer

Remote Network

Answer

Mobile User

Answer

Explicit Proxy

Question 2

An administrator is configuring a Remote Network in Prisma Access to connect a branch office. The branch office has a single ISP link and requires high availability. The administrator wants to ensure that if the primary IPSec tunnel fails, traffic automatically switches to a secondary tunnel. Which Prisma Access feature should be configured to achieve this?

Accepted Answer

Multiple IPSec tunnels with BGP. High availability for a Remote Network is achieved by configuring multiple IPSec tunnels and using BGP for route failover. BGP dynamically withdraws routes when a tunnel fails, directing traffic to the remaining tunnel. Policy-Based Forwarding, QoS, and Explicit Proxy do not provide this automatic failover capability.

Answer

Explicit Proxy

Answer

Policy-Based Forwarding

Answer

Quality of Service (QoS)

Question 3

An administrator is planning a Prisma Access deployment for a new branch office. The branch has a single ISP connection and requires high availability for Remote Network connectivity. Which Prisma Access feature should the administrator use to provide redundancy?

Accepted Answer

Configure two IPSec tunnels to different Prisma Access locations.. To provide high availability for a Remote Network with a single ISP, the administrator should configure two IPSec tunnels to different Prisma Access locations. This allows failover if one location becomes unavailable. Other options either do not provide redundancy or are insufficient for high availability. BGP and DPD are useful but require multiple tunnels to be effective.

Answer

Enable BGP with a single tunnel to the nearest Prisma Access location.

Answer

Configure a single tunnel with two different pre-shared keys.

Answer

Use a single IPSec tunnel with IKEv2 and enable Dead Peer Detection.

Question 4

An engineer is deploying a new Prisma Access tenant for a multinational company. The security team requires that all remote user traffic be inspected by a dedicated set of Security Processing Nodes located in the same region as the users, to minimize latency. The company has offices in North America, Europe, and Asia. Which deployment model should the engineer choose to meet this requirement?

Accepted Answer

Configure multiple mobile user locations in Prisma Access, one for each region, and assign users to the appropriate location based on their geographic location.. The requirement is to have dedicated Security Processing Nodes in the same region as users to minimize latency. Prisma Access supports multiple mobile user locations, each with its own SPNs. By deploying a location per region and directing users to the nearest one, traffic is inspected locally. Other options either centralize inspection or use features not intended for mobile users.

Answer

Set up a Remote Network connection in each region and route all remote user traffic through the corporate data center for inspection.

Answer

Use Prisma Access with a single service connection and enable ECMP to distribute traffic across multiple SPNs globally.

Answer

Deploy a single Prisma Access tenant with a global mobile user location and enable GlobalProtect with automatic region selection.

Question 5

A network architect is designing a Prisma Access deployment for a company with multiple remote networks. The company requires that traffic from remote networks to the internet be inspected by Prisma Access, but they also want to minimize latency for cloud applications. Which feature should be enabled to optimize routing for cloud applications?

Accepted Answer

Cloud On-Ramp. Cloud On-Ramp is the feature that optimizes routing for cloud applications by directing traffic to the nearest Prisma Access location and then to the cloud application, reducing latency. Other features like Traffic Steering, QoS, or Service Connections serve different purposes and do not provide the specific optimization needed for cloud applications.

Answer

Traffic Steering

Answer

QoS

Answer

Service Connection

Question 6

An administrator is planning to deploy Prisma Access for a company with a single data center and multiple branch offices. The administrator needs to ensure that branch office traffic to the internet is secured by Prisma Access, while traffic to the data center is routed directly. Which Prisma Access component must be deployed to connect the branch offices to Prisma Access?

Accepted Answer

Remote Network. Remote Network is the Prisma Access component designed to connect branch offices via IPSec tunnels, ensuring their internet-bound traffic is secured. Service Connection connects to data centers, Mobile User is for individual users, and Explicit Proxy is for proxy-based redirection. Therefore, Remote Network is the correct choice for branch office connectivity.

Answer

Explicit Proxy

Answer

Service Connection

Answer

Mobile User

Question 7

An architect is planning a Prisma Access deployment with a Service Connection to a data center. The data center advertises a default route (0.0.0.0/0) to Prisma Access over BGP. The architect wants to ensure that internet-bound traffic from Remote Networks is inspected by Prisma Access and not sent back to the data center. Which configuration should be applied to prevent the default route from being used for internet traffic?

Accepted Answer

Apply an inbound filter on the Service Connection to reject the default route.. To prevent internet-bound traffic from being sent to the data center, the default route learned via BGP from the data center must be filtered out. Applying an inbound filter on the Service Connection to reject the 0.0.0.0/0 route ensures that Prisma Access does not install this route. Consequently, internet-bound traffic from Remote Networks will be routed to the internet through Prisma Access, where it can be inspected by security policies.

Answer

Disable BGP on the Service Connection and use static routes instead.

Answer

Set the default route's administrative distance higher than other routes.

Answer

Configure a more specific route for internet-bound traffic on the Remote Network.

Question 8

An architect is planning a Prisma Access deployment for a large enterprise with multiple Remote Network locations. The architect must ensure that the deployment meets the requirements for high availability and scalability. Which TWO factors should the architect consider when designing the Remote Network locations? (Choose two.)

Accepted Answer

The bandwidth of each ISP connection and the total aggregate bandwidth required for the Remote Network.. High availability and scalability for Remote Networks depend on the number and distribution of IPSec tunnels and the available bandwidth. Distributing tunnels across multiple Prisma Access locations provides redundancy, while sufficient bandwidth ensures performance as traffic grows. Mobile users and SPN types are not relevant to Remote Network design, and routing protocol is secondary to tunnel count and bandwidth.

Answer

The routing protocol used between the Remote Network and Prisma Access.

Answer

The number of mobile users assigned to each Remote Network location.

Answer

The type of security processing node (SPN) used for each Remote Network location.

Question 9

An architect is designing a Prisma Access deployment for a company with offices in North America and Europe. The company wants to minimize latency for users accessing SaaS applications. Which Prisma Access feature should be leveraged to achieve this?

Accepted Answer

Deploy Remote Networks in each region and enable local internet breakout with security inspection.. To minimize latency for SaaS applications, Remote Networks should be deployed in each region. Remote Networks connect branch offices to the nearest Prisma Access security processing node, where traffic is inspected and then broken out to the internet locally. This avoids backhauling and reduces latency. Service Connections are for data center connectivity, and Mobile Users are for individual users, not offices.

Answer

Enable Prisma Access Mobile Users with GlobalProtect and use the closest security processing node.

Answer

Use Service Connections in each region to route SaaS traffic through the data center.

Answer

Configure Remote Networks in each region and use Service Connections to backhaul traffic to a central data center.

Question 10

An administrator is configuring Prisma Access for remote users and needs to ensure that split tunneling is used for specific applications. Which Prisma Access component is responsible for enforcing split tunneling policies?

Accepted Answer

GlobalProtect gateway. Split tunneling for remote users is enforced by the GlobalProtect gateway, which applies the configured split tunnel policy to direct traffic either through the tunnel or directly to the internet. The portal handles authentication and configuration delivery, while Service Connections and Insights serve different purposes. Thus, the gateway is the correct component.

Answer

Prisma Access Insights

Answer

GlobalProtect portal

Answer

Prisma Access Service Connection

Question 11

An administrator is configuring Prisma Access for the first time and needs to onboard the Prisma Access infrastructure. Which step must be completed before configuring Remote Networks and Service Connections?

Accepted Answer

Activate the Prisma Access license and allocate the infrastructure. The first step in deploying Prisma Access is to activate the license and allocate the infrastructure. This provisions the cloud-based security processing nodes and network components. Only after this onboarding can Remote Networks, Service Connections, and other configurations be set up. Other tasks like GlobalProtect or BGP are part of subsequent configuration phases.

Answer

Set up a Panorama management server

Answer

Configure BGP peering with the customer's data center

Answer

Deploy a GlobalProtect portal and gateway

Question 12

An administrator is setting up a new Prisma Access deployment and needs to ensure that the initial configuration is applied correctly. The administrator has already activated the Prisma Access license and is now in the Prisma Access configuration workflow. Which step must be completed first before configuring Remote Networks and Service Connections?

Accepted Answer

Configure the Prisma Access infrastructure settings, including the tenant and service connection type.. In the Prisma Access configuration workflow, the first step is to configure the infrastructure settings. This includes specifying the tenant, selecting the service connection type, and defining the locations for mobile users and remote networks. These settings are foundational and must be completed before moving on to more specific configurations like Remote Networks, Service Connections, or security policies.

Answer

Set up GlobalProtect portals and gateways for remote users.

Answer

Configure DNS and DHCP settings for the service connections.

Answer

Create security policies for remote users and remote networks.

Question 13

A network architect is planning a Prisma Access deployment for a company with a large remote workforce. The company wants to ensure that remote users can access both internet and internal applications securely. The architect decides to use Prisma Access for both internet and private application access. Which component must be configured to allow remote users to access internal applications hosted in the corporate data center?

Accepted Answer

Configure a Service Connection to the corporate data center and enable the appropriate routes for internal subnets.. To allow remote users to securely access internal applications hosted in a data center, Prisma Access must be connected to that data center via a Service Connection. The Service Connection enables routing between Prisma Access and the data center, and internal subnets are advertised so that remote user traffic can reach them. This ensures that traffic is inspected by Prisma Access security policies before reaching the internal applications.

Answer

Set up a Remote Network connection at the data center to tunnel internal traffic to Prisma Access.

Answer

Enable GlobalProtect split tunneling to route internal traffic directly to the data center.

Answer

Configure a site-to-site IPSec tunnel between the remote users' local networks and the data center.

Question 14

An engineer is designing a Prisma Access deployment for a company that requires that all traffic from remote users be inspected by the same security policy stack regardless of the user's location. The company has offices in North America, Europe, and Asia. The engineer must ensure that the security policy is enforced consistently and that users always connect to the closest Prisma Access compute location. Which configuration should the engineer use to achieve this?

Accepted Answer

Configure a single Prisma Access tenant with multiple compute locations and enable GlobalProtect with the same security policy applied to all locations.. Prisma Access is designed to provide consistent security policy enforcement across all compute locations within a single tenant. By using a single tenant with multiple compute locations and a unified policy set, the engineer ensures that users are protected by the same rules regardless of where they connect. GlobalProtect automatically routes users to the closest location, optimizing performance without compromising security.

Answer

Configure Prisma Access with multiple compute locations and apply different security policies per location based on user region.

Answer

Use a single compute location and force all users to connect to it via GlobalProtect portal configuration.

Answer

Deploy separate Prisma Access tenants for each region and synchronize security policies manually.

Question 15

An administrator is planning a Prisma Access deployment for a small company with 10 remote users. The company does not have any data centers or branch offices. The administrator wants to ensure that the remote users are protected by Prisma Access security policies. What is the minimum configuration required?

Accepted Answer

Configure GlobalProtect and onboard users to Prisma Access.. For remote users with no internal resources, the minimum configuration is to set up GlobalProtect and onboard the users to Prisma Access. This allows users to connect to the closest compute location and be protected by security policies. No Service Connections or Remote Network connections are required because there is no need to access internal networks.

Answer

Configure a Service Connection to the company's headquarters.

Answer

Configure a compute location in the same region as the users.

Answer

Configure a Remote Network connection for each user's home network.