SSE-Engineer Prisma Access Planning And Deployment — Timed 10 Questions

Question 1

An enterprise is planning a Prisma Access Remote Networks deployment with overlapping RFC 1918 IP address spaces across several acquired branch offices. Which Prisma Access feature must the architect implement to successfully route traffic without changing the local branch IP schemes?

10 minute time limit — choose an answer to begin.

Accepted Answer

Source NAT (SNAT) configured for Remote Networks traffic. When multiple branch offices use overlapping RFC 1918 address ranges (e.g., 192.168.1.0/24 in two locations), Prisma Access cannot route traffic correctly because the destination prefixes are ambiguous. Source NAT (SNAT) rewrites the source IP of traffic originating from Remote Networks to a unique, non-overlapping address before it enters the Prisma Access fabric, allowing the service to distinguish and route traffic from each branch without requiring the enterprise to re-IP its branches. This is the documented Prisma Access approach for overlapping subnets in Remote Networks deployments.

Answer

Destination NAT rules on the Service Connections

Answer

GRE tunneling with static default routes

Answer

BGP AS-Path Prepending across all branch tunnels

Question 2

An engineer is troubleshooting BGP routing between a customer data center and Prisma Access over a Service Connection. The data center router is advertising routes, but Prisma Access is not installing them into the routing table. What is the most likely cause?

Accepted Answer

The advertised prefixes overlap with the reserved Prisma Access internal service subnet 10.255.0.0/16. Service Connections require BGP peering, and advertised routes must match supported prefix lengths and be properly configured within the Panorama Service Connection settings.

Answer

The BGP hold timer is set higher than 180 seconds

Answer

BGP authentication type is set to MD5 instead of SHA-256

Answer

The Autonomous System Number (ASN) is a private 4-byte ASN

Question 3

An architect is designing a Prisma Access deployment where branch offices require high availability using redundant IPSec VPN tunnels to Prisma Access Remote Networks. How does Prisma Access handle active-active redundant tunnels from a single branch router?

Accepted Answer

By establishing multiple tunnels terminating on separate SPNs and using BGP multi-path or local preference for failover. Prisma Access supports redundant IPSec tunnels from branch routers, utilizing BGP to manage path selection and failover between the tunnels.

Answer

By utilizing VRRP across the cloud public IP addresses

Answer

By enabling Spanning Tree Protocol (STP) over the IPsec tunnel interfaces

Answer

By configuring LACP bonding directly across the cloud IPSec endpoints

Question 4

An enterprise is configuring Prisma Access for users who travel frequently and require consistent security enforcement regardless of their location. Which GlobalProtect feature ensures that users cannot disable or bypass the VPN protection?

Accepted Answer

Enforced Mode. Enforced mode in GlobalProtect prevents users from disconnecting or disabling the VPN client.

Answer

Always-On VPN with Disconnect Lockout

Answer

Clientless VPN Portal redirection

Answer

GlobalProtect App Lockdown Policy

Question 5

When deploying Prisma Access, which component acts as the central management plane to push security policies, configurations, and software updates to all cloud-managed SPNs?

Accepted Answer

Panorama. Panorama acts as the central management plane for Prisma Access.

Answer

GlobalProtect Portal

Answer

AWS Transit Gateway Manager

Answer

Prisma Access Cloud Controller

Question 6

An administrator is planning a Prisma Access deployment and needs to configure Service Connections to connect the enterprise data center to the cloud. Which TWO requirements must be met for a successful BGP peering session over a Service Connection? (Choose two)

Accepted Answer

Ensure the advertised BGP routes do not overlap with Prisma Access internal reserved subnets. Option C is correct because Prisma Access reserves specific internal subnets for its own infrastructure, and any BGP routes advertised over the Service Connection that overlap these reserved ranges will be rejected or cause routing conflicts, so the administrator must ensure advertised routes do not overlap them. Option E is correct because each Service Connection requires a unique Local ASN configured in the Panorama Service Connection settings so that BGP peering with the Prisma Access cloud can be established without ASN conflicts with other Service Connections or the customer's environment. Option A is incorrect because Service Connections are established from an IPSec-capable device (physical or virtual) on the customer side to Prisma Access, and no Palo Alto Networks hardware firewall must be deployed inside the AWS VPC for BGP peering. Option B is incorrect because LACP active-active bonding applies to link aggregation on physical interfaces, not to Service Connection tunnel interfaces, which use IPSec tunnels and BGP rather than LACP. Option D is incorrect because BGP peering is required for dynamic route exchange over a Service Connection, so static default routing alone without any routing protocol does not satisfy the requirement.

Answer

Deploy a physical hardware firewall inside the AWS cloud VPC

Answer

Configure LACP active-active bonding on the Service Connection tunnel interfaces

Answer

Enable static default routing without configuring any routing protocols

Question 7

When configuring GlobalProtect mobile users in Prisma Access, which THREE settings are typically defined within the GlobalProtect Client Settings configuration? (Choose three)

Accepted Answer

Connect method (e.g., On-Demand, Always-On). Option A (Connect method, e.g., On-Demand, Always-On) is correct because the GlobalProtect Client Settings (agent settings) in Prisma Access define the connect method that governs how the agent establishes the tunnel, such as On-Demand, Always-On, or User-Logon. Option B (GlobalProtect Gateway preference list) is correct because Client Settings specify the gateway preference list (including manual or internal/external gateway ordering) that tells the agent which Prisma Access gateways to connect to and in what priority. Option D (Internal DNS server IP addresses) is correct because Client Settings include the DNS configuration, such as internal DNS server IP addresses, that the agent pushes to the endpoint for resolving internal resources. Option C (Prisma Access Remote Network BGP ASN) is not part of Client Settings; BGP ASN is configured on Remote Networks/Service Connections for routing, not on the GlobalProtect agent. Option E (Service Connection public gateway IP address) is not a Client Settings item; Service Connection public IPs are part of the Prisma Access infrastructure/Service Connection configuration, not the GlobalProtect client settings.

Answer

Prisma Access Remote Network BGP ASN

Answer

Service Connection public gateway IP address

Question 8

An administrator is configuring Source NAT (SNAT) for Prisma Access Remote Networks. Which TWO reasons explain why SNAT is necessary in certain network designs? (Choose two)

Accepted Answer

To resolve overlapping IP address spaces between multiple branch offices. SNAT is used to prevent IP address overlapping between branch sites and to hide internal network structures when accessing external destinations.

Answer

To authenticate GlobalProtect users against Active Directory

Answer

To replace the requirement for BGP routing over Service Connections

Answer

To assign dynamic IPv6 addresses to individual remote worker laptops

Question 9

An engineer is troubleshooting a routing issue where a remote network branch connected to Prisma Access cannot reach another remote network branch (branch-to-branch routing). Which THREE configuration items must be verified to ensure successful branch-to-branch traffic flow? (Choose three)

Accepted Answer

Verify that Security Policy rules permit traffic between the respective branch zones. Branch-to-branch routing in Prisma Access requires explicit configuration, including enabling branch-to-branch traffic in Panorama, ensuring proper security policies permit the traffic, and correct route advertisement.

Answer

Verify that local branch DHCP lease times are set to 8 hours

Answer

Check that all mobile user clients have disabled split tunneling

Question 10

A network engineer is deploying Prisma Access for a new remote network location. The ISP provides a single public IP address. The engineer must ensure that all outbound traffic from the branch uses a specific public IP that is different from the ISP-assigned address, and that return traffic is correctly routed back through the IPSec tunnel. Which Prisma Access feature should be configured to meet these requirements?

Accepted Answer

Static IP address assignment for the remote network. Assigning a static IP address to a remote network in Prisma Access ensures that all outbound traffic uses that specific public IP. This is essential when external services require IP whitelisting or when the ISP-assigned IP is not suitable. The static IP is configured on the remote network's IPSec tunnel, and return traffic is automatically routed back through the tunnel.

Answer

Destination NAT (DNAT) on the remote network

Answer

Policy-Based Forwarding (PBF) with a dedicated egress IP

Answer

Source NAT (SNAT) on the remote network