SSE-Engineer Prisma Access Services — 15 Questions

Question 1

An administrator needs to onboard new mobile users into Prisma Access using a SAML Identity Provider (IdP). Where in Panorama are the SAML authentication settings configured for GlobalProtect mobile users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Objects -> Authentication. Authentication profiles and server profiles linked to SAML IdP metadata are configured under Device -> Setup -> Authentication or Objects -> Authentication in Panorama.

Answer

Panorama -> Cloud Services -> Setup -> SAML

Answer

Network -> GlobalProtect -> Portals -> Authentication

Answer

Policies -> Authentication

Question 2

An administrator is configuring a Secure Web Gateway policy in Prisma Access to restrict employee access to high-risk SaaS applications using Cloud Access Security Broker (CASB) inline controls. The requirement is to block file uploads to unmanaged personal instances of cloud storage while permitting read access. Where should the administrator configure this granular action?

Accepted Answer

In the SaaS Security Access control settings within the URL Filtering profile. CASB inline security rules in Prisma Access are configured within the Decryption or URL Filtering profiles, and specifically through the SaaS Application Security policy rules where activity controls (such as upload, download, edit) can be enforced per application tenant or risk level.

Answer

In the WildFire analysis profile associated with the Decryption policy

Answer

In the Data Filtering profile attached to the Security policy rule

Answer

In the GlobalProtect App configuration under the ZTNA connector settings

Question 3

An organization requires that Prisma Access Secure Web Gateway inspects all inbound and outbound TLS traffic for employees browsing external websites. However, HR and healthcare applications must be bypassed due to privacy regulations. Where in Panorama must the administrator configure the exception for these categories?

Accepted Answer

Policies -> Decryption. Decryption policy rules in Panorama allow administrators to bypass decryption based on URL categories such as healthcare and financial services.

Answer

Panorama -> Cloud Services -> User Access

Answer

Network Services -> Prisma Access -> Decryption Bypass

Answer

Objects -> Custom URL Category

Question 4

A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?

Accepted Answer

BGP. Prisma Access supports BGP (Border Gateway Protocol) over IPsec for dynamic routing on Service Connections and Remote Networks.

Answer

EIGRP

Answer

RIPv2

Answer

OSPF

Question 5

An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect outgoing traffic for specific patterns, file types, and sensitive data to prevent data exfiltration in SWG deployments.

Answer

Zone Protection profile

Answer

Antivirus profile

Answer

URL Filtering profile

Question 6

An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?

Accepted Answer

Monitor -> Logs -> Authentication. Prisma Access status and operational logs related to user authentication and SAML can be monitored via Panorama operational commands and SaaS / User-ID status dashboards.

Answer

Monitor -> Traffic -> Session End

Answer

Objects -> Authentication -> SAML Test

Answer

Panorama -> Cloud Services -> Health -> Infrastructure

Question 7

A security engineer is troubleshooting a ZTNA connection issue where remote users running GlobalProtect are unable to reach internal applications hosted behind a Prisma Access Remote Network. The mobile users and remote networks are in the same region, but direct branch-to-branch routing is failing. Which Prisma Access feature must be verified to ensure direct traffic flow between mobile users and remote networks without backhauling to the cloud service nodes?

Accepted Answer

Mobile User to Remote Network direct routing. Prisma Access supports Mobile User to Remote Network (MU-to-RN) direct traffic routing, which allows traffic to flow between mobile users and remote networks directly when both are connected to the same service node location.

Answer

Explicit Proxy PAC file redirect

Answer

Prisma Access Insights Regional Peering

Answer

Clean Pipe architecture

Question 8

An enterprise wants to implement Firewall as a Service (FWaaS) using Prisma Access to protect inter-branch traffic and internet traffic. Which Panorama template type is primarily used to push network and device configurations to Prisma Access nodes?

Accepted Answer

Cloud Services templates. Panorama uses Cloud Services templates to manage network, interface, and routing settings for Prisma Access locations.

Answer

Stack templates

Answer

Prisma Access Global templates

Answer

Mobile User dynamic templates

Question 9

A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?

Accepted Answer

HTTP Header Insertion / Restricted Tenant Access. App-ID SaaS Security controls and HTTP header insertion (specifically restricted domains/tenant restriction headers) allow Prisma Access to enforce access only to approved enterprise tenants.

Answer

Prisma Access DNS Security sinking

Answer

GlobalProtect Client-less VPN rewriting rules

Answer

SaaS Security API inline scanning

Question 10

An administrator needs to configure Prisma Access Remote Networks to route specific corporate traffic to a local data center while sending internet-bound traffic directly through Prisma Access. Which configuration component in Panorama is used to define this split-tunneling behavior?

Accepted Answer

Subnets included in the Remote Network definition. In Prisma Access Remote Networks, split tunneling is controlled via the Traffic Distribution profile or explicit static routes configured under Network Services -> Prisma Access -> Remote Networks.

Answer

Traffic Distribution profile

Answer

GlobalProtect Client-less VPN portal settings

Answer

Decryption Policy rules

Question 11

A network administrator needs to verify that the QoS (Quality of Service) settings applied to Prisma Access mobile users are prioritizing real-time voice and video traffic correctly. Where are QoS profiles applied in the Prisma Access configuration hierarchy in Panorama?

Accepted Answer

Panorama -> Cloud Services -> Configuration -> QoS Policy. QoS profiles in Prisma Access are applied within the QoS policy rules and associated with the Cloud Services mobile user or remote network configuration to prioritize traffic classes.

Answer

Objects -> QoS Profiles -> Global

Answer

GlobalProtect Portal -> Client Settings -> QoS

Answer

Network -> Interfaces -> Tunnel -> QoS

Question 12

Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?

Accepted Answer

URL Filtering log. URL Filtering logs record all web traffic processed by SWG URL filtering rules.

Answer

Threat log

Answer

Data Filtering log

Answer

HIP Match log

Question 13

An organization wants to restrict access to a sensitive internal financial database so that only users belonging to the 'Finance-Dept' Active Directory group and connecting from compliant corporate laptops can access it. Which Prisma Access security feature combines user identity, device posture, and application access control?

Accepted Answer

HIP (Host Information Profile) matching in Security Policies. Prisma Access ZTNA policy enforcement leverages User-ID, HIP (Host Information Profile) checks, and App-ID to enforce least-privilege access.

Answer

URL Filtering Custom Categories

Answer

Zone Protection profiles

Answer

CASB Inline Policy Rules

Question 14

Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?

Accepted Answer

GlobalProtect Client-less VPN. GlobalProtect Client-less VPN provides browser-based access to internal web applications without requiring an endpoint client.

Answer

Prisma Access Remote Network IPsec

Answer

Prisma Access Browser

Answer

Explicit Proxy Forwarding

Question 15

An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?

Accepted Answer

DNS Security. WildFire and DNS Security provide real-time threat intelligence and automated threat prevention across Prisma Access.

Answer

Prisma Access Insights

Answer

SaaS Security API

Answer

GlobalProtect Cloud Service Agent