SSE-Engineer Prisma Access Services — 30 Questions

Question 1

An organization requires that Prisma Access Secure Web Gateway inspects all inbound and outbound TLS traffic for employees browsing external websites. However, HR and healthcare applications must be bypassed due to privacy regulations. Where in Panorama must the administrator configure the exception for these categories?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policies -> Decryption. Decryption policy rules in Panorama allow administrators to bypass decryption based on URL categories such as healthcare and financial services.

Answer

Panorama -> Cloud Services -> User Access

Answer

Network Services -> Prisma Access -> Decryption Bypass

Answer

Objects -> Custom URL Category

Question 2

A security engineer is troubleshooting a ZTNA connection issue where remote users running GlobalProtect are unable to reach internal applications hosted behind a Prisma Access Remote Network. The mobile users and remote networks are in the same region, but direct branch-to-branch routing is failing. Which Prisma Access feature must be verified to ensure direct traffic flow between mobile users and remote networks without backhauling to the cloud service nodes?

Accepted Answer

Mobile User to Remote Network direct routing. Prisma Access supports Mobile User to Remote Network direct routing, which allows GlobalProtect mobile users to reach resources behind a Remote Network location directly without backhauling traffic through the Prisma Access service nodes. This feature must be enabled and verified when users and remote networks are in the same region but traffic is not flowing directly. It is the specific feature that governs branch-to-branch (mobile user to remote network) traffic paths.

Answer

Explicit Proxy PAC file redirect

Answer

Prisma Access Insights Regional Peering

Answer

Clean Pipe architecture

Question 3

An enterprise wants to implement Firewall as a Service (FWaaS) using Prisma Access to protect inter-branch traffic and internet traffic. Which Panorama template type is primarily used to push network and device configurations to Prisma Access nodes?

Accepted Answer

Cloud Services templates. Panorama uses Cloud Services templates to manage network, interface, and routing settings for Prisma Access locations.

Answer

Stack templates

Answer

Prisma Access Global templates

Answer

Mobile User dynamic templates

Question 4

An administrator needs to configure Prisma Access Remote Networks to route specific corporate traffic to a local data center while sending internet-bound traffic directly through Prisma Access. Which configuration component in Panorama is used to define this split-tunneling behavior?

Accepted Answer

Subnets included in the Remote Network definition. In Prisma Access Remote Networks, split-tunneling is defined by the subnets included in the Remote Network definition. Traffic destined to those subnets is routed over the IPSec tunnel to the remote network (and then to the local data center), while all other traffic is sent directly to Prisma Access for internet security inspection. This is the configuration component that controls which traffic is tunneled versus sent to the service.

Answer

Traffic Distribution profile

Answer

GlobalProtect Client-less VPN portal settings

Answer

Decryption Policy rules

Question 5

A network administrator needs to verify that the QoS (Quality of Service) settings applied to Prisma Access mobile users are prioritizing real-time voice and video traffic correctly. Where are QoS profiles applied in the Prisma Access configuration hierarchy in Panorama?

Accepted Answer

Panorama -> Cloud Services -> Configuration -> QoS Policy. QoS profiles for Prisma Access mobile users are applied under Panorama > Cloud Services > Configuration > QoS Policy, because Prisma Access QoS is a cloud-managed feature that lives inside the Cloud Services plugin configuration tree, not in the standard Panorama Objects or Network tabs. This is where the admin binds a QoS profile to mobile user traffic and defines bandwidth guarantees and priorities for real-time voice/video.

Answer

Objects -> QoS Profiles -> Global

Answer

GlobalProtect Portal -> Client Settings -> QoS

Answer

Network -> Interfaces -> Tunnel -> QoS

Question 6

An organization wants to restrict access to a sensitive internal financial database so that only users belonging to the 'Finance-Dept' Active Directory group and connecting from compliant corporate laptops can access it. Which Prisma Access security feature combines user identity, device posture, and application access control?

Accepted Answer

HIP (Host Information Profile) matching in Security Policies. HIP (Host Information Profile) matching lets Prisma Access security policies evaluate the endpoint's posture — OS patch level, antivirus status, disk encryption, etc. — alongside user identity from AD and the application being accessed. Combining HIP profiles with User-ID and App-ID in a single Security policy rule enforces the 'Finance-Dept users on compliant corporate laptops' requirement. This is the only option that natively binds identity, device posture, and application in one policy construct.

Answer

URL Filtering Custom Categories

Answer

Zone Protection profiles

Answer

CASB Inline Policy Rules

Question 7

An administrator needs to onboard new mobile users into Prisma Access using a SAML Identity Provider (IdP). Where in Panorama are the SAML authentication settings configured for GlobalProtect mobile users?

Accepted Answer

Objects -> Authentication. Authentication profiles and server profiles linked to SAML IdP metadata are configured under Device -> Setup -> Authentication or Objects -> Authentication in Panorama.

Answer

Panorama -> Cloud Services -> Setup -> SAML

Answer

Network -> GlobalProtect -> Portals -> Authentication

Answer

Policies -> Authentication

Question 8

A company requires that Prisma Access FWaaS inspects all inter-zone traffic between two different remote branch offices connected via Prisma Access. By default, how does Prisma Access handle traffic between two Remote Networks attached to the same service region?

Accepted Answer

Traffic between Remote Networks is dropped by default unless explicitly allowed by security policy and inter-branch routing is enabled.. Prisma Access supports inter-branch routing, allowing traffic between remote networks to be inspected by security policies when inter-branch traffic is enabled.

Answer

Traffic must be backhauled to the corporate data center via a Service Connection before reaching another branch.

Answer

Remote Networks cannot communicate with each other under any circumstance.

Answer

Traffic is automatically bypassed and sent directly over public internet.

Question 9

Which component of Prisma Access is responsible for providing centralized management, monitoring, and reporting for all SWG, ZTNA, CASB, and FWaaS features?

Accepted Answer

Panorama. Panorama is the centralized management platform for Palo Alto Networks firewalls and Prisma Access. It provides a single pane of glass for configuring, monitoring, and reporting on all Prisma Access features, including SWG, ZTNA, CASB, and FWaaS. Prisma Access is managed through Panorama, which pushes policy and collects logs from all service nodes.

Answer

Prisma Access Insights

Answer

GlobalProtect App

Answer

Prisma Cloud

Question 10

A security analyst is investigating a Prisma Access FWaaS alert indicating a brute-force attack against an internal server published via a Service Connection. Which security profile should be tuned to detect and block this network-layer attack signature?

Accepted Answer

Vulnerability Protection Profile. A brute-force attack against an internal server is a network-layer attack signature, and the Vulnerability Protection Profile is designed to detect and block such exploits, including brute-force attempts, by inspecting traffic for known vulnerability signatures and anomalous patterns. Tuning this profile allows the analyst to block the attack.

Answer

Antivirus Profile

Answer

Data Filtering Profile

Answer

URL Filtering Profile

Question 11

An enterprise is integrating Prisma Access with their corporate infrastructure. Which THREE components can be connected to Prisma Access to provide centralized cloud security inspection? (Choose three)

Accepted Answer

Service Connections (corporate data centers or headquarters). Service Connections (A) are correct because they are the standard Prisma Access construct for connecting corporate data centers or headquarters to the Prisma Access infrastructure, typically over IPsec tunnels with BGP, so that traffic from those sites is steered through Prisma Access for centralized cloud security inspection. Remote Networks (D) are correct because branch offices connect to Prisma Access via IPsec VPN (with BGP for dynamic routing), allowing their traffic to be inspected by the Prisma Access security services in the cloud. Mobile Users running the GlobalProtect app (E) are correct because GlobalProtect tunnels user traffic to Prisma Access gateways, where the same cloud-delivered security subscriptions (e.g., Threat Prevention, WildFire, URL Filtering, DNS Security) inspect it centrally. Option B is not correct because a local standalone firewall in hardware bypass mode with no cloud connection performs no Prisma Access inspection and is not an integration component. Option C is not correct because public cloud VPCs are onboarded to Prisma Access through Service Connections (using IPsec/BGP), not via automated cloud connectors that bypass IPsec or BGP.

Answer

Local standalone firewalls operating in hardware bypass mode without cloud connection

Answer

Public cloud VPCs directly via automated cloud connectors without IPsec or BGP

Question 12

A security engineer is troubleshooting traffic inspection issues in Prisma Access FWaaS. Traffic between two mobile users is bypassing security policy inspection. Which THREE factors could cause intra-zone or inter-user traffic to bypass security inspection in Prisma Access? (Choose three)

Accepted Answer

Security policy rules configured with the 'App-Override' or custom bypass settings for specific applications.. Option A is correct because security policy rules that use App-Override or custom application bypass settings deliberately exclude matching traffic from further inspection, so user-to-user flows matching those rules will skip security processing. Option C is correct because a Decryption rule with a 'No Decrypt' action prevents the firewall from decrypting matching sessions, and without decryption Prisma Access cannot inspect the encrypted payload, allowing that traffic to bypass content and threat inspection. Option D is correct because client split-tunneling on GlobalProtect sends specified traffic directly out the local internet path instead of through the Prisma Access tunnel, so intra-zone or inter-user traffic covered by the split-tunnel access route never reaches the security processing nodes. Option B does not belong because portal banner customization is only a cosmetic login message and has no effect on traffic forwarding or inspection. Option E does not belong because a pending Panorama template commit on Remote Networks affects configuration deployment state, not the runtime inspection path for mobile-user traffic.

Answer

GlobalProtect portal banner message customization.

Answer

Panorama template commit pending status on Remote Networks.

Question 13

An administrator is setting up Prisma Access logging and monitoring. Which THREE logs or reporting features in Panorama provide insights into SWG, ZTNA, and CASB activities? (Choose three)

Accepted Answer

Threat logs for malware, spyware, and vulnerability exploit detections.. The three correct options are A, C, and D. A (Threat logs) is correct because Prisma Access Threat logs capture detections from the security subscriptions — including spyware, vulnerability exploits, and malware — that surface malicious activity in SWG, ZTNA, and CASB traffic flows. C (Data Filtering logs) is correct because Data Filtering is the CASB/Enterprise DLP logging mechanism that records sensitive data patterns and exfiltration attempts, which is exactly the CASB activity insight the scenario requires. D (URL Filtering logs) is correct because URL Filtering logs record web category access, URL allow/block decisions, and SWG policy enforcement, directly reflecting SWG activity. Option B is incorrect because hardware environmental temperature and power supply status are system/health telemetry, not SWG, ZTNA, or CASB activity logs. Option E is incorrect because CLI debug logs from physical core router interfaces are device-level troubleshooting output and are unrelated to Prisma Access SWG, ZTNA, or CASB reporting.

Answer

Hardware environmental temperature and power supply status logs.

Answer

CLI debug logs from physical core router interfaces.

Question 14

An administrator is configuring a Secure Web Gateway policy in Prisma Access to restrict employee access to high-risk SaaS applications using Cloud Access Security Broker (CASB) inline controls. The requirement is to block file uploads to unmanaged personal instances of cloud storage while permitting read access. Where should the administrator configure this granular action?

Accepted Answer

In the SaaS Security Access control settings within the URL Filtering profile. CASB inline security rules in Prisma Access are configured within the Decryption or URL Filtering profiles, and specifically through the SaaS Application Security policy rules where activity controls (such as upload, download, edit) can be enforced per application tenant or risk level.

Answer

In the WildFire analysis profile associated with the Decryption policy

Answer

In the Data Filtering profile attached to the Security policy rule

Answer

In the GlobalProtect App configuration under the ZTNA connector settings

Question 15

An enterprise requires their mobile users to use a Secure Web Gateway (SWG) service that intercepts all web traffic without requiring explicit browser proxy configurations on each client machine. Which Prisma Access deployment method meets this requirement transparently?

Accepted Answer

GlobalProtect client in transparent tunnel mode forwarding traffic to Prisma Access SWG. Prisma Access transparently intercepts web traffic from mobile users via the GlobalProtect app operating in layer-3 tunnel mode, eliminating the need for PAC files or manual proxy settings.

Answer

GRE tunnel forwarding from local ISP routers

Answer

Static NAT configuration on the branch office gateway

Answer

GlobalProtect client in explicit proxy mode

Question 16

A Prisma Access administrator needs to route all traffic from a specific branch office through a dedicated service connection to enforce security inspection, but the branch uses a static public IP that is not managed by Panorama. Which type of service connection should be configured to achieve this?

Accepted Answer

GRE tunnel with a static route to the Prisma Access service connection. A GRE tunnel with a static route is the correct choice because it enables a branch with a static public IP to establish a dedicated connection to Prisma Access without requiring Panorama management. This method ensures all traffic is routed through Prisma Access for security inspection, meeting the requirement for dedicated service connection.

Answer

BGP peering over a direct interconnect with Prisma Access

Answer

SSL VPN tunnel from the branch firewall to Prisma Access

Answer

IPSec tunnel terminated on a Prisma Access service IP

Question 17

An administrator needs to ensure that DNS queries from Prisma Access mobile users are resolved by Prisma Access's built-in DNS proxy rather than by the local DNS servers of the user's ISP. Which configuration step is required in the Prisma Access mobile user settings?

Accepted Answer

Enable DNS proxy on the mobile user gateway and configure the DNS proxy settings under the Mobile Users global settings.. The DNS proxy feature in Prisma Access Mobile Users settings is designed to resolve DNS queries on behalf of mobile users, ensuring that DNS resolution occurs within Prisma Access and can be secured with DNS Security policies. Enabling it is the correct way to prevent mobile users from using their local ISP DNS servers. Other options either confuse DNS Security with DNS proxy or incorrectly attempt to use routing or endpoint settings.

Answer

Configure a DNS Security policy on the mobile user gateway to redirect all DNS traffic to a custom DNS server.

Answer

Create a static route on the mobile user gateway to forward all DNS traffic to the service infrastructure.

Answer

Set the primary and secondary DNS servers in the GlobalProtect app settings to point to Prisma Access internal DNS servers.

Question 18

A Prisma Access administrator needs to ensure that remote users' DNS queries are resolved by Prisma Access DNS Security and that malicious domains are sinkholed. The administrator has already configured DNS Security in a Security policy rule. Which additional configuration is required to enforce DNS sinkholing for mobile users?

Accepted Answer

Enable DNS sinkholing in the DNS Security profile and attach the profile to the security policy rule.. Sinkholing is a feature of the DNS Security profile. To enforce it, the administrator must enable the sinkhole action within the profile and then attach that profile to a security policy rule that matches DNS traffic. Simply configuring DNS Security without the sinkhole action will not sinkhole malicious domains.

Answer

Create a custom URL category for malicious domains and apply a block action in the security policy.

Answer

Configure the mobile users' DNS settings to point to the Prisma Access DNS server IP addresses.

Answer

Configure a DNS Proxy object and assign it to the mobile users' security policy rule.

Question 19

A security engineer is configuring Prisma Access to inspect traffic from a remote network that uses a dynamic public IP address. The remote network's firewall supports only policy-based VPNs. Which Prisma Access feature should be used to ensure traffic is inspected and the connection is established securely?

Accepted Answer

Remote network IPSec tunnel with dynamic IP detection. A remote network IPSec tunnel with dynamic IP detection is the correct choice because it allows a firewall with a dynamic public IP to establish a secure tunnel to Prisma Access. The firewall initiates the connection, and Prisma Access uses the IKE ID to identify the peer, ensuring traffic is inspected without requiring a static IP.

Answer

Service connection with BGP over IPSec

Answer

Mobile user IPSec tunnel with X-Auth

Answer

Service connection with GRE tunnel

Question 20

An organization is deploying Prisma Access for mobile users. They require that all DNS queries from mobile users be resolved by Prisma Access's DNS security service to enforce domain-based policies and sinkhole malicious domains. Which configuration must be enabled in the Prisma Access mobile user settings?

Accepted Answer

Enable DNS Security in the Mobile Users - GlobalProtect settings and configure DNS sinkhole.. DNS Security in Prisma Access mobile user settings intercepts DNS queries, applies domain-based policies, and provides sinkholing. It is the dedicated feature for enforcing DNS security for mobile users. Other options either do not provide security enforcement or are meant for different use cases such as split tunneling or inbound DNS.

Answer

Configure a DNS Inbound policy on the Prisma Access firewall to redirect DNS traffic to a sinkhole.

Answer

Configure a custom DNS server list under Mobile Users - GlobalProtect - DNS and point to Prisma Access DNS proxy.

Answer

Enable Split DNS in the GlobalProtect portal and specify internal domains.