An organization requires that Prisma Access Secure Web Gateway inspects all inbound and outbound TLS traffic for employees browsing external websites. However, HR and healthcare applications must be bypassed due to privacy regulations. Where in Panorama must the administrator configure the exception for these categories?
A security engineer is troubleshooting a ZTNA connection issue where remote users running GlobalProtect are unable to reach internal applications hosted behind a Prisma Access Remote Network. The mobile users and remote networks are in the same region, but direct branch-to-branch routing is failing. Which Prisma Access feature must be verified to ensure direct traffic flow between mobile users and remote networks without backhauling to the cloud service nodes?
An enterprise wants to implement Firewall as a Service (FWaaS) using Prisma Access to protect inter-branch traffic and internet traffic. Which Panorama template type is primarily used to push network and device configurations to Prisma Access nodes?
An administrator needs to configure Prisma Access Remote Networks to route specific corporate traffic to a local data center while sending internet-bound traffic directly through Prisma Access. Which configuration component in Panorama is used to define this split-tunneling behavior?
A network administrator needs to verify that the QoS (Quality of Service) settings applied to Prisma Access mobile users are prioritizing real-time voice and video traffic correctly. Where are QoS profiles applied in the Prisma Access configuration hierarchy in Panorama?
An organization wants to restrict access to a sensitive internal financial database so that only users belonging to the 'Finance-Dept' Active Directory group and connecting from compliant corporate laptops can access it. Which Prisma Access security feature combines user identity, device posture, and application access control?
An administrator needs to onboard new mobile users into Prisma Access using a SAML Identity Provider (IdP). Where in Panorama are the SAML authentication settings configured for GlobalProtect mobile users?
A company requires that Prisma Access FWaaS inspects all inter-zone traffic between two different remote branch offices connected via Prisma Access. By default, how does Prisma Access handle traffic between two Remote Networks attached to the same service region?
Which component of Prisma Access is responsible for providing centralized management, monitoring, and reporting for all SWG, ZTNA, CASB, and FWaaS features?
A security analyst is investigating a Prisma Access FWaaS alert indicating a brute-force attack against an internal server published via a Service Connection. Which security profile should be tuned to detect and block this network-layer attack signature?
An enterprise is integrating Prisma Access with their corporate infrastructure. Which THREE components can be connected to Prisma Access to provide centralized cloud security inspection? (Choose three)
A security engineer is troubleshooting traffic inspection issues in Prisma Access FWaaS. Traffic between two mobile users is bypassing security policy inspection. Which THREE factors could cause intra-zone or inter-user traffic to bypass security inspection in Prisma Access? (Choose three)
An administrator is setting up Prisma Access logging and monitoring. Which THREE logs or reporting features in Panorama provide insights into SWG, ZTNA, and CASB activities? (Choose three)
An administrator is configuring a Secure Web Gateway policy in Prisma Access to restrict employee access to high-risk SaaS applications using Cloud Access Security Broker (CASB) inline controls. The requirement is to block file uploads to unmanaged personal instances of cloud storage while permitting read access. Where should the administrator configure this granular action?
An enterprise requires their mobile users to use a Secure Web Gateway (SWG) service that intercepts all web traffic without requiring explicit browser proxy configurations on each client machine. Which Prisma Access deployment method meets this requirement transparently?
A Prisma Access administrator needs to route all traffic from a specific branch office through a dedicated service connection to enforce security inspection, but the branch uses a static public IP that is not managed by Panorama. Which type of service connection should be configured to achieve this?
An administrator needs to ensure that DNS queries from Prisma Access mobile users are resolved by Prisma Access's built-in DNS proxy rather than by the local DNS servers of the user's ISP. Which configuration step is required in the Prisma Access mobile user settings?
A Prisma Access administrator needs to ensure that remote users' DNS queries are resolved by Prisma Access DNS Security and that malicious domains are sinkholed. The administrator has already configured DNS Security in a Security policy rule. Which additional configuration is required to enforce DNS sinkholing for mobile users?
A security engineer is configuring Prisma Access to inspect traffic from a remote network that uses a dynamic public IP address. The remote network's firewall supports only policy-based VPNs. Which Prisma Access feature should be used to ensure traffic is inspected and the connection is established securely?
An organization is deploying Prisma Access for mobile users. They require that all DNS queries from mobile users be resolved by Prisma Access's DNS security service to enforce domain-based policies and sinkhole malicious domains. Which configuration must be enabled in the Prisma Access mobile user settings?
A Prisma Access administrator is configuring a Service Connection for a remote network. The requirement is to ensure that traffic from the remote network to the internet is inspected by Prisma Access SWG, while traffic to corporate data centers is forwarded over the Service Connection. Which configuration achieves this?
A Prisma Access administrator needs to provide mobile users with secure access to a private application hosted on-premises behind a Palo Alto Networks firewall. The application is not published to the internet. Which Prisma Access service should be configured to enable this access?
An administrator is configuring Prisma Access Explicit Proxy for mobile users. The requirement is to ensure that all web traffic from managed endpoints is inspected by Prisma Access SWG, even when users are on-premises. The administrator has deployed a PAC file that points to the Prisma Access Explicit Proxy. However, users on-premises are bypassing the proxy and going directly to the internet. What is the most likely reason?
An administrator is configuring Prisma Access to enforce security policies for mobile users based on the applications they use. The administrator wants to create a policy that allows access to Microsoft 365 but blocks all other SaaS applications. Which Prisma Access feature should be used to achieve this?
An administrator is configuring Prisma Access to provide secure web gateway services for mobile users. The administrator wants to ensure that users cannot bypass the security inspection by using a non-standard port for HTTP traffic. Which configuration should be applied?
An administrator is configuring a Prisma Access remote network for a branch office. The requirement is that all traffic from the branch to the internet must be inspected by Prisma Access SWG, while traffic to a private data center must be forwarded over an IPsec tunnel to a specific service connection. Which Prisma Access component must be configured to achieve this?
An administrator needs to ensure that Prisma Access GlobalProtect mobile users receive consistent security policy enforcement when they connect from different geographic regions. Currently, users in Europe and Asia are experiencing different URL filtering results for the same website. The administrator has verified that the same security policy rules are deployed to all Prisma Access locations. What is the most likely cause of the inconsistent URL filtering outcomes?
A Prisma Access administrator is configuring a remote network to use a Service Connection. The administrator needs to ensure that the remote network can access both the internet and corporate resources securely. Which TWO configuration steps are required on the remote network firewall? (Choose two.)
A security engineer is configuring Prisma Access to inspect traffic from remote branch offices using the Explicit Proxy method. The branch offices use a proxy auto-configuration (PAC) file to redirect web traffic to Prisma Access. Users report that HTTPS websites are showing certificate errors, although HTTP sites load fine. The engineer has deployed the Prisma Access root certificate to all branch office computers via Group Policy. What is the most likely reason for the certificate errors on HTTPS sites?
A security engineer is configuring Prisma Access to provide secure access to a private application hosted in an on-premises data center. The application uses a custom TCP port and requires user identity-based access control. The engineer has already set up a service connection to the data center. Which additional configuration is required to allow mobile users to access the application with identity-based policies?
A Prisma Access administrator is troubleshooting why mobile users are unable to access a specific SaaS application. The administrator has confirmed that the application is allowed in the security policy and that GlobalProtect is connected. Which log type should the administrator examine to determine if the SaaS application is being identified and if any CASB policies are blocking it?
An administrator is configuring Prisma Access to enforce Data Loss Prevention (DLP) policies for mobile users uploading files to SaaS applications. The administrator has created a DLP profile in Prisma Access and attached it to a security policy rule. However, DLP is not detecting sensitive data in files uploaded via HTTPS. The administrator has confirmed that SSL decryption is enabled for the traffic. What is the most likely reason DLP is not inspecting the files?
A security engineer is deploying Prisma Access for a remote branch office that uses a single IPsec tunnel to a Prisma Access service connection. The branch has two ISP links and requires automatic failover if the primary link degrades, without re-establishing the IPsec tunnel to a different Prisma Access node. Which Prisma Access configuration should the engineer implement?
A security engineer is configuring Prisma Access for a remote network that uses a dynamic public IP address. The remote network's ISP assigns a new IP address every 24 hours. The engineer wants to ensure that the IPsec tunnel to Prisma Access remains operational despite the IP change. What should the engineer configure?
A network engineer is configuring a Service Connection in Prisma Access to connect the cloud security infrastructure back to the corporate data center. Which routing protocol is supported natively by Prisma Access to dynamically exchange routes over the IPsec VPN tunnel?
An administrator wants to deploy Secure Web Gateway (SWG) capabilities in Prisma Access to prevent users from uploading company proprietary data to unauthorized cloud storage applications. Which Prisma Access profile type should be applied to the Security Policy rules to achieve this?
An administrator notices that certain mobile users connecting via Prisma Access are experiencing intermittent authentication timeouts when authenticating via SAML 2.0. Where should the administrator check to verify the Identity Provider (IdP) connectivity status and SAML assertion errors within Panorama?
A security architect is designing a CASB inline policy in Prisma Access. The requirement is to restrict corporate users from logging into personal instances of sanctioned SaaS applications (e.g., personal Microsoft 365 or Google Workspace) while allowing access to corporate-owned tenants. Which feature enables this control?
Which log type in Prisma Access should an administrator examine to review details about blocked URLs, category ratings, and user web-browsing attempts?
Which Prisma Access service capability provides secure, least-privilege remote access for third-party contractors who cannot install the GlobalProtect agent on their managed or unmanaged devices?
An administrator is configuring Prisma Access Secure Web Gateway and wants to ensure that newly registered malicious domains are blocked automatically without waiting for manual signature updates. Which Palo Alto Networks security service provides real-time IP and domain threat intelligence to Prisma Access?
An enterprise is deploying Prisma Access and wants to ensure that user identity mapping is gathered efficiently from Microsoft Entra ID (formerly Azure AD) without deploying physical User-ID agents inside the cloud network. Which integration method should be used?
An administrator is troubleshooting a CASB inline policy where a specific file upload to an unapproved SaaS application was not blocked. Upon checking the Security policy, the rule has the correct application identified. What is the most likely reason the inline action failed to trigger?
An administrator configuring Prisma Access ZTNA wants to view real-time metrics regarding active mobile user connections, bandwidth consumption per region, and tunnel status. Which tool provides this specific operational dashboard?
A security engineer is configuring a Prisma Access Remote Network location with redundant IPsec tunnels to ensure high availability. What configuration requirement must be met on the customer premise equipment (CPE) router to support dynamic routing over these redundant tunnels?
When designing a Prisma Access deployment for remote workers, which component authenticates the user and assigns the appropriate GlobalProtect gateway connection based on geographic location?
An organization requires that all DNS queries from Prisma Access mobile users be inspected and filtered for malicious domains before resolving. Where in Panorama is Prisma Access DNS Security configured?
Which security feature in Prisma Access SWG inspects downloaded executable files and documents against a cloud-based behavioral sandbox to identify zero-day malware?
When configuring Prisma Access via Panorama, which administrative role or permission is required to push configuration changes to the cloud infrastructure?
An administrator is setting up Prisma Access and needs to ensure that mobile users connecting from managed corporate laptops can access internal resources, while unmanaged contractor laptops are restricted to web-based applications only. Which Prisma Access mechanism distinguishes between managed and unmanaged endpoints during connection?
An organization is deploying Prisma Access for mobile users and needs to ensure that users in Europe connect to European cloud nodes while users in North America connect to North American nodes. How does Prisma Access automatically achieve this geographic routing?
An enterprise using Prisma Access has configured a Service Connection to their primary data center. Users at remote branches report that they cannot reach internal applications hosted in the data center. Upon checking Panorama, the Service Connection status shows 'Connected', but routing is failing. What configuration step is required on Prisma Access to advertise the remote network subnets to the data center?
An administrator wants to configure Prisma Access Secure Web Gateway to block access to sites categorized as 'Gambling' during working hours, but allow them during lunch breaks. Which Panorama feature enables time-based policy enforcement?
An administrator is troubleshooting a Prisma Access deployment where mobile users are intermittently disconnected when moving between trusted Wi-Fi networks and cellular connections. Which GlobalProtect client setting in Prisma Access helps maintain session persistence and fast reconnection during network roaming?
Which Prisma Access feature enables enterprises to inspect and secure traffic between different virtual networks or cloud environments connected to the cloud service?
An enterprise wants to ensure that all internet-bound traffic from mobile users is decrypted and inspected for malware and sensitive data using Prisma Access SWG. Which GlobalProtect client traffic forwarding configuration ensures that all traffic is sent to Prisma Access?
An administrator is configuring Prisma Access Remote Networks to connect branch offices to the cloud security backbone. Which TWO configuration steps are required on Panorama to establish a functional Remote Network connection? (Choose two)
An organization is deploying Prisma Access CASB and Secure Web Gateway features. Which THREE capabilities are provided by Prisma Access Inline CASB compared to out-of-band SaaS Security API? (Choose three)
An administrator is troubleshooting ZTNA connectivity issues for mobile users connecting via Prisma Access. Which TWO tools or log types in Panorama should the administrator check to diagnose user authentication and tunnel establishment problems? (Choose two)
A security architect is designing a Prisma Access FWaaS deployment and needs to ensure robust security posture across all zones (Mobile Users, Remote Networks, Service Connections, and Internet). Which THREE security profile types should be attached to Security Policy rules to ensure comprehensive threat prevention? (Choose three)
An administrator is configuring Prisma Access Secure Web Gateway and wants to restrict access to high-risk web categories. Which TWO options represent configurable actions within a Prisma Access URL Filtering profile? (Choose two)
An administrator needs to configure Prisma Access ZTNA to verify endpoint hygiene before granting access to internal applications. Which TWO posture checks can be evaluated using GlobalProtect Host Information Profiles (HIP)? (Choose two)
An administrator is configuring Prisma Access SWG and needs to implement granular control over file sharing and collaboration tools. Which TWO SaaS Security features can be configured in Prisma Access to achieve this? (Choose two)
An enterprise is planning a Prisma Access deployment and wants to optimize performance and redundancy for Remote Networks. Which THREE best practices should the network architect follow when designing IPsec connections to Prisma Access? (Choose three)
An administrator wants to ensure high availability and resilient connectivity for mobile users connecting to Prisma Access. Which TWO features or mechanisms are utilized by Prisma Access to ensure reliable mobile user access? (Choose two)
An administrator is configuring authentication for Prisma Access mobile users. Which TWO authentication methods are natively supported for GlobalProtect mobile users in Prisma Access? (Choose two)
An enterprise is deploying Prisma Access Service Connections to connect corporate data centers to the cloud security platform. Which THREE configuration parameters must be correctly specified on Panorama for a Service Connection? (Choose three)
A deployment of Prisma Access requires ZTNA 2.0 posture check enforcement for remote users. The administrator must ensure that mobile devices attempting to connect to internal corporate apps are evaluated for disk encryption and active endpoint protection agents prior to tunnel establishment. Which component performs this real-time device posture assessment?
An organization is migrating their branch offices to Prisma Access Firewall as a Service (FWaaS). What is the primary method used to connect a physical branch office location to the Prisma Access cloud infrastructure securely?
A Prisma Access administrator needs to implement ZTNA 2.0 continuous trust verification for mobile users accessing internal private applications. Which feature ensures that continuous validation of both user identity and device posture occurs throughout the session, rather than only at initial authentication?
When configuring Prisma Access for ZTNA 2.0 to control access to private applications, which TWO components or configurations are mandatory for establishing least-privileged application access? (Choose two)
An administrator is configuring Prisma Access Firewall as a Service (FWaaS) to protect outbound internet traffic from remote networks. They want to ensure that known command-and-control (C2) traffic and vulnerability exploits are blocked dynamically in real time. Which security profile should be applied to the security policy rules?
An administrator is designing a Prisma Access Secure Web Gateway (SWG) and CASB architecture. Which THREE capabilities can be enforced natively through Prisma Access SWG and inline CASB policies? (Choose three)
An administrator is troubleshooting a connectivity issue where remote mobile users cannot reach internal private applications via Prisma Access ZTNA. Which THREE diagnostic steps or verification checks should the administrator perform? (Choose three)
An administrator notices that certain SaaS applications are not being accurately identified or controlled by Prisma Access CASB inline policies due to domain fronting and complex URL structures. Which feature should the administrator configure in Prisma Access to ensure deep application identification and decryption of this traffic?
A security engineer manages a Prisma Access deployment with 5,000 mobile users. The organization wants to enforce different security policies for users in the Finance department versus the Engineering department, without deploying separate GlobalProtect portals or gateways. The identity provider is SAML-based and already integrated. What is the most operationally efficient way to achieve this?
An administrator is configuring Prisma Access to provide secure access to private applications for mobile users using ZTNA 2.0. The administrator must ensure that the solution enforces least-privilege access and continuous trust verification. Which TWO configurations are required to meet these requirements? (Choose two.)
An administrator is troubleshooting a Prisma Access mobile users deployment where some users cannot access a critical internal web application. The application is hosted in a remote network that is connected to Prisma Access via a service connection. Other users in the same region can access the application successfully. The affected users are able to access other internal resources. What is the most likely cause?
An administrator is configuring Prisma Access for the first time and needs to ensure that mobile users can resolve internal domain names. The administrator has enabled DNS proxy in the Mobile Users settings. Which additional configuration is required to resolve internal domains?
A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. They want to ensure that all web traffic is scanned for threats and that file downloads are restricted based on file type. Which Prisma Access service should they configure to achieve this?
A security engineer is configuring Prisma Access to inspect traffic from remote networks. The requirement is to apply different security policies based on the source IP address of the traffic. Which configuration object in Prisma Access should be used to define the source IP addresses for policy enforcement?
An administrator is deploying Prisma Access with a service connection so that branch users can reach internal applications hosted in a data center. The branch traffic is tunneled to a Prisma Access mobile user location, and the administrator wants to confirm which component forwards traffic from the Prisma Access infrastructure to the data center. Which component provides this forwarding?
An administrator is configuring Prisma Access for a branch office to provide secure internet access. They want to ensure that the branch users' traffic is inspected for threats and that access to risky URLs is blocked. Which two components are required in the Prisma Access configuration to achieve this? (Choose two.)
An administrator is configuring Prisma Access for Secure Web Gateway (SWG) and needs to ensure that SSL decryption is applied to traffic from mobile users. Which component must be configured to enable SSL decryption in Prisma Access?
A security engineer is troubleshooting a Prisma Access deployment where mobile users report that traffic to a specific SaaS application is being inspected but the CASB inline policy is not applying the expected data-loss prevention action. The engineer confirms the SaaS application is identified in the traffic logs. Which log or dashboard should the engineer examine to determine whether the CASB policy matched and what action was taken?
An administrator is troubleshooting why mobile users cannot access a private application through Prisma Access ZTNA. The administrator has verified that the application is configured correctly and that the user is in the correct group. Which log type in Prisma Access should be examined to determine if the connection is being blocked by a security policy?
An administrator is troubleshooting a Prisma Access issue where mobile users cannot access a specific internal application hosted on-premises. The application is reachable via a Service Connection. The administrator has verified that the Service Connection is up and that the application is accessible from the Service Connection's tunnel interface. What is the most likely cause of the issue?
An administrator is configuring Prisma Access to provide secure access for mobile users. The requirement is to ensure that all traffic from mobile users is inspected by Prisma Access, including traffic to the internet and to private applications. Which TWO configurations are necessary to achieve this? (Choose two.)
A network security administrator is configuring Prisma Access to provide secure web gateway services to mobile users. The requirement is that all web traffic from the mobile users must be inspected for threats and URL filtering, and the administrator wants the simplest deployment that does not require installing certificates on the endpoints. Which Prisma Access capability should the administrator enable?
An administrator needs to ensure that Prisma Access mobile users are authenticated using multi-factor authentication (MFA) before accessing corporate resources. Which Prisma Access component is responsible for enforcing MFA?
A security engineer is configuring Prisma Access to protect mobile users from malicious downloads. The requirement is that files downloaded from the internet by mobile users must be analyzed for zero-day malware, and the analysis must not delay the user's download. Which Prisma Access feature should the engineer configure?
An administrator is configuring Prisma Access to secure outbound internet traffic for mobile users. The requirement is to inspect all traffic for threats and sensitive data, but the organization wants to avoid decrypting traffic to financial and healthcare websites due to privacy regulations. Which Prisma Access feature should be used to meet this requirement?
An administrator needs to provide access to a private web application hosted in an on-premises data center for a group of remote contractors. The contractors will use personal devices and must authenticate via SAML. The application uses HTTPS on port 443. Which Prisma Access feature should be used to securely publish this application without requiring a GlobalProtect agent?
An administrator is configuring Prisma Access for mobile users and wants to ensure that all traffic to and from the internet is inspected by the Secure Web Gateway (SWG) service. The administrator has enabled the SWG license and configured a security policy rule to allow web traffic. However, users report that they can access malicious websites that should be blocked. What is the most likely missing configuration?
A security engineer is configuring Prisma Access to provide secure access to private applications hosted in an on-premises data center for mobile users. The engineer has set up a service connection and configured the private applications. However, users are unable to reach the applications. The engineer suspects that the issue is related to the service connection configuration. Which TWO items should the engineer verify to ensure the service connection is correctly established? (Choose two.)
An administrator is configuring Prisma Access to provide secure web gateway services for mobile users. The requirement is to decrypt outbound SSL traffic for inspection, but only for categories that are not in a predefined exemption list. Where should the administrator configure the SSL decryption policy in Prisma Access?
A security engineer is configuring Prisma Access to enforce threat prevention on all traffic from remote networks. The engineer wants to ensure that the threat prevention profile is applied to both inbound and outbound traffic. Where should the engineer attach the threat prevention profile in the Prisma Access policy?
A security engineer is deploying Prisma Access for a remote network that connects via a single IPsec tunnel to a service connection. The organization wants to provide redundancy in case the primary tunnel fails. The remote network has two ISP links with static public IP addresses. Which configuration should the engineer use to achieve tunnel redundancy?
A security engineer is deploying Prisma Access with a service connection to an on-premises data center. The data center hosts a critical application at 10.10.10.50/32. The engineer wants all traffic from mobile users destined to that IP to be routed through the service connection and inspected by Prisma Access security policies, while all other internet-bound traffic goes directly to the internet. Which configuration should the engineer use?
An administrator is configuring Prisma Access for a remote network that uses a single IPsec tunnel to a Prisma Access service connection. The remote network has two ISP links: a primary link and a backup link. The administrator wants to ensure that if the primary link fails, traffic automatically fails over to the backup link without manual intervention. Which Prisma Access feature should be configured to achieve this?
A security engineer needs to ensure that DNS queries from Prisma Access mobile users are resolved by Prisma Access's built-in DNS proxy rather than by external DNS servers. Which configuration should the engineer perform?
A security engineer is configuring Prisma Access to inspect traffic from remote networks to the internet. The engineer wants to ensure that all web traffic is inspected for threats and that certain high-risk web categories are blocked. Which TWO configurations are required to achieve this? (Choose two.)