SSE-Engineer Prisma Access Services Practice Test 2 — 15 Questions

Question 1

A Prisma Access administrator needs to route all traffic from a specific branch office through a dedicated service connection to enforce security inspection, but the branch uses a static public IP that is not managed by Panorama. Which type of service connection should be configured to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GRE tunnel with a static route to the Prisma Access service connection. A GRE tunnel with a static route is the correct choice because it enables a branch with a static public IP to establish a dedicated connection to Prisma Access without requiring Panorama management. This method ensures all traffic is routed through Prisma Access for security inspection, meeting the requirement for dedicated service connection.

Answer

BGP peering over a direct interconnect with Prisma Access

Answer

SSL VPN tunnel from the branch firewall to Prisma Access

Answer

IPSec tunnel terminated on a Prisma Access service IP

Question 2

An administrator needs to ensure that DNS queries from Prisma Access mobile users are resolved by Prisma Access's built-in DNS proxy rather than by the local DNS servers of the user's ISP. Which configuration step is required in the Prisma Access mobile user settings?

Accepted Answer

Enable DNS proxy on the mobile user gateway and configure the DNS proxy settings under the Mobile Users global settings.. The DNS proxy feature in Prisma Access Mobile Users settings is designed to resolve DNS queries on behalf of mobile users, ensuring that DNS resolution occurs within Prisma Access and can be secured with DNS Security policies. Enabling it is the correct way to prevent mobile users from using their local ISP DNS servers. Other options either confuse DNS Security with DNS proxy or incorrectly attempt to use routing or endpoint settings.

Answer

Configure a DNS Security policy on the mobile user gateway to redirect all DNS traffic to a custom DNS server.

Answer

Create a static route on the mobile user gateway to forward all DNS traffic to the service infrastructure.

Answer

Set the primary and secondary DNS servers in the GlobalProtect app settings to point to Prisma Access internal DNS servers.

Question 3

A Prisma Access administrator needs to ensure that remote users' DNS queries are resolved by Prisma Access DNS Security and that malicious domains are sinkholed. The administrator has already configured DNS Security in a Security policy rule. Which additional configuration is required to enforce DNS sinkholing for mobile users?

Accepted Answer

Enable DNS sinkholing in the DNS Security profile and attach the profile to the security policy rule.. Sinkholing is a feature of the DNS Security profile. To enforce it, the administrator must enable the sinkhole action within the profile and then attach that profile to a security policy rule that matches DNS traffic. Simply configuring DNS Security without the sinkhole action will not sinkhole malicious domains.

Answer

Create a custom URL category for malicious domains and apply a block action in the security policy.

Answer

Configure the mobile users' DNS settings to point to the Prisma Access DNS server IP addresses.

Answer

Configure a DNS Proxy object and assign it to the mobile users' security policy rule.

Question 4

A security engineer is configuring Prisma Access to inspect traffic from a remote network that uses a dynamic public IP address. The remote network's firewall supports only policy-based VPNs. Which Prisma Access feature should be used to ensure traffic is inspected and the connection is established securely?

Accepted Answer

Remote network IPSec tunnel with dynamic IP detection. A remote network IPSec tunnel with dynamic IP detection is the correct choice because it allows a firewall with a dynamic public IP to establish a secure tunnel to Prisma Access. The firewall initiates the connection, and Prisma Access uses the IKE ID to identify the peer, ensuring traffic is inspected without requiring a static IP.

Answer

Service connection with BGP over IPSec

Answer

Mobile user IPSec tunnel with X-Auth

Answer

Service connection with GRE tunnel

Question 5

An organization is deploying Prisma Access for mobile users. They require that all DNS queries from mobile users be resolved by Prisma Access's DNS security service to enforce domain-based policies and sinkhole malicious domains. Which configuration must be enabled in the Prisma Access mobile user settings?

Accepted Answer

Enable DNS Security in the Mobile Users - GlobalProtect settings and configure DNS sinkhole.. DNS Security in Prisma Access mobile user settings intercepts DNS queries, applies domain-based policies, and provides sinkholing. It is the dedicated feature for enforcing DNS security for mobile users. Other options either do not provide security enforcement or are meant for different use cases such as split tunneling or inbound DNS.

Answer

Configure a DNS Inbound policy on the Prisma Access firewall to redirect DNS traffic to a sinkhole.

Answer

Configure a custom DNS server list under Mobile Users - GlobalProtect - DNS and point to Prisma Access DNS proxy.

Answer

Enable Split DNS in the GlobalProtect portal and specify internal domains.

Question 6

A Prisma Access administrator is configuring a Service Connection for a remote network. The requirement is to ensure that traffic from the remote network to the internet is inspected by Prisma Access SWG, while traffic to corporate data centers is forwarded over the Service Connection. Which configuration achieves this?

Accepted Answer

Configure the remote network to use Prisma Access as the default route for internet traffic, and configure a static route for corporate subnets pointing to the Service Connection.. To split traffic between internet and corporate destinations for a remote network using a Service Connection, the remote network must route internet traffic to Prisma Access (for SWG inspection) and corporate traffic over the Service Connection. This is typically done by setting the default route to Prisma Access and adding specific static routes for corporate subnets via the Service Connection.

Answer

Create a policy-based forwarding rule on the remote network firewall that directs internet traffic to Prisma Access and corporate traffic to the Service Connection.

Answer

Configure a static route on the remote network firewall pointing all traffic to the Service Connection, and enable 'No Decrypt' for corporate destinations.

Answer

In the Service Connection configuration, enable 'Internet Breakout' and configure the remote network to use the Service Connection as the default route.

Question 7

A Prisma Access administrator needs to provide mobile users with secure access to a private application hosted on-premises behind a Palo Alto Networks firewall. The application is not published to the internet. Which Prisma Access service should be configured to enable this access?

Accepted Answer

Prisma Access Mobile Users. Mobile Users is the Prisma Access service that enables roaming users to securely connect via GlobalProtect. It enforces security policies and, when combined with a Service Connection, allows access to private applications hosted on-premises. Remote Networks and Service Connections serve different purposes, and Explicit Proxy is for web traffic only.

Answer

Prisma Access Remote Networks

Answer

Prisma Access Explicit Proxy

Answer

Prisma Access Service Connection

Question 8

An administrator is configuring Prisma Access Explicit Proxy for mobile users. The requirement is to ensure that all web traffic from managed endpoints is inspected by Prisma Access SWG, even when users are on-premises. The administrator has deployed a PAC file that points to the Prisma Access Explicit Proxy. However, users on-premises are bypassing the proxy and going directly to the internet. What is the most likely reason?

Accepted Answer

The on-premises firewall is allowing direct internet access, and the PAC file does not route traffic through the proxy for on-premises users.. The PAC file likely contains conditions that only proxy traffic when users are outside the corporate network. For on-premises users, it returns DIRECT, causing bypass. To enforce inspection, the PAC file must be modified to always proxy web traffic, or additional enforcement mechanisms must be applied. This ensures consistent SWG inspection regardless of location.

Answer

Prisma Access Explicit Proxy does not support on-premises users.

Answer

The PAC file is not being applied to on-premises users because of Group Policy settings.

Answer

The on-premises users' traffic is being routed through a VPN that bypasses Prisma Access.

Question 9

An administrator is configuring Prisma Access to enforce security policies for mobile users based on the applications they use. The administrator wants to create a policy that allows access to Microsoft 365 but blocks all other SaaS applications. Which Prisma Access feature should be used to achieve this?

Accepted Answer

Create a security policy rule using App-ID for Microsoft 365 and a subsequent rule that denies all SaaS applications using the SaaS application filter.. Prisma Access App-ID can identify Microsoft 365 traffic, and the SaaS application filter allows policies to match a wide range of SaaS applications. Combining an allow rule for Microsoft 365 with a deny rule for other SaaS apps achieves the required policy. This method is precise and leverages native Prisma Access capabilities. Other options either lack the granularity or are not designed for application-based access control.

Answer

Configure a URL filtering profile that allows only Microsoft 365 URLs and blocks all other categories.

Answer

Use a decryption policy to inspect all traffic and then apply a data filtering profile to block non-Microsoft 365 SaaS applications.

Answer

Set up a CASB inline policy that allows Microsoft 365 and blocks all other SaaS applications.

Question 10

An administrator is configuring Prisma Access to provide secure web gateway services for mobile users. The administrator wants to ensure that users cannot bypass the security inspection by using a non-standard port for HTTP traffic. Which configuration should be applied?

Accepted Answer

Configure a security policy rule that allows HTTP and applies a decryption profile, and ensure the application is set to 'http' or 'web-browsing'.. Prisma Access uses App-ID to identify applications regardless of port. By creating a security policy rule that allows the 'http' or 'web-browsing' application and attaches a decryption profile, the administrator ensures that HTTP traffic on any port is decrypted and inspected. This prevents users from evading security controls by using non-standard ports.

Answer

Create a custom application that matches HTTP on non-standard ports and apply a decryption policy.

Answer

Create a security policy rule that blocks all traffic on non-standard ports.

Answer

Enable 'HTTP on Non-Standard Ports' in the Prisma Access decryption policy.

Question 11

An administrator is configuring a Prisma Access remote network for a branch office. The requirement is that all traffic from the branch to the internet must be inspected by Prisma Access SWG, while traffic to a private data center must be forwarded over an IPsec tunnel to a specific service connection. Which Prisma Access component must be configured to achieve this?

Accepted Answer

Remote Network with a policy-based route that sends internet-bound traffic to the Prisma Access SWG and private traffic to the service connection. The requirement is to steer branch internet traffic to Prisma Access SWG while sending private data center traffic over a service connection. This is achieved with a Remote Network and policy-based routing, which allows separate handling based on destination. The other options either apply to the wrong deployment type or do not provide the necessary traffic steering.

Answer

Mobile Users deployment with split tunneling enabled for the data center and full tunneling for the internet

Answer

Service Connection with a static route for the internet and a default route for the data center

Answer

Remote Network with a static route pointing to the service connection for the data center subnet

Question 12

An administrator needs to ensure that Prisma Access GlobalProtect mobile users receive consistent security policy enforcement when they connect from different geographic regions. Currently, users in Europe and Asia are experiencing different URL filtering results for the same website. The administrator has verified that the same security policy rules are deployed to all Prisma Access locations. What is the most likely cause of the inconsistent URL filtering outcomes?

Accepted Answer

The security policy rules are applied to different zones in each region, and the URL filtering profile is only attached to the trust-to-untrust rule in one region.. The inconsistent URL filtering results stem from how security policy rules are applied across Prisma Access regions. Even with identical rule names, zone assignments or rule ordering can vary, causing the URL filtering profile to be enforced in one region but not another. Verifying that the same profile is attached to the correct rules in all regions resolves the issue.

Answer

The URL filtering profile is configured to use the local URL database instead of the cloud-based URL database, causing regional differences in categorization.

Answer

The Prisma Access mobile user infrastructure is using different Cloud Security Service (CSS) instances in each region, each with its own URL category database version.

Answer

The GlobalProtect app version differs between users, and older versions do not support the URL filtering profile enforced by Prisma Access.

Question 13

A Prisma Access administrator is configuring a remote network to use a Service Connection. The administrator needs to ensure that the remote network can access both the internet and corporate resources securely. Which TWO configuration steps are required on the remote network firewall? (Choose two.)

Accepted Answer

Configure a static route for internet-bound traffic pointing to the Service Connection tunnel.. To allow a remote network to access both internet and corporate resources securely via Prisma Access, the remote network firewall must have a default route pointing to the Service Connection tunnel for internet-bound traffic, and specific static routes for corporate subnets also pointing to the Service Connection. This ensures that all traffic is sent to Prisma Access, where security policies are applied, and corporate traffic is then forwarded to the data center.

Answer

Configure the remote network firewall to use Prisma Access as the next hop for all traffic.

Answer

Configure a policy-based forwarding rule to send internet traffic to Prisma Access and corporate traffic to the Service Connection.

Answer

Set the default route to point to the Service Connection tunnel for internet-bound traffic.

Question 14

A security engineer is configuring Prisma Access to inspect traffic from remote branch offices using the Explicit Proxy method. The branch offices use a proxy auto-configuration (PAC) file to redirect web traffic to Prisma Access. Users report that HTTPS websites are showing certificate errors, although HTTP sites load fine. The engineer has deployed the Prisma Access root certificate to all branch office computers via Group Policy. What is the most likely reason for the certificate errors on HTTPS sites?

Accepted Answer

The Prisma Access SSL decryption certificate is not trusted by the branch office computers because the root certificate was installed in the wrong certificate store.. Certificate errors on HTTPS sites while HTTP works indicate SSL decryption is occurring but the decryption certificate is not trusted. The Prisma Access forward trust certificate must be installed in the Trusted Root Certification Authorities store on clients. If Group Policy placed it in a different store, clients will not trust the decrypted connections, causing errors.

Answer

The branch office computers are not configured to use the PAC file for HTTPS, so they are bypassing Prisma Access and connecting directly, causing certificate errors.

Answer

The Prisma Access Explicit Proxy is not configured to decrypt HTTPS traffic, so it is passing through encrypted traffic and causing certificate errors.

Answer

The PAC file is not configured to handle HTTPS traffic, so it is bypassing the proxy for secure connections.

Question 15

A security engineer is configuring Prisma Access to provide secure access to a private application hosted in an on-premises data center. The application uses a custom TCP port and requires user identity-based access control. The engineer has already set up a service connection to the data center. Which additional configuration is required to allow mobile users to access the application with identity-based policies?

Accepted Answer

Configure an authentication profile and map users to groups in the identity provider, then reference those groups in security policies. Identity-based access control requires integration with an identity provider to map users to groups. Security policies can then reference those groups to permit or deny access. While a security policy rule is needed, it must be combined with identity mapping. HIP and URL filtering do not address user identity for a custom TCP application.

Answer

Create a security policy rule that allows the custom TCP port and apply it to the mobile users zone

Answer

Enable HIP checks and require a specific HIP profile for the application

Answer

Create a URL filtering profile that allows the application's FQDN and apply it to the mobile users